@profullstack/threatcrush 0.8.0 → 0.10.0

package/dist/index.js

@@ -9998,6 +9998,56 @@ var CODE_RULES = [
     severity: "high",
     pattern: /(?:token|secret|password|salt|nonce|session|otp|reset|apikey|api_key)[\w]*\s*[:=][^;\n]{0,60}(?:Math\s*\.\s*random\s*\(|\brandom\s*\.\s*(?:random|randint|choice)\s*\(|\brand\s*\()/i
   },
+  // ── Weak crypto: Python ──────────────────────────────────────────────────
+  //
+  // The generic rules above catch the credential case on the matched line.
+  // These cover what they miss in Python, where the security role of a value is
+  // set by the enclosing function rather than a same-line assignment — a
+  // `random`-drawn token that is *returned*, an MD5 used to *verify* an
+  // artifact — and the broken ciphers, which have no safe use at all.
+  {
+    id: "py-broken-cipher",
+    title: "broken cipher or ECB mode",
+    consequence: "DES, RC2, RC4 and Blowfish are broken or too small to rely on, and ECB encrypts identical plaintext blocks to identical ciphertext, so structure in the data survives encryption. None of them provides the confidentiality their use implies.",
+    cwe: "CWE-327",
+    severity: "high",
+    languages: ["python"],
+    // PyCryptodome/PyCrypto constructors. The mode matters only for AES, whose
+    // safe modes (GCM, CTR, CBC) are common — so AES matches solely on ECB,
+    // while DES/RC4/Blowfish are broken by the algorithm regardless of mode.
+    pattern: /\b(?:DES|DES3|ARC2|RC2|ARC4|RC4|Blowfish|XOR)\s*\.\s*new\s*\(|\bAES\s*\.\s*new\s*\([^)\n]*\bMODE_ECB\b/,
+    inherent: true,
+    guard: false
+  },
+  {
+    id: "py-weak-hash",
+    title: "broken hash algorithm",
+    consequence: "MD5 and SHA-1 have practical collisions, so a digest used for integrity or a signature can be forged to match a value the code trusts.",
+    cwe: "CWE-327",
+    severity: "medium",
+    languages: ["python"],
+    pattern: /\bhashlib\s*\.\s*(?:md5|sha1)\s*\(/,
+    // Python 3.9+ marks a non-security digest — a cache key, an ETag — with
+    // `usedforsecurity=False`, which is exactly the "this MD5 is not a security
+    // claim" signal, so it exempts the line rather than being flagged.
+    lineGuard: /usedforsecurity\s*=\s*False/
+  },
+  {
+    id: "py-predictable-random-seed",
+    title: "PRNG seeded from a predictable value",
+    consequence: "Seeding `random` from the clock or the process id makes its whole sequence reproducible, so anything drawn from it afterwards \u2014 a token, an id, a shuffle \u2014 can be regenerated by guessing the seed.",
+    cwe: "CWE-338",
+    severity: "high",
+    languages: ["python"],
+    // A time- or pid-derived seed, which is the predictable kind. A fixed
+    // integer seed (`random.seed(42)`) is deliberate reproducibility for tests
+    // and simulations, so it is left alone. This needs no credential context:
+    // seeding the global PRNG from the clock is a weakness on its own terms,
+    // which is why the enclosing function's name — that this engine does not
+    // read as evidence anyway — is not consulted.
+    pattern: /\brandom\s*\.\s*seed\s*\([^)\n]*(?:time\s*\.\s*time|datetime|\.\s*now\s*\(|getpid)/,
+    inherent: true
+  },
   {
     id: "redos-nested-quantifier",
     title: "regex with nested unbounded quantifiers",
@@ -10355,6 +10405,155 @@ var CODE_RULES = [
     // constant the author wrote and is not a finding.
     pattern: /\btemplate\s*\.\s*(?:HTML|JS|CSS|HTMLAttr|URL|Srcset)\s*\(\s*(?!\s*[`"])/,
     needsContext: true
+  },
+  // ── Misconfiguration, weak crypto and the rest of the injection family ────
+  //
+  // Each of these is a defect the *line* shows — a debug flag left on, a
+  // wildcard CORS origin, a key literal, a fast password hash — so the safe
+  // counterpart in the corpus differs on something visible here, not three
+  // functions away. The classes that genuinely need whole-function reasoning
+  // (CSRF, IDOR, TOCTOU, missing authorization) are deliberately still absent;
+  // see KNOWN_GAPS.
