@quantakrypto/core 0.4.3 → 0.5.0

package/dist/detectors/cicd.js

@@ -0,0 +1,129 @@
+import { eachMatch, findingFromRule, maskCommentLines } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+/** True for the CI/CD pipeline definition files this detector inspects. */
+function isCiPipelineFile(filePath) {
+    const lower = filePath.toLowerCase();
+    const base = lower.split("/").pop() ?? lower;
+    return ((lower.includes(".github/workflows/") && (lower.endsWith(".yml") || lower.endsWith(".yaml"))) ||
+        base === ".gitlab-ci.yml" ||
+        lower.endsWith(".gitlab-ci.yml") ||
+        base === "jenkinsfile" ||
+        lower.endsWith(".jenkinsfile") ||
+        base === "azure-pipelines.yml" ||
+        base === "azure-pipelines.yaml" ||
+        (lower.includes(".circleci/") && (lower.endsWith(".yml") || lower.endsWith(".yaml"))));
+}
+const CI_RULES = [
+    {
+        // `sign-blob` precedes `sign` so the longer subcommand wins — otherwise `sign`
+        // matches first and the trailing `\b` succeeds at the `-`, never reaching `sign-blob`.
+        re: /\bcosign\s+(?:sign-blob|sign|attest|generate-key-pair)\b/g,
+        meta: {
+            id: "ci-cosign-ecdsa",
+            title: "cosign artifact signing (ECDSA)",
+            description: "sigstore/cosign signing in a CI pipeline",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "ECDSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "CI pipeline signs artifacts with cosign (ECDSA P-256, key-based or keyless/Fulcio); classical signatures are forgeable once a CRQC exists.",
+            remediation: "Track sigstore's post-quantum signing roadmap (ML-DSA); plan hybrid signing for long-lived release artifacts.",
+        },
+    },
+    {
+        // Bound the span to the gpg invocation ([^\n&|;] stops it crossing `&&`/`|`/`;`
+        // into another command's flag), and `(?![\w-])` stops `--sign` matching the
+        // `--sign` prefix of an unrelated flag like `--sign-artifacts`. The short forms
+        // `-s` (sign) / `-b` (detach-sign) are safe inside the bounded gpg span.
+        re: /\bgpg\b[^\n&|;]{0,120}?\s(?:-[sb]\b|--(?:detach-sign|clearsign|sign)(?![\w-]))/g,
+        meta: {
+            id: "ci-gpg-sign",
+            title: "GPG signing (RSA)",
+            description: "GnuPG detached/clear signing in a CI pipeline",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "CI pipeline signs with GPG, classically an RSA signing key; forgeable once a CRQC exists.",
+            remediation: "Plan migration to ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205) signatures.",
+        },
+    },
+    {
+        re: /\bjarsigner\b/g,
+        meta: {
+            id: "ci-jarsigner",
+            title: "Java jarsigner (classical)",
+            description: "JDK jarsigner code signing in a CI pipeline",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "CI pipeline signs JARs with jarsigner (classical RSA/DSA/EC signing key); forgeable once a CRQC exists.",
+            remediation: "Plan migration to a PQC signature scheme (ML-DSA-65 / SLH-DSA) as the JDK adds support.",
+        },
+    },
+    {
+        // Allow intervening flags (the common `codesign --force --options runtime --sign`
+        // form), bounded to the codesign invocation so it can't latch onto a later
+        // command's `--sign` across `&&`/`|`/`;`.
+        re: /\bcodesign\b[^\n&|;]{0,120}?\s(?:-s\b|--sign\b)/g,
+        meta: {
+            id: "ci-codesign",
+            title: "Apple codesign (RSA)",
+            description: "Apple codesign in a CI pipeline",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "CI pipeline signs with Apple codesign (classical RSA signing identity); forgeable once a CRQC exists.",
+            remediation: "Classical only today; track Apple's PQC signing support and plan migration.",
+        },
+    },
+    {
+        re: /\bminisign\b/g,
+        meta: {
+            id: "ci-minisign",
+            title: "minisign (Ed25519)",
+            description: "minisign signing in a CI pipeline",
+            category: "signature",
+            severity: "low",
+            confidence: "high",
+            algorithm: "EdDSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "CI pipeline signs with minisign (Ed25519); modern but classical and forgeable once a CRQC exists.",
+            remediation: "Plan migration to ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+        },
+    },
+];
+/** Detects classical artifact / code signing in CI/CD pipeline definitions. */
+export const cicdDetector = {
+    id: "cicd-signing",
+    description: "Classical artifact / code signing in CI/CD pipelines",
+    scope: "config",
+    language: "any",
+    rules: CI_RULES.map((r) => r.meta),
+    appliesTo: isCiPipelineFile,
+    detect({ file, content }) {
+        const findings = [];
+        // A commented-out CI step (`# - run: cosign sign …`, or a `//` line in a
+        // Jenkinsfile) is not an active signing step. Mask comment lines first; offsets
+        // are preserved so the snippet from the original `content` stays correct.
