@profullstack/threatcrush 0.7.2 → 0.9.0

package/dist/index.js

@@ -9998,6 +9998,56 @@ var CODE_RULES = [
     severity: "high",
     pattern: /(?:token|secret|password|salt|nonce|session|otp|reset|apikey|api_key)[\w]*\s*[:=][^;\n]{0,60}(?:Math\s*\.\s*random\s*\(|\brandom\s*\.\s*(?:random|randint|choice)\s*\(|\brand\s*\()/i
   },
+  // ── Weak crypto: Python ──────────────────────────────────────────────────
+  //
+  // The generic rules above catch the credential case on the matched line.
+  // These cover what they miss in Python, where the security role of a value is
+  // set by the enclosing function rather than a same-line assignment — a
+  // `random`-drawn token that is *returned*, an MD5 used to *verify* an
+  // artifact — and the broken ciphers, which have no safe use at all.
+  {
+    id: "py-broken-cipher",
+    title: "broken cipher or ECB mode",
+    consequence: "DES, RC2, RC4 and Blowfish are broken or too small to rely on, and ECB encrypts identical plaintext blocks to identical ciphertext, so structure in the data survives encryption. None of them provides the confidentiality their use implies.",
+    cwe: "CWE-327",
+    severity: "high",
+    languages: ["python"],
+    // PyCryptodome/PyCrypto constructors. The mode matters only for AES, whose
+    // safe modes (GCM, CTR, CBC) are common — so AES matches solely on ECB,
+    // while DES/RC4/Blowfish are broken by the algorithm regardless of mode.
+    pattern: /\b(?:DES|DES3|ARC2|RC2|ARC4|RC4|Blowfish|XOR)\s*\.\s*new\s*\(|\bAES\s*\.\s*new\s*\([^)\n]*\bMODE_ECB\b/,
+    inherent: true,
+    guard: false
+  },
+  {
+    id: "py-weak-hash",
+    title: "broken hash algorithm",
+    consequence: "MD5 and SHA-1 have practical collisions, so a digest used for integrity or a signature can be forged to match a value the code trusts.",
+    cwe: "CWE-327",
+    severity: "medium",
+    languages: ["python"],
+    pattern: /\bhashlib\s*\.\s*(?:md5|sha1)\s*\(/,
+    // Python 3.9+ marks a non-security digest — a cache key, an ETag — with
+    // `usedforsecurity=False`, which is exactly the "this MD5 is not a security
+    // claim" signal, so it exempts the line rather than being flagged.
+    lineGuard: /usedforsecurity\s*=\s*False/
+  },
+  {
+    id: "py-predictable-random-seed",
+    title: "PRNG seeded from a predictable value",
+    consequence: "Seeding `random` from the clock or the process id makes its whole sequence reproducible, so anything drawn from it afterwards \u2014 a token, an id, a shuffle \u2014 can be regenerated by guessing the seed.",
+    cwe: "CWE-338",
+    severity: "high",
+    languages: ["python"],
+    // A time- or pid-derived seed, which is the predictable kind. A fixed
+    // integer seed (`random.seed(42)`) is deliberate reproducibility for tests
+    // and simulations, so it is left alone. This needs no credential context:
+    // seeding the global PRNG from the clock is a weakness on its own terms,
+    // which is why the enclosing function's name — that this engine does not
+    // read as evidence anyway — is not consulted.
+    pattern: /\brandom\s*\.\s*seed\s*\([^)\n]*(?:time\s*\.\s*time|datetime|\.\s*now\s*\(|getpid)/,
+    inherent: true
+  },
   {
     id: "redos-nested-quantifier",
     title: "regex with nested unbounded quantifiers",
@@ -11141,6 +11191,81 @@ function meetsFailThreshold(findings, threshold) {
 // ../../packages/scan/src/node/walk.ts
 var import_node_fs5 = require("fs");
 var import_node_path2 = require("path");
+function compileExcludes(patterns) {
+  const matchers = patterns.map((p) => p.trim()).filter((p) => p.length > 0 && !p.startsWith("#")).map(compilePattern);
+  if (matchers.length === 0) return () => false;
+  return (relPath) => {
+    const segs = relPath.split("/");
+    return matchers.some((m) => m(segs));
+  };
+}
+var GLOBSTAR = /* @__PURE__ */ Symbol("globstar");
+function compilePattern(pattern) {
+  const withoutLead = pattern.replace(/^\.?\//, "");
+  let end = withoutLead.length;
+  while (end > 0 && withoutLead[end - 1] === "/") end -= 1;
+  const p = withoutLead.slice(0, end);
+  if (!p.includes("/")) {
+    if (p === "**") return () => true;
+    const rx = segToRegExp(p);
+    return (segs) => segs.some((s) => rx.test(s));
+  }
+  const raw = p.split("/");
+  const trailingGlobstar = raw[raw.length - 1] === "**";
+  const core = trailingGlobstar ? raw.slice(0, -1) : raw;
+  const parts = core.map((s) => s === "**" ? GLOBSTAR : segToRegExp(s));
+  return (segs) => {
+    const end2 = matchPrefix(parts, segs);
+    if (end2 < 0) return false;
+    return trailingGlobstar ? end2 < segs.length : true;
+  };
+}
+function segToRegExp(seg) {
+  let body = "";
+  for (let i = 0; i < seg.length; i += 1) {
+    const c = seg[i];
+    if (c === "*") {
+      while (seg[i + 1] === "*") i += 1;
+      body += "[^/]*";
+    } else if (c === "?") {
+      body += "[^/]";
+    } else {
+      body += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${body}$`);
+}
+function matchPrefix(parts, segs) {
+  let pi = 0;
+  let si = 0;
+  let star = -1;
+  let starSi = -1;
+  while (pi < parts.length) {
+    const part = parts[pi];