+  {
+    id: "py-framework-debug-enabled",
+    title: "debug mode enabled",
+    consequence: "Framework debug mode serves an interactive traceback console on any error \u2014 arbitrary code execution to whoever triggers it \u2014 and leaks source and configuration.",
+    cwe: "CWE-489",
+    severity: "high",
+    languages: ["python"],
+    pattern: /\bDEBUG['"\]]*\s*[=:]\s*True\b|\.\s*run\s*\([^)\n]*\bdebug\s*=\s*True\b/,
+    inherent: true
+  },
+  {
+    id: "js-cors-wildcard-credentials",
+    title: "wildcard CORS origin with credentials",
+    consequence: "A `*` origin combined with credentials lets any site read authenticated responses on the victim\u2019s behalf: the browser attaches their cookies and hands the result to the attacker\u2019s page.",
+    cwe: "CWE-942",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /origin\s*:\s*['"`]\*['"`][^\n]*credentials\s*:\s*true|credentials\s*:\s*true[^\n]*origin\s*:\s*['"`]\*['"`]/,
+    inherent: true
+  },
+  {
+    id: "js-cookie-insecure-flag",
+    title: "cookie set with Secure disabled",
+    consequence: "Without Secure the cookie travels over plain HTTP, where anyone on the path reads it. A session cookie set this way is a session anyone can lift.",
+    cwe: "CWE-614",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    pattern: /\.\s*cookie\s*\([^\n]*\bsecure\s*:\s*false\b/i
+  },
+  {
+    id: "js-hardcoded-crypto-key",
+    title: "hardcoded key material",
+    consequence: "A key committed to source is a key everyone with the repo has. The encryption it backs protects nothing once the source is shared, forked or leaked.",
+    cwe: "CWE-321",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\b(?:key|secret|iv|passphrase|salt|hmac)\w*\s*=\s*Buffer\s*\.\s*from\s*\(\s*['"`]/i,
+    fileRequires: /\bcrypto\b|createCipheriv|createDecipheriv|createHmac/
+  },
+  {
+    id: "py-hardcoded-secret-key",
+    title: "hardcoded application secret",
+    consequence: "A signing secret in source lets anyone with the code forge what it signs \u2014 session cookies, tokens, password-reset links.",
+    cwe: "CWE-798",
+    severity: "high",
+    languages: ["python"],
+    // Assigned a *string literal*. A value from a provider call (`os.environ`,
+    // `secret_provider(...)`) is the correct shape and starts with an
+    // identifier after the `=`, not a quote.
+    pattern: /\b(?:SECRET_KEY|JWT_SECRET|SIGNING_KEY|SESSION_SECRET|PRIVATE_KEY)['"\]]*\s*[=:]\s*['"`][^'"`\n]{6,}/
+  },
+  {
+    id: "py-ldap-injection",
+    title: "LDAP filter built by interpolation",
+    consequence: "Unescaped input in an LDAP filter lets an attacker rewrite the query \u2014 widening a match, bypassing a check, or enumerating the directory.",
+    cwe: "CWE-90",
+    severity: "high",
+    languages: ["python"],
+    // An f-string whose content is an LDAP filter (`(&…` / `(|…`) with an
+    // interpolation. The safe form escapes, so the window carries an escaper.