+        const scan = maskCommentLines(content, ["#", "//"]);
+        for (const rule of CI_RULES) {
+            eachMatch(rule.re, scan, (m) => {
+                findings.push(findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }));
+            });
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=cicd.js.map

package/dist/detectors/cicd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cicd.js","sourceRoot":"","sources":["../../src/detectors/cicd.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC;IAC7C,OAAO,CACL,CAAC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7F,IAAI,KAAK,gBAAgB;QACzB,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAChC,IAAI,KAAK,aAAa;QACtB,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC9B,IAAI,KAAK,qBAAqB;QAC9B,IAAI,KAAK,sBAAsB;QAC/B,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CACtF,CAAC;AACJ,CAAC;AAOD,MAAM,QAAQ,GAAa;IACzB;QACE,+EAA+E;QAC/E,uFAAuF;QACvF,EAAE,EAAE,2DAA2D;QAC/D,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,iCAAiC;YACxC,WAAW,EAAE,0CAA0C;YACvD,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,4IAA4I;YAC9I,WAAW,EACT,+GAA+G;SAClH;KACF;IACD;QACE,gFAAgF;QAChF,4EAA4E;QAC5E,gFAAgF;QAChF,yEAAyE;QACzE,EAAE,EAAE,iFAAiF;QACrF,IAAI,EAAE;YACJ,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EAAE,+CAA+C;YAC5D,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,2FAA2F;YAC7F,WAAW,EAAE,0EAA0E;SACxF;KACF;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE;YACJ,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,6CAA6C;YAC1D,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,yGAAyG;YAC3G,WAAW,EACT,yFAAyF;SAC5F;KACF;IACD;QACE,kFAAkF;QAClF,2EAA2E;QAC3E,0CAA0C;QAC1C,EAAE,EAAE,kDAAkD;QACtD,IAAI,EAAE;YACJ,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,iCAAiC;YAC9C,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,uGAAuG;YACzG,WAAW,EAAE,6EAA6E;SAC3F;KACF;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE;YACJ,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,mCAAmC;YAChD,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,mGAAmG;YACrG,WAAW,EAAE,+DAA+D;SAC7E;KACF;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,sDAAsD;IACnE,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,SAAS,EAAE,gBAAgB;IAC3B,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,yEAAyE;QACzE,gFAAgF;QAChF,0EAA0E;QAC1E,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBAC7B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACxF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical signing of build artifacts and code in CI/CD\n * pipelines (GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI).\n *\n * Artifact and code signatures are the signature-side analogue of \"harvest now,\n * decrypt later\": a release signed today with a classical key is *forgeable* once\n * a CRQC exists, and long-lived artifacts (container images, released binaries,\n * SBOM attestations) keep verifying against that classical public key for years.\n * So these are flagged `hndl:false` (a signature is not confidentiality — nothing\n * to harvest) but remain real quantum-migration debt.\n *\n * Covered command invocations (distinctive enough inside a CI file that the\n * false-positive risk is low):\n *  - `cosign sign|attest|generate-key-pair`  → sigstore/cosign uses ECDSA P-256\n *    (both key-based and keyless/Fulcio).\n *  - `gpg --detach-sign|--clearsign|--sign`   → GnuPG, classically RSA.\n *  - `jarsigner`                              → Java JAR signing (RSA/DSA/EC).\n *  - `codesign --sign|-s`                     → Apple code signing (RSA).\n *  - `minisign`                               → Ed25519 signatures.\n *\n * Gated to CI/CD pipeline files so `gpg`/`cosign` mentioned in a shell script or\n * doc does not fire; the surface here is specifically the release pipeline.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule, maskCommentLines } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n/** True for the CI/CD pipeline definition files this detector inspects. */\nfunction isCiPipelineFile(filePath: string): boolean {\n  const lower = filePath.toLowerCase();\n  const base = lower.split(\"/\").pop() ?? lower;\n  return (\n    (lower.includes(\".github/workflows/\") && (lower.endsWith(\".yml\") || lower.endsWith(\".yaml\"))) ||\n    base === \".gitlab-ci.yml\" ||\n    lower.endsWith(\".gitlab-ci.yml\") ||\n    base === \"jenkinsfile\" ||\n    lower.endsWith(\".jenkinsfile\") ||\n    base === \"azure-pipelines.yml\" ||\n    base === \"azure-pipelines.yaml\" ||\n    (lower.includes(\".circleci/\") && (lower.endsWith(\".yml\") || lower.endsWith(\".yaml\")))\n  );\n}\n\ninterface CiRule {\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst CI_RULES: CiRule[] = [\n  {\n    // `sign-blob` precedes `sign` so the longer subcommand wins — otherwise `sign`\n    // matches first and the trailing `\\b` succeeds at the `-`, never reaching `sign-blob`.\n    re: /\\bcosign\\s+(?:sign-blob|sign|attest|generate-key-pair)\\b/g,\n    meta: {\n      id: \"ci-cosign-ecdsa\",\n      title: \"cosign artifact signing (ECDSA)\",\n      description: \"sigstore/cosign signing in a CI pipeline\",\n      category: \"signature\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"ECDSA\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"CI pipeline signs artifacts with cosign (ECDSA P-256, key-based or keyless/Fulcio); classical signatures are forgeable once a CRQC exists.\",\n      remediation:\n        \"Track sigstore's post-quantum signing roadmap (ML-DSA); plan hybrid signing for long-lived release artifacts.\",\n    },\n  },\n  {\n    // Bound the span to the gpg invocation ([^\\n&|;] stops it crossing `&&`/`|`/`;`\n    // into another command's flag), and `(?![\\w-])` stops `--sign` matching the\n    // `--sign` prefix of an unrelated flag like `--sign-artifacts`. The short forms\n    // `-s` (sign) / `-b` (detach-sign) are safe inside the bounded gpg span.\n    re: /\\bgpg\\b[^\\n&|;]{0,120}?\\s(?:-[sb]\\b|--(?:detach-sign|clearsign|sign)(?![\\w-]))/g,\n    meta: {\n      id: \"ci-gpg-sign\",\n      title: \"GPG signing (RSA)\",\n      description: \"GnuPG detached/clear signing in a CI pipeline\",\n      category: \"signature\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"CI pipeline signs with GPG, classically an RSA signing key; forgeable once a CRQC exists.\",\n      remediation: \"Plan migration to ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205) signatures.\",\n    },\n  },\n  {\n    re: /\\bjarsigner\\b/g,\n    meta: {\n      id: \"ci-jarsigner\",\n      title: \"Java jarsigner (classical)\",\n      description: \"JDK jarsigner code signing in a CI pipeline\",\n      category: \"signature\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"CI pipeline signs JARs with jarsigner (classical RSA/DSA/EC signing key); forgeable once a CRQC exists.\",\n      remediation:\n        \"Plan migration to a PQC signature scheme (ML-DSA-65 / SLH-DSA) as the JDK adds support.\",\n    },\n  },\n  {\n    // Allow intervening flags (the common `codesign --force --options runtime --sign`\n    // form), bounded to the codesign invocation so it can't latch onto a later\n    // command's `--sign` across `&&`/`|`/`;`.\n    re: /\\bcodesign\\b[^\\n&|;]{0,120}?\\s(?:-s\\b|--sign\\b)/g,\n    meta: {\n      id: \"ci-codesign\",\n      title: \"Apple codesign (RSA)\",\n      description: \"Apple codesign in a CI pipeline\",\n      category: \"signature\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"CI pipeline signs with Apple codesign (classical RSA signing identity); forgeable once a CRQC exists.\",\n      remediation: \"Classical only today; track Apple's PQC signing support and plan migration.\",\n    },\n  },\n  {\n    re: /\\bminisign\\b/g,\n    meta: {\n      id: \"ci-minisign\",\n      title: \"minisign (Ed25519)\",\n      description: \"minisign signing in a CI pipeline\",\n      category: \"signature\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"EdDSA\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"CI pipeline signs with minisign (Ed25519); modern but classical and forgeable once a CRQC exists.\",\n      remediation: \"Plan migration to ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).\",\n    },\n  },\n];\n\n/** Detects classical artifact / code signing in CI/CD pipeline definitions. */\nexport const cicdDetector: Detector = {\n  id: \"cicd-signing\",\n  description: \"Classical artifact / code signing in CI/CD pipelines\",\n  scope: \"config\",\n  language: \"any\",\n  rules: CI_RULES.map((r) => r.meta),\n  appliesTo: isCiPipelineFile,\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    // A commented-out CI step (`# - run: cosign sign …`, or a `//` line in a\n    // Jenkinsfile) is not an active signing step. Mask comment lines first; offsets\n    // are preserved so the snippet from the original `content` stays correct.\n    const scan = maskCommentLines(content, [\"#\", \"//\"]);\n    for (const rule of CI_RULES) {\n      eachMatch(rule.re, scan, (m) => {\n        findings.push(\n          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/cloud-kms.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Cloud-KMS SDK detector: classical asymmetric keys minted at RUNTIME through a
+ * cloud KMS SDK call — the application-code counterpart to the Terraform detector
+ * (which covers the infrastructure-as-code path). AWS KMS `CreateKey` /
+ * `GenerateDataKeyPair` select the key type with a `KeySpec` / `KeyPairSpec`
+ * (legacy `CustomerMasterKeySpec`) field whose value is `RSA_*` or `ECC_*`.