+    if (part === GLOBSTAR) {
+      star = pi;
+      starSi = si;
+      pi += 1;
+    } else if (si < segs.length && part.test(segs[si])) {
+      pi += 1;
+      si += 1;
+    } else if (star !== -1 && starSi < segs.length) {
+      starSi += 1;
+      si = starSi;
+      pi = star + 1;
+    } else {
+      return -1;
+    }
+  }
+  return si;
+}
+function readIgnoreFile(root) {
+  try {
+    return (0, import_node_fs5.readFileSync)((0, import_node_path2.join)(root, ".threatcrushignore"), "utf-8").split("\n");
+  } catch {
+    return [];
+  }
+}
 function scanPath(targetPath, options = {}) {
   const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;
   const allowed = options.categories ? new Set(options.categories) : null;
@@ -11148,6 +11273,7 @@ function scanPath(targetPath, options = {}) {
   const unreadable = [];
   let filesScanned = 0;
   let suppressed = 0;
+  let excluded = 0;
   const rootIsDirectory = (() => {
     try {
       return (0, import_node_fs5.statSync)(targetPath).isDirectory();
@@ -11156,6 +11282,7 @@ function scanPath(targetPath, options = {}) {
     }
   })();
   const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path2.dirname)(targetPath);
+  const isExcluded = compileExcludes([...options.exclude ?? [], ...readIgnoreFile(walkRoot)]);
   const scanFile = (fullPath, filename) => {
     const relativePath = toRelative(walkRoot, fullPath);
     const extension = (0, import_node_path2.extname)(filename).toLowerCase();
@@ -11213,17 +11340,28 @@ function scanPath(targetPath, options = {}) {
     }
     for (const entry of entries) {
       const fullPath = (0, import_node_path2.join)(currentPath, entry.name);
+      const relativePath = toRelative(walkRoot, fullPath);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
+        if (isExcluded(relativePath)) {
+          excluded += 1;
+          continue;
+        }
         walk(fullPath);
         continue;
       }
       if (!entry.isFile()) continue;
+      if (isExcluded(relativePath)) {
+        excluded += 1;
+        continue;
+      }
       scanFile(fullPath, entry.name);
     }
   };
   if (rootIsDirectory) {
     walk(targetPath);
+  } else if (isExcluded(toRelative(walkRoot, targetPath))) {
+    excluded += 1;
   } else {
     scanFile(targetPath, (0, import_node_path2.basename)(targetPath));
   }
@@ -11231,7 +11369,7 @@ function scanPath(targetPath, options = {}) {
   filtered.sort(
     (a, b) => severityRank(b.severity) - severityRank(a.severity) || a.file.localeCompare(b.file) || a.line - b.line
   );
-  return { findings: filtered, filesScanned, unreadable, suppressed, root: walkRoot };
+  return { findings: filtered, filesScanned, unreadable, suppressed, excluded, root: walkRoot };
 }
 function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
   if (fileFindings.length > 0) return;
@@ -11580,6 +11718,7 @@ async function scanCommand(targetPath, options = {}) {
   try {
     let seen = 0;
     const report = scanPath(targetPath, {
+      exclude: options.exclude,
       onFile: () => {
         seen += 1;
         if (spinner) spinner.text = `Scanning files... (${seen} files)`;
@@ -11595,6 +11734,7 @@ async function scanCommand(targetPath, options = {}) {
       filesScanned: report.filesScanned,
       unreadable: report.unreadable,
       suppressed: report.suppressed,
+      excluded: report.excluded,
       root: report.root
     };
   } catch (err) {
@@ -11614,6 +11754,13 @@ async function scanCommand(targetPath, options = {}) {
       for (const path of outcome.unreadable) say(source_default.gray(`      ${path}`));
     }
   }
+  if (outcome.excluded > 0) {
+    say(
+      source_default.gray(
+        `  \xB7 ${outcome.excluded} path(s) excluded by --exclude or .threatcrushignore`
+      )
+    );
+  }
   if (outcome.suppressed > 0) {
     say(
       source_default.gray(
@@ -17245,7 +17392,12 @@ program2.command("scan").description("Scan codebase for vulnerabilities and secr
 ).option(
   "--path-prefix <prefix>",
   "prepend this to SARIF file URIs \u2014 use when the scan root is not the repository root"
-).option("--deps", "also query OSV.dev for advisories against lockfile versions (network)").option("-v, --verbose", "list the paths that could not be read").action(async (targetPath, opts) => {
+).option("--deps", "also query OSV.dev for advisories against lockfile versions (network)").option(
+  "--exclude <glob>",
+  "skip paths matching this glob (repeatable); merged with a .threatcrushignore at the scan root",
+  (value, previous) => [...previous, value],
+  []
+).option("-v, --verbose", "list the paths that could not be read").action(async (targetPath, opts) => {
   const format = (opts.format ?? "text").toLowerCase();
   if (!["text", "json", "sarif"].includes(format)) {
     console.error(source_default.red(`Unknown --format "${opts.format}" (expected text, json, or sarif)`));
@@ -17264,6 +17416,7 @@ program2.command("scan").description("Scan codebase for vulnerabilities and secr
     failOn,
     pathPrefix: opts.pathPrefix,
     dependencies: opts.deps,
+    exclude: opts.exclude,
     verbose: opts.verbose
   });
 });