+    pattern: /\bf['"][^'"\n]*\([&|][^'"\n]*\{[^}\n]+\}/,
+    guard: /escap/i
+  },
+  {
+    id: "py-xpath-injection",
+    title: "XPath built by interpolation",
+    consequence: "Unescaped input in an XPath expression lets an attacker rewrite the query and read nodes it was meant to exclude.",
+    cwe: "CWE-643",
+    severity: "high",
+    languages: ["python"],
+    pattern: /\bf['"][^'"\n]*(?:\/\/|\/\w+\[)[^'"\n]*\{[^}\n]+\}/
+  },
+  {
+    id: "py-fast-password-hash",
+    title: "password hashed with a fast digest",
+    consequence: "SHA-2 is built to be fast, which is exactly wrong for a password: a leaked hash is brute-forced at billions of guesses a second. Passwords need a slow, salted KDF (bcrypt, scrypt, argon2, PBKDF2).",
+    cwe: "CWE-759",
+    severity: "high",
+    languages: ["python"],
+    pattern: /\bhashlib\s*\.\s*(?:sha224|sha256|sha384|sha512)\s*\([^)\n]*(?:password|passwd|passphrase|pwd)/i,
+    guard: /pbkdf2|scrypt|bcrypt|argon/i
+  },
+  {
+    id: "py-plaintext-password-retained",
+    title: "plaintext password stored",
+    consequence: "A record that keeps the password itself, not a hash, turns one database leak into every user\u2019s credential \u2014 reused across every other site they log into.",
+    cwe: "CWE-256",
+    severity: "high",
+    languages: ["python"],
+    pattern: /['"]password['"]\s*:\s*(?:form|request|req|data|payload|body|params)\b/i
+  },
+  {
+    id: "js-timing-unsafe-mac-compare",
+    title: "MAC or signature compared with ==",
+    consequence: "`===` on a signature returns the moment a byte differs, so response time leaks how much of a forged signature is correct \u2014 enough to recover a valid one byte by byte. Use `crypto.timingSafeEqual`.",
+    cwe: "CWE-208",
+    severity: "medium",
+    languages: ["javascript", "typescript"],
+    pattern: /\b\w*(?:[Ss]ignature|[Hh]mac|[Dd]igest)\s*===?\s*\w|\w\s*===?\s*\w*(?:[Ss]ignature|[Hh]mac|[Dd]igest)\b/,
+    // Comparing `.length` is the *safe* preamble to a constant-time check, not
+    // the timing-unsafe value comparison this rule is about — and the
+    // `timingSafeEqual` that follows it sits forward of the line, out of the
+    // backward guard window.
+    lineGuard: /\.\s*length\b/,
+    guard: /timingSafeEqual/
+  },
+  {
+    id: "js-predictable-cipher-iv",
+    title: "static initialization vector",
+    consequence: "A fixed IV reused across encryptions leaks whether two plaintexts are equal and, in CBC/CTR, breaks confidentiality outright. The IV must be random per message.",
+    cwe: "CWE-329",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\b\w*[Ii][Vv]\s*=\s*Buffer\s*\.\s*(?:alloc|from)\s*\(/,
+    fileRequires: /createCipheriv|\bcrypto\b/,
+    guard: /randomBytes|randomFill/
+  },
+  // A rule for `Math.random().toString(36)` was tried and dropped: the exact
+  // shape generates security tokens *and* benign callback/correlation ids
+  // (Capacitor's native bridge uses it for the latter), with no line-visible
+  // signal between them. The credential-scoped `insecure-randomness-for-secret`
+  // above still catches the `token = …Math.random…` case; the bare shape is
+  // left alone rather than flagged on every id generator.
+  {
+    id: "js-mass-assignment",
+    title: "mass assignment from request data",
+    consequence: "Copying the whole request body onto a record lets a caller set fields you never exposed \u2014 `isAdmin`, `role`, `balance` \u2014 because nothing stands between the input and the object.",
+    cwe: "CWE-915",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\bObject\s*\.\s*assign\s*\([^,\n]+,\s*(?:req|request|ctx)\s*\.\s*(?:body|query|params)\b/
+  },
+  {
+    id: "js-header-injection",
+    title: "response header set from request input",
+    consequence: "A CR/LF in the value splits the response \u2014 the attacker injects headers or a whole second response (cache poisoning, a forged Set-Cookie).",
+    cwe: "CWE-113",
+    severity: "high",
+    languages: ["javascript", "typescript"],
+    pattern: /\.\s*(?:setHeader|header|set)\s*\(\s*['"`][^'"`\n]+['"`]\s*,\s*(?:req|request|ctx)\s*\.\s*(?:query|body|params|headers)\b/
   }
 ];
 var COMMENT_PREFIX = /^\s*(?:\/\/|\/\*|\*|#|--|<!--)/;