+ *
+ * These field names + `RSA_2048` / `ECC_NIST_P256` values are specific to the AWS
+ * KMS/ACM API across every SDK language (JS/TS, Python/boto3, Java, Go, the CLI, JSON
+ * policies), so a single lexical rule catches them at very low false-positive rate.
+ * Covered forms: the quoted-value SDK/JSON form (`KeySpec: "RSA_2048"`), the camelCase
+ * CDK/Pulumi prop form (`customerMasterKeySpec: "RSA_2048"`), and the AWS CDK ENUM
+ * form (`kms.KeySpec.RSA_2048`, `KeyAlgorithm.EC_prime256v1`). Terraform uses the
+ * snake_case `customer_master_key_spec`, so this never double-counts with the IaC
+ * detector.
+ *
+ * HNDL: an RSA KMS key (encryption/KEM) and an EC KMS key (which AWS KMS can use
+ * for ECDH key agreement as well as ECDSA signing) are both harvest-now-decrypt-
+ * later exposed → hndl:true.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical asymmetric keys provisioned via a cloud KMS SDK call. */
+export declare const cloudKmsDetector: Detector;
+//# sourceMappingURL=cloud-kms.d.ts.map

package/dist/detectors/cloud-kms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-kms.d.ts","sourceRoot":"","sources":["../../src/detectors/cloud-kms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAoE/D,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,EAAE,QAmD9B,CAAC"}

package/dist/detectors/cloud-kms.js

@@ -0,0 +1,99 @@
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension, maskBlockComments, maskCommentLines, } from "../detect-utils.js";
+import { isCloudTemplateFile } from "./cloudformation.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+// The AWS KMS / ACM key-spec field names. Both PascalCase (SDK / boto3 / JSON) and
+// camelCase (AWS CDK / Pulumi props) leading letters are accepted. `KeyAlgorithm` is
+// the ACM certificate key spec.
+const SPEC_KEYS = "[Kk]eySpec|[Kk]eyPairSpec|[Cc]ustomerMasterKeySpec|[Kk]eyAlgorithm";
+// (a) The QUOTED-VALUE form: `KeySpec: "RSA_2048"` / `"KeySpec": "RSA_2048"` /
+//     `customerMasterKeySpec: "RSA_2048"` (SDK, boto3, JSON, Pulumi props).
+const RE_KMS_RSA = new RegExp(`\\b(?:${SPEC_KEYS})"?\\s*[:=]\\s*['"](?:RSA_\\d+)['"]`, "g");
+const RE_KMS_EC = new RegExp(`\\b(?:${SPEC_KEYS})"?\\s*[:=]\\s*['"](?:ECC_[A-Z0-9_]+|EC_[A-Za-z0-9]+)['"]`, "g");
+// (b) The ENUM-MEMBER form used by AWS CDK: `kms.KeySpec.RSA_2048`,
+//     `KeySpec.ECC_NIST_P256`, `KeyAlgorithm.RSA_2048`, `KeyAlgorithm.EC_prime256v1`
+//     — an enum reference, no quoted value, so (a) never matches it.
+const RE_KMS_RSA_ENUM = /\b(?:KeySpec|KeyAlgorithm)\.RSA_\d+\b/g;
+const RE_KMS_EC_ENUM = /\b(?:KeySpec|KeyAlgorithm)\.(?:ECC_[A-Z0-9_]+|EC_[A-Za-z0-9]+)\b/g;
+// (c) GCP Cloud KMS: the CryptoKeyVersion algorithm — `RSA_SIGN_PSS_2048_SHA256`,
+//     `RSA_DECRYPT_OAEP_*`, `EC_SIGN_P256_SHA256` (enum or quoted string). The
+//     `RSA_SIGN`/`RSA_DECRYPT`/`EC_SIGN` prefixes are GCP-KMS-specific.
+const RE_GCP_KMS_RSA = /\bRSA_(?:SIGN|DECRYPT)_[A-Z0-9_]+/g;
+const RE_GCP_KMS_EC = /\bEC_SIGN_[A-Z0-9_]+/g;
+// (d) Azure Key Vault SDK: `createRsaKey` / `createEcKey` (+ `Create*KeyOptions`) and
+//     `KeyType.Rsa` / `KeyType.Ec`.
