@profullstack/threatcrush 0.3.0 → 0.4.0

package/dist/daemon.js

@@ -4426,7 +4426,7 @@ function severityFor(declared, confidence) {
 }
 
 // src/scan/code-rules.ts
-var UNTRUSTED_JS = /\b(?:req|request|ctx|context)\s*\.\s*(?:body|query|params|param|headers|cookies|url|files)\b|\bprocess\.argv\b|\bwindow\.location\b|\bdocument\.location\b|\blocation\.(?:search|hash|href)\b|\bsearchParams\b|\bgetParameter\s*\(|\bgetQueryString\s*\(|\bgetInputStream\s*\(/;
+var UNTRUSTED_JS = /\b(?:req|request|ctx|context)\s*\.\s*(?:body|query|params|param|headers|cookies|url|files)\b|\bprocess\.argv\b|\bwindow\.location\b|\bdocument\.location\b|\blocation\.(?:search|hash|href)\b|\bsearchParams\s*\.\s*(?:get|getAll|has|entries|keys|values|forEach)\b|\bgetParameter\s*\(|\bgetQueryString\s*\(|\bgetInputStream\s*\(/;
 var UNTRUSTED_PY = /\brequest\b|\bparams\b|\bflask\b|\bsys\.argv\b|\bos\.environ\b\s*\[/;
 var UNTRUSTED_RB = /\bparams\s*\[|\brequest\b|\bcookies\s*\[/;
 var UNTRUSTED_GO = /\br\s*\.\s*(?:URL|Form|Body|Header|PostForm)\b|\bFormValue\s*\(|\bQuery\s*\(\s*\)\s*\.\s*Get\s*\(|\bmux\.Vars\s*\(/;
@@ -4445,7 +4445,17 @@ function untrustedPatternFor(language) {
       return UNTRUSTED_JS;
   }
 }
-var GENERIC_GUARD = /\ballow(?:ed|list|_list|ed_hosts)?\b|\bwhitelist\b|\bescape(?:Html|Html4|Xml|Sql)?\s*\(|\bhtml_escape\b|\bhtmlspecialchars\s*\(|\bsanitiz\w*\b|\bencoded\b|\brealpath\b|\bcommonpath\b|\bresolve\(\)\.startsWith\b|\bprocess\.env\b|\bos\.environ\b|\bgetenv\b|\bENV\s*\[|setObjectInputFilter|ObjectInputFilter/i;
+var GENERIC_GUARD = (
+  // `esc(`, `aEsc(`, `htmlEscape(`, `escapeHtml(` — the escaper is almost
+  // never *named* `escapeHtml` in real code. It gets aliased to something
+  // short because it is called on nearly every interpolation, so matching only
+  // the long spellings reported the codebases that escape most rigorously.
+  //
+  // The identifier must END at the escaper (with at most a known output-context
+  // suffix). An earlier, looser form also matched `describe(`, which would have
+  // silenced findings across every test file in every repository.
+  /\ballow(?:ed|list|_list|ed_hosts)?\b|\bwhitelist\b|\b\w{0,6}[Ee]sc(?:ape)?(?:[Hh]tml|HTML|[Xx]ml|XML|[Ss]ql|[Aa]ttr|[Jj]s|[Uu]ri|[Uu]rl)?\s*\(|\bhtml_escape\b|\bhtmlspecialchars\s*\(|\bsanitiz\w*\b|\bencoded\b|\brealpath\b|\bcommonpath\b|\bresolve\(\)\.startsWith\b|\bprocess\.env\b|\bos\.environ\b|\bgetenv\b|\bENV\s*\[|setObjectInputFilter|ObjectInputFilter/i
+);
 var XXE_GUARD = /FEATURE_SECURE_PROCESSING|setExpandEntityReferences|disallow-doctype-decl|external-general-entities|external-parameter-entities|setXIncludeAware\s*\(\s*false/;
 var CODE_SINK = /\bglobalThis\s*\[|\bconstructor\b|\beval\b|\bFunction\b|\brun\s*\(|\bvm\s*\.\s*run/;
 var EXFIL_SINK = /\bconsole\s*\.\s*(?:log|debug|info|warn|error)\s*\(|\bfetch\s*\(|\baxios\b|\brequest\s*\(|\.\s*send\s*\(/;
@@ -4596,7 +4606,17 @@ var CODE_RULES = [
     cwe: "CWE-79",
     severity: "high",
     languages: ["javascript", "typescript"],
-    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=\s*(?!\s*['"`]\s*['"`]\s*;?\s*$)|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/
+    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=\s*(?!\s*['"`]\s*['"`]\s*;?\s*$)|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/,
+    /**
+     * A whole-statement assignment of a string with no interpolation and no
+     * concatenation carries no data, so it cannot carry attacker data. This
+     * was the single largest source of noise: a codebase that builds its UI
+     * with innerHTML reports every static heading and spinner as XSS, and a
+     * rule that flags 40 safe lines to catch one real one gets switched off.
+     *
+     * Line-scoped on purpose — see `lineGuard`.
+     */
+    lineGuard: /(?:innerHTML|outerHTML)\s*=\s*(?:'[^'\\]*'|"[^"\\]*"|`[^`$\\]*`)\s*;?\s*$/
   },
   {
     id: "java-html-writer-concatenation",
@@ -4903,6 +4923,7 @@ function evaluateRule(rule, ctx) {
   const forward = rule.guardForward ?? 0;
   const context = windowText(ctx.lines, ctx.index, back, forward, ctx.prose);
   if (rule.requires && !rule.requires.test(context)) return null;
+  if (rule.lineGuard?.test(line)) return null;
   const guard = rule.guard === void 0 ? GENERIC_GUARD : rule.guard;
   if (guard && (guard.test(line) || guard.test(context))) return null;
   const untrusted = untrustedPatternFor(ctx.language);
@@ -5504,10 +5525,15 @@ function isSuppressed(suppressions, index, ruleId) {
   if (!rules) return false;
   return rules.has("*") || rules.has(ruleId);
 }
+function isTestPath(relativePath) {
+  const p = relativePath.replace(/\\/g, "/");
+  return /(?:^|\/)(?:tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|e2e|testdata)\//i.test(p) || /(?:^|\/)(?:test|conftest)_[^/]+$/i.test(p) || /[._-](?:test|spec)\.[a-z]+$/i.test(p) || /_test\.[a-z]+$/i.test(p);
+}
 function scanText(relativePath, text, language = languageOf(relativePath)) {
   const findings = [];
   const lines = text.split("\n");
   const suppressions = collectSuppressions(lines);
+  const inTests = isTestPath(relativePath);
   lines.forEach((line, index) => {
     for (const rule of SECRET_RULES) {
       const match = rule.pattern.exec(line);
@@ -5519,10 +5545,11 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
         title: rule.name,
         file: relativePath,
         line: index + 1,
-        severity: rule.severity,
+        // Reported but not blocking in tests — see isTestPath.
+        severity: inTests ? "low" : rule.severity,
         // A matched credential format is the finding, not a proxy for one.
         confidence: "evidence",
-        message: `Possible ${rule.name} detected`,
+        message: inTests ? `Possible ${rule.name} detected in a test file \u2014 usually a fixture, still worth confirming it is not a live credential` : `Possible ${rule.name} detected`,
         consequence: rule.consequence,
         cwe: rule.cwe,
         excerpt: redactSecret(line.trim()).slice(0, 200),