+const RE_AZURE_KV_RSA = /\b[Cc]reateRsaKey(?:Options)?\b|\bKeyType\.Rsa\b/g;
+const RE_AZURE_KV_EC = /\b[Cc]reateEcKey(?:Options)?\b|\bKeyType\.Ec\b/g;
+const RULE_KMS_RSA = {
+    id: "cloud-kms-rsa",
+    title: "Cloud KMS RSA key",
+    description: "AWS/GCP/Azure KMS RSA key spec (KeySpec / RSA_SIGN_* / createRsaKey)",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Mints a classical RSA key via a cloud KMS SDK (AWS/GCP/Azure); harvest-now-decrypt-later exposed for encryption.",
+    remediation: "Plan migration to PQC as cloud KMS adds ML-KEM / ML-DSA key specs.",
+};
+const RULE_KMS_EC = {
+    id: "cloud-kms-ec",
+    title: "Cloud KMS EC key",
+    description: "AWS/GCP/Azure KMS EC key spec (ECC_* / EC_SIGN_* / createEcKey)",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Mints a classical EC key via a cloud KMS SDK (AWS/GCP/Azure); EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+/** Detects classical asymmetric keys provisioned via a cloud KMS SDK call. */
+export const cloudKmsDetector = {
+    id: "cloud-kms",
+    description: "Classical asymmetric keys minted via a cloud KMS/ACM SDK, AWS CDK, or Pulumi",
+    scope: "config",
+    language: "any",
+    rules: [RULE_KMS_RSA, RULE_KMS_EC],
+    // Skip prose/docs: a README or tutorial showing `KeySpec: "RSA_2048"` to describe
+    // the KMS API is not a live key-minting call.
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+    detect({ file, content }) {
+        // Fast reject: only proceed if an AWS / GCP / Azure KMS key-spec marker is present.
+        const lc = content.toLowerCase();
+        if (!lc.includes("keyspec") &&
+            !lc.includes("keypairspec") &&
+            !lc.includes("keyalgorithm") &&
+            !lc.includes("rsa_sign") &&
+            !lc.includes("rsa_decrypt") &&
+            !lc.includes("ec_sign") &&
+            !lc.includes("creatersakey") &&
+            !lc.includes("createeckey") &&
+            !lc.includes("keytype.")) {
+            return [];
+        }
+        // Inside a CloudFormation / ARM template FILE, the cloudformation detector owns
+        // the KMS key specs — defer so a KeySpec line is not counted twice. Gated to the
+        // template extensions it scans, so an SDK call in a `.ts` stays covered here.
+        if (isCloudTemplateFile(file, content))
+            return [];
+        // Mask comments before scanning so a commented-out `# KeySpec: "RSA_2048"` in a
+        // YAML/JSON/HCL config (which the central source-comment stripper doesn't cover)
+        // can't fire. Offsets are preserved, so the finding's snippet — built from the
+        // original `content` — stays exact.
+        const scan = maskCommentLines(maskBlockComments(content), ["#", "//"]);
+        const findings = [];
+        const add = (re, rule) => eachMatch(re, scan, (m) => findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length })));
+        add(RE_KMS_RSA, RULE_KMS_RSA);
+        add(RE_KMS_EC, RULE_KMS_EC);
+        add(RE_KMS_RSA_ENUM, RULE_KMS_RSA);
+        add(RE_KMS_EC_ENUM, RULE_KMS_EC);
+        add(RE_GCP_KMS_RSA, RULE_KMS_RSA);
+        add(RE_GCP_KMS_EC, RULE_KMS_EC);
+        add(RE_AZURE_KV_RSA, RULE_KMS_RSA);
+        add(RE_AZURE_KV_EC, RULE_KMS_EC);
+        return findings;
+    },
+};
+//# sourceMappingURL=cloud-kms.js.map

package/dist/detectors/cloud-kms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-kms.js","sourceRoot":"","sources":["../../src/detectors/cloud-kms.ts"],"names":[],"mappings":"AAqBA,OAAO,EACL,cAAc,EACd,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,mFAAmF;AACnF,qFAAqF;AACrF,gCAAgC;AAChC,MAAM,SAAS,GAAG,oEAAoE,CAAC;AACvF,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,SAAS,SAAS,qCAAqC,EAAE,GAAG,CAAC,CAAC;AAC5F,MAAM,SAAS,GAAG,IAAI,MAAM,CAC1B,SAAS,SAAS,2DAA2D,EAC7E,GAAG,CACJ,CAAC;AACF,oEAAoE;AACpE,qFAAqF;AACrF,qEAAqE;AACrE,MAAM,eAAe,GAAG,wCAAwC,CAAC;AACjE,MAAM,cAAc,GAAG,mEAAmE,CAAC;AAC3F,kFAAkF;AAClF,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAC5D,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAC9C,sFAAsF;AACtF,oCAAoC;AACpC,MAAM,eAAe,GAAG,mDAAmD,CAAC;AAC5E,MAAM,cAAc,GAAG,iDAAiD,CAAC;AAEzE,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EAAE,sEAAsE;IACnF,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,kHAAkH;IACpH,WAAW,EAAE,oEAAoE;CAClF,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,iEAAiE;IAC9E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0KAA0K;IAC5K,WAAW,EACT,8FAA8F;CACjG,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,WAAW;IACf,WAAW,EAAE,8EAA8E;IAC3F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;IAClC,kFAAkF;IAClF,8CAA8C;IAC9C,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,oFAAoF;QACpF,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACjC,IACE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvB,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC3B,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC5B,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YACxB,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC3B,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvB,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC5B,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC3B,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EACxB,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,gFAAgF;QAChF,iFAAiF;QACjF,8EAA8E;QAC9E,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAClD,gFAAgF;QAChF,iFAAiF;QACjF,+EAA+E;QAC/E,oCAAoC;QACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAQ,EAAE,CAC/C,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACxB,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QACnC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACjC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QAClC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAChC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QACnC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACjC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Cloud-KMS SDK detector: classical asymmetric keys minted at RUNTIME through a\n * cloud KMS SDK call — the application-code counterpart to the Terraform detector\n * (which covers the infrastructure-as-code path). AWS KMS `CreateKey` /\n * `GenerateDataKeyPair` select the key type with a `KeySpec` / `KeyPairSpec`\n * (legacy `CustomerMasterKeySpec`) field whose value is `RSA_*` or `ECC_*`.\n *\n * These field names + `RSA_2048` / `ECC_NIST_P256` values are specific to the AWS\n * KMS/ACM API across every SDK language (JS/TS, Python/boto3, Java, Go, the CLI, JSON\n * policies), so a single lexical rule catches them at very low false-positive rate.\n * Covered forms: the quoted-value SDK/JSON form (`KeySpec: \"RSA_2048\"`), the camelCase\n * CDK/Pulumi prop form (`customerMasterKeySpec: \"RSA_2048\"`), and the AWS CDK ENUM\n * form (`kms.KeySpec.RSA_2048`, `KeyAlgorithm.EC_prime256v1`). Terraform uses the\n * snake_case `customer_master_key_spec`, so this never double-counts with the IaC\n * detector.\n *\n * HNDL: an RSA KMS key (encryption/KEM) and an EC KMS key (which AWS KMS can use\n * for ECDH key agreement as well as ECDSA signing) are both harvest-now-decrypt-\n * later exposed → hndl:true.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport {\n  DOC_EXTENSIONS,\n  eachMatch,\n  findingFromRule,\n  hasExtension,\n  maskBlockComments,\n  maskCommentLines,\n} from \"../detect-utils.js\";\nimport { isCloudTemplateFile } from \"./cloudformation.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n// The AWS KMS / ACM key-spec field names. Both PascalCase (SDK / boto3 / JSON) and\n// camelCase (AWS CDK / Pulumi props) leading letters are accepted. `KeyAlgorithm` is\n// the ACM certificate key spec.\nconst SPEC_KEYS = \"[Kk]eySpec|[Kk]eyPairSpec|[Cc]ustomerMasterKeySpec|[Kk]eyAlgorithm\";\n// (a) The QUOTED-VALUE form: `KeySpec: \"RSA_2048\"` / `\"KeySpec\": \"RSA_2048\"` /\n//     `customerMasterKeySpec: \"RSA_2048\"` (SDK, boto3, JSON, Pulumi props).\nconst RE_KMS_RSA = new RegExp(`\\\\b(?:${SPEC_KEYS})\"?\\\\s*[:=]\\\\s*['\"](?:RSA_\\\\d+)['\"]`, \"g\");\nconst RE_KMS_EC = new RegExp(\n  `\\\\b(?:${SPEC_KEYS})\"?\\\\s*[:=]\\\\s*['\"](?:ECC_[A-Z0-9_]+|EC_[A-Za-z0-9]+)['\"]`,\n  \"g\",\n);\n// (b) The ENUM-MEMBER form used by AWS CDK: `kms.KeySpec.RSA_2048`,\n//     `KeySpec.ECC_NIST_P256`, `KeyAlgorithm.RSA_2048`, `KeyAlgorithm.EC_prime256v1`\n//     — an enum reference, no quoted value, so (a) never matches it.\nconst RE_KMS_RSA_ENUM = /\\b(?:KeySpec|KeyAlgorithm)\\.RSA_\\d+\\b/g;\nconst RE_KMS_EC_ENUM = /\\b(?:KeySpec|KeyAlgorithm)\\.(?:ECC_[A-Z0-9_]+|EC_[A-Za-z0-9]+)\\b/g;\n// (c) GCP Cloud KMS: the CryptoKeyVersion algorithm — `RSA_SIGN_PSS_2048_SHA256`,\n//     `RSA_DECRYPT_OAEP_*`, `EC_SIGN_P256_SHA256` (enum or quoted string). The\n//     `RSA_SIGN`/`RSA_DECRYPT`/`EC_SIGN` prefixes are GCP-KMS-specific.\nconst RE_GCP_KMS_RSA = /\\bRSA_(?:SIGN|DECRYPT)_[A-Z0-9_]+/g;\nconst RE_GCP_KMS_EC = /\\bEC_SIGN_[A-Z0-9_]+/g;\n// (d) Azure Key Vault SDK: `createRsaKey` / `createEcKey` (+ `Create*KeyOptions`) and\n//     `KeyType.Rsa` / `KeyType.Ec`.\nconst RE_AZURE_KV_RSA = /\\b[Cc]reateRsaKey(?:Options)?\\b|\\bKeyType\\.Rsa\\b/g;\nconst RE_AZURE_KV_EC = /\\b[Cc]reateEcKey(?:Options)?\\b|\\bKeyType\\.Ec\\b/g;\n\nconst RULE_KMS_RSA: RuleMeta = {\n  id: \"cloud-kms-rsa\",\n  title: \"Cloud KMS RSA key\",\n  description: \"AWS/GCP/Azure KMS RSA key spec (KeySpec / RSA_SIGN_* / createRsaKey)\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Mints a classical RSA key via a cloud KMS SDK (AWS/GCP/Azure); harvest-now-decrypt-later exposed for encryption.\",\n  remediation: \"Plan migration to PQC as cloud KMS adds ML-KEM / ML-DSA key specs.\",\n};\nconst RULE_KMS_EC: RuleMeta = {\n  id: \"cloud-kms-ec\",\n  title: \"Cloud KMS EC key\",\n  description: \"AWS/GCP/Azure KMS EC key spec (ECC_* / EC_SIGN_* / createEcKey)\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Mints a classical EC key via a cloud KMS SDK (AWS/GCP/Azure); EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n};\n\n/** Detects classical asymmetric keys provisioned via a cloud KMS SDK call. */\nexport const cloudKmsDetector: Detector = {\n  id: \"cloud-kms\",\n  description: \"Classical asymmetric keys minted via a cloud KMS/ACM SDK, AWS CDK, or Pulumi\",\n  scope: \"config\",\n  language: \"any\",\n  rules: [RULE_KMS_RSA, RULE_KMS_EC],\n  // Skip prose/docs: a README or tutorial showing `KeySpec: \"RSA_2048\"` to describe\n  // the KMS API is not a live key-minting call.\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    // Fast reject: only proceed if an AWS / GCP / Azure KMS key-spec marker is present.\n    const lc = content.toLowerCase();\n    if (\n      !lc.includes(\"keyspec\") &&\n      !lc.includes(\"keypairspec\") &&\n      !lc.includes(\"keyalgorithm\") &&\n      !lc.includes(\"rsa_sign\") &&\n      !lc.includes(\"rsa_decrypt\") &&\n      !lc.includes(\"ec_sign\") &&\n      !lc.includes(\"creatersakey\") &&\n      !lc.includes(\"createeckey\") &&\n      !lc.includes(\"keytype.\")\n    ) {\n      return [];\n    }\n    // Inside a CloudFormation / ARM template FILE, the cloudformation detector owns\n    // the KMS key specs — defer so a KeySpec line is not counted twice. Gated to the\n    // template extensions it scans, so an SDK call in a `.ts` stays covered here.\n    if (isCloudTemplateFile(file, content)) return [];\n    // Mask comments before scanning so a commented-out `# KeySpec: \"RSA_2048\"` in a\n    // YAML/JSON/HCL config (which the central source-comment stripper doesn't cover)\n    // can't fire. Offsets are preserved, so the finding's snippet — built from the\n    // original `content` — stays exact.\n    const scan = maskCommentLines(maskBlockComments(content), [\"#\", \"//\"]);\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta): void =>\n      eachMatch(re, scan, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    add(RE_KMS_RSA, RULE_KMS_RSA);\n    add(RE_KMS_EC, RULE_KMS_EC);\n    add(RE_KMS_RSA_ENUM, RULE_KMS_RSA);\n    add(RE_KMS_EC_ENUM, RULE_KMS_EC);\n    add(RE_GCP_KMS_RSA, RULE_KMS_RSA);\n    add(RE_GCP_KMS_EC, RULE_KMS_EC);\n    add(RE_AZURE_KV_RSA, RULE_KMS_RSA);\n    add(RE_AZURE_KV_EC, RULE_KMS_EC);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/cloudformation.d.ts

@@ -0,0 +1,38 @@
+/**
+ * IaC detector: classical asymmetric cryptography (and legacy TLS config)
+ * declared in AWS CloudFormation / Azure ARM (incl. Bicep-compiled JSON)
+ * templates — plus CDK `cdk synth` output, which is plain CloudFormation
+ * JSON. This is a distinct surface from `terraform.ts`: CloudFormation/ARM
+ * use PascalCase JSON/YAML property names, never Terraform's snake_case HCL
+ * attributes, so the two detectors never collide on the same file.
+ *
+ * Covered:
+ *  - AWS::KMS::Key `KeySpec`:                    `"RSA_…"` (kem) / `"ECC_…"` (key-exchange)
+ *  - AWS::CertificateManager::Certificate
+ *    `KeyAlgorithm`:                             `"RSA_…"` / `"EC_…"` (certificate)
+ *  - CloudFront distribution `MinimumProtocolVersion`: legacy `TLSv1` / `TLSv1.1` (tls)
+ *  - ELB/ALB listener `SslPolicy`:                legacy `ELBSecurityPolicy-2016-08` /
+ *                                                 `-TLS-1-0-…` / `-TLS-1-1-…` (tls)
+ *  - Azure ARM `Microsoft.KeyVault` key `kty`:    `"RSA"` (kem) / `"EC"` (key-exchange)
+ *
+ * `KeySpec` is PascalCase and case-sensitive, so it never matches Terraform's
+ * snake_case `customer_master_key_spec` (same underlying AWS API, different
+ * authoring surface). A fast-reject on a CFN/ARM marker keeps this detector
+ * from ever firing on arbitrary JSON/YAML that happens to contain one of
+ * these property names in an unrelated context.
+ */
+import type { Detector } from "../types.js";
+/**
+ * True when a file is one THIS detector actually scans (a `.json`/`.yaml`/`.yml`
+ * template). The `cloud-kms` and `jwk` detectors defer to this detector ONLY on
+ * such files — deferring on any extension that merely contains a marker string
+ * (e.g. a `.ts` with an `AWS::KMS` comment) would drop a real finding, since this
+ * detector never runs there.
+ */
+export declare function isCloudTemplateFile(file: string, content: string): boolean;
+/**
+ * Detects classical asymmetric crypto and legacy TLS config declared in
+ * AWS CloudFormation / Azure ARM (incl. Bicep-compiled JSON) templates.
+ */
+export declare const cloudformationDetector: Detector;
+//# sourceMappingURL=cloudformation.d.ts.map

package/dist/detectors/cloudformation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudformation.d.ts","sourceRoot":"","sources":["../../src/detectors/cloudformation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA0B/D;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1E;AA6ID;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,QA8CpC,CAAC"}

package/dist/detectors/cloudformation.js

@@ -0,0 +1,201 @@
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO, CWE_WEAK_STRENGTH } from "../cwe.js";
+const CFN_EXTENSIONS = [".json", ".yaml", ".yml"];
+// Fast-reject markers: at least one must appear before any rule regex runs, so
+// this detector never scans arbitrary JSON/YAML that merely happens to share
+// an attribute name (`KeySpec`, `kty`, …) with an unrelated schema.
+const CFN_MARKERS = [
+    "AWS::KMS",
+    "AWS::CertificateManager",
+    "AWSTemplateFormatVersion",
+    "MinimumProtocolVersion",
+    "Microsoft.KeyVault",
+    "SslPolicy", // unquoted so a YAML `SslPolicy:` key also gates the file in, not just JSON
+];
+/**
+ * True when the content looks like a CloudFormation / ARM deployment template (one
+ * of the {@link CFN_MARKERS} is present).
+ */
+function isCloudTemplate(content) {
+    return CFN_MARKERS.some((marker) => content.includes(marker));
+}
+/**
+ * True when a file is one THIS detector actually scans (a `.json`/`.yaml`/`.yml`
+ * template). The `cloud-kms` and `jwk` detectors defer to this detector ONLY on
+ * such files — deferring on any extension that merely contains a marker string
+ * (e.g. a `.ts` with an `AWS::KMS` comment) would drop a real finding, since this
+ * detector never runs there.
+ */
+export function isCloudTemplateFile(file, content) {
+    return hasExtension(file, CFN_EXTENSIONS) && isCloudTemplate(content);
+}
+// Each attribute is matched with an optional quote around the key and `:` as
+// the separator (both plain-JSON and YAML-block-scalar forms use `:`). The
+// `(?<![\w"-])` lookbehind stops a longer/prefixed attribute name from
+// matching on its suffix.
+// Match all three AWS KMS spec-key spellings so this detector fully owns KMS keys
+// inside a template (KeySpec, the KeyPair variant, and the legacy CustomerMasterKeySpec).
+const RE_CFN_KMS_RSA = /(?<![\w"-])"?(?:KeySpec|KeyPairSpec|CustomerMasterKeySpec)"?\s*:\s*"?RSA_\d+"?/g;
+const RE_CFN_KMS_EC = /(?<![\w"-])"?(?:KeySpec|KeyPairSpec|CustomerMasterKeySpec)"?\s*:\s*"?ECC_[A-Z0-9_]+"?/g;
+const RE_CFN_ACM_RSA = /(?<![\w"-])"?KeyAlgorithm"?\s*:\s*"?RSA_\d+"?/g;
+const RE_CFN_ACM_EC = /(?<![\w"-])"?KeyAlgorithm"?\s*:\s*"?EC_[A-Za-z0-9]+"?/g;
+// CloudFront: only the pre-2018 "TLSv1" / "TLSv1_2016" / "TLSv1.1_2016"
+// values are legacy; the lookahead delimiter stops this from matching a
+// "TLSv1.2_2018"-style value that merely starts with the same prefix.
+const RE_CFN_CLOUDFRONT_TLS = /(?<![\w"-])"?MinimumProtocolVersion"?\s*:\s*"?(?:TLSv1(?:\.1)?_2016|TLSv1|SSLv3)(?=["'\s,}]|$)/gm;
+// ELB/ALB legacy SSL negotiation policies (named, dated policy strings). The value
+// quote is optional (`"?`) so YAML block scalars (`SslPolicy: ELBSecurityPolicy-...`)
+// match too, with a delimiter lookahead so a longer/newer policy name that merely
+// shares the prefix is not matched.
+const RE_CFN_ELB_TLS = /(?<![\w"-])"?SslPolicy"?\s*:\s*"?ELBSecurityPolicy-(?:2016-08|TLS-1-0-\d{4}-\d{2}|TLS-1-1-\d{4}-\d{2})(?=["'\s,}]|$)/g;
+// Azure ARM Microsoft.KeyVault key resource `properties.kty`.
+const RE_CFN_ARM_KV_RSA = /(?<![\w"-])"?kty"?\s*:\s*"?RSA"?(?!\w)/g;
+const RE_CFN_ARM_KV_EC = /(?<![\w"-])"?kty"?\s*:\s*"?EC"?(?!\w)/g;
+const RULE_CFN_KMS_RSA = {
+    id: "cfn-kms-rsa",
+    title: "CloudFormation KMS RSA key",
+    description: 'AWS::KMS::Key KeySpec = "RSA_*"',
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "CloudFormation provisions a classical RSA KMS key (harvest-now-decrypt-later exposed for encryption CMKs).",
+    remediation: "Plan migration to PQC as cloud KMS adds ML-KEM / ML-DSA key specs.",
+};
+const RULE_CFN_KMS_EC = {
+    id: "cfn-kms-ec",
+    title: "CloudFormation KMS EC key",
+    description: 'AWS::KMS::Key KeySpec = "ECC_*"',
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "CloudFormation provisions a classical EC KMS key; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_CFN_ACM_RSA = {
+    id: "cfn-acm-rsa",
+    title: "CloudFormation ACM RSA certificate",
+    description: 'AWS::CertificateManager::Certificate KeyAlgorithm = "RSA_*"',
+    category: "certificate",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "CloudFormation provisions an ACM certificate with a classical RSA key, which is not quantum-safe.",
+    remediation: "Plan migration to PQC (ML-KEM-768 for encryption, ML-DSA-65 for signatures).",
+};
+const RULE_CFN_ACM_EC = {
+    id: "cfn-acm-ec",
+    title: "CloudFormation ACM EC certificate",
+    description: 'AWS::CertificateManager::Certificate KeyAlgorithm = "EC_*"',
+    category: "certificate",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "CloudFormation provisions an ACM certificate with a classical EC key, forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_CFN_CLOUDFRONT_TLS = {
+    id: "cfn-cloudfront-legacy-tls",
+    title: "CloudFormation CloudFront legacy TLS",
+    description: 'CloudFront Distribution MinimumProtocolVersion = "TLSv1" / "TLSv1.1"',
+    category: "tls",
+    severity: "medium",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_WEAK_STRENGTH,
+    message: "CloudFront distribution permits TLS 1.0/1.1, which are deprecated and insecure.",
+    remediation: "Set MinimumProtocolVersion to TLSv1.2_2021 (or later) and prefer PQC-hybrid key exchange.",
+};
+const RULE_CFN_ELB_TLS = {
+    id: "cfn-elb-legacy-tls",
+    title: "CloudFormation ELB/ALB legacy TLS policy",
+    description: "Elastic Load Balancer SslPolicy naming a pre-2017 legacy policy",
+    category: "tls",
+    severity: "medium",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_WEAK_STRENGTH,
+    message: "Load balancer listener uses a legacy SSL negotiation policy permitting TLS 1.0/1.1.",
+    remediation: "Use ELBSecurityPolicy-TLS13-1-2-2021-06 (or the latest FS+TLS1.2/1.3 policy).",
+};
+const RULE_CFN_ARM_KV_RSA = {
+    id: "cfn-arm-keyvault-rsa",
+    title: "ARM template Key Vault RSA key",
+    description: 'Microsoft.KeyVault key resource kty = "RSA"',
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "ARM template provisions a classical RSA Azure Key Vault key, which is not quantum-safe.",
+    remediation: "Plan migration to PQC (ML-KEM-768 / ML-DSA-65).",
+};
+const RULE_CFN_ARM_KV_EC = {
+    id: "cfn-arm-keyvault-ec",
+    title: "ARM template Key Vault EC key",
+    description: 'Microsoft.KeyVault key resource kty = "EC"',
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "ARM template provisions a classical EC Azure Key Vault key; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+/**
+ * Detects classical asymmetric crypto and legacy TLS config declared in
+ * AWS CloudFormation / Azure ARM (incl. Bicep-compiled JSON) templates.
+ */
+export const cloudformationDetector = {
+    id: "cloudformation-crypto",
+    description: "Classical asymmetric crypto and legacy TLS config declared in CloudFormation / ARM templates (IaC)",
+    scope: "config",
+    language: "any",
+    rules: [
+        RULE_CFN_KMS_RSA,
+        RULE_CFN_KMS_EC,
+        RULE_CFN_ACM_RSA,
+        RULE_CFN_ACM_EC,
+        RULE_CFN_CLOUDFRONT_TLS,
+        RULE_CFN_ELB_TLS,
+        RULE_CFN_ARM_KV_RSA,
+        RULE_CFN_ARM_KV_EC,
+    ],
+    appliesTo: (f) => hasExtension(f, CFN_EXTENSIONS),
+    detect({ file, content }) {
+        if (!CFN_MARKERS.some((marker) => content.includes(marker)))
+            return [];
+        // Mask whole `#` comment lines (YAML CFN/ARM templates ship large commented-out
+        // blocks); harmless for JSON, which has no comments. Offsets preserved so finding
+        // locations stay exact. `.yaml`/`.json` are not centrally comment-stripped.
+        const scan = maskCommentLines(content, ["#"]);
+        const findings = [];
+        const add = (re, rule) => eachMatch(re, scan, (m) => findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length })));
+        add(RE_CFN_KMS_RSA, RULE_CFN_KMS_RSA);
+        add(RE_CFN_KMS_EC, RULE_CFN_KMS_EC);
+        add(RE_CFN_ACM_RSA, RULE_CFN_ACM_RSA);
+        add(RE_CFN_ACM_EC, RULE_CFN_ACM_EC);
+        add(RE_CFN_CLOUDFRONT_TLS, RULE_CFN_CLOUDFRONT_TLS);
+        add(RE_CFN_ELB_TLS, RULE_CFN_ELB_TLS);
+        // The bare `kty` attribute is generic (every JWK has it), so only treat it as
+        // an ARM Key Vault key when the ARM resource type is actually present — otherwise
+        // a JWK in a file gated in by another marker (e.g. SslPolicy) would misfire here.
+        if (content.includes("Microsoft.KeyVault")) {
+            add(RE_CFN_ARM_KV_RSA, RULE_CFN_ARM_KV_RSA);
+            add(RE_CFN_ARM_KV_EC, RULE_CFN_ARM_KV_EC);
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=cloudformation.js.map

package/dist/detectors/cloudformation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudformation.js","sourceRoot":"","sources":["../../src/detectors/cloudformation.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEjE,MAAM,cAAc,GAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAErE,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,MAAM,WAAW,GAAsB;IACrC,UAAU;IACV,yBAAyB;IACzB,0BAA0B;IAC1B,wBAAwB;IACxB,oBAAoB;IACpB,WAAW,EAAE,4EAA4E;CAC1F,CAAC;AAEF;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAAe;IAC/D,OAAO,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,0BAA0B;AAC1B,kFAAkF;AAClF,0FAA0F;AAC1F,MAAM,cAAc,GAClB,iFAAiF,CAAC;AACpF,MAAM,aAAa,GACjB,wFAAwF,CAAC;AAC3F,MAAM,cAAc,GAAG,gDAAgD,CAAC;AACxE,MAAM,aAAa,GAAG,wDAAwD,CAAC;AAC/E,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,MAAM,qBAAqB,GACzB,kGAAkG,CAAC;AACrG,mFAAmF;AACnF,sFAAsF;AACtF,kFAAkF;AAClF,oCAAoC;AACpC,MAAM,cAAc,GAClB,uHAAuH,CAAC;AAC1H,8DAA8D;AAC9D,MAAM,iBAAiB,GAAG,yCAAyC,CAAC;AACpE,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAElE,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,iCAAiC;IAC9C,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,4GAA4G;IAC9G,WAAW,EAAE,oEAAoE;CAClF,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,iCAAiC;IAC9C,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,8JAA8J;IAChK,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,oCAAoC;IAC3C,WAAW,EAAE,6DAA6D;IAC1E,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mGAAmG;IACrG,WAAW,EAAE,8EAA8E;CAC5F,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,mCAAmC;IAC1C,WAAW,EAAE,4DAA4D;IACzE,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,wGAAwG;IAC1G,WAAW,EAAE,6CAA6C;CAC3D,CAAC;AACF,MAAM,uBAAuB,GAAa;IACxC,EAAE,EAAE,2BAA2B;IAC/B,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EAAE,sEAAsE;IACnF,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,iFAAiF;IAC1F,WAAW,EACT,2FAA2F;CAC9F,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,0CAA0C;IACjD,WAAW,EAAE,iEAAiE;IAC9E,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,qFAAqF;IAC9F,WAAW,EAAE,+EAA+E;CAC7F,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,gCAAgC;IACvC,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yFAAyF;IAC3F,WAAW,EAAE,iDAAiD;CAC/D,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,qBAAqB;IACzB,KAAK,EAAE,+BAA+B;IACtC,WAAW,EAAE,4CAA4C;IACzD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,wKAAwK;IAC1K,WAAW,EACT,8FAA8F;CACjG,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAa;IAC9C,EAAE,EAAE,uBAAuB;IAC3B,WAAW,EACT,oGAAoG;IACtG,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE;QACL,gBAAgB;QAChB,eAAe;QACf,gBAAgB;QAChB,eAAe;QACf,uBAAuB;QACvB,gBAAgB;QAChB,mBAAmB;QACnB,kBAAkB;KACnB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IACjD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAEvE,gFAAgF;QAChF,kFAAkF;QAClF,4EAA4E;QAC5E,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACxB,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;QACpD,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,8EAA8E;QAC9E,kFAAkF;QAClF,kFAAkF;QAClF,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAC5C,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * IaC detector: classical asymmetric cryptography (and legacy TLS config)\n * declared in AWS CloudFormation / Azure ARM (incl. Bicep-compiled JSON)\n * templates — plus CDK `cdk synth` output, which is plain CloudFormation\n * JSON. This is a distinct surface from `terraform.ts`: CloudFormation/ARM\n * use PascalCase JSON/YAML property names, never Terraform's snake_case HCL\n * attributes, so the two detectors never collide on the same file.\n *\n * Covered:\n *  - AWS::KMS::Key `KeySpec`:                    `\"RSA_…\"` (kem) / `\"ECC_…\"` (key-exchange)\n *  - AWS::CertificateManager::Certificate\n *    `KeyAlgorithm`:                             `\"RSA_…\"` / `\"EC_…\"` (certificate)\n *  - CloudFront distribution `MinimumProtocolVersion`: legacy `TLSv1` / `TLSv1.1` (tls)\n *  - ELB/ALB listener `SslPolicy`:                legacy `ELBSecurityPolicy-2016-08` /\n *                                                 `-TLS-1-0-…` / `-TLS-1-1-…` (tls)\n *  - Azure ARM `Microsoft.KeyVault` key `kty`:    `\"RSA\"` (kem) / `\"EC\"` (key-exchange)\n *\n * `KeySpec` is PascalCase and case-sensitive, so it never matches Terraform's\n * snake_case `customer_master_key_spec` (same underlying AWS API, different\n * authoring surface). A fast-reject on a CFN/ARM marker keeps this detector\n * from ever firing on arbitrary JSON/YAML that happens to contain one of\n * these property names in an unrelated context.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule, hasExtension, maskCommentLines } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_WEAK_STRENGTH } from \"../cwe.js\";\n\nconst CFN_EXTENSIONS: readonly string[] = [\".json\", \".yaml\", \".yml\"];\n\n// Fast-reject markers: at least one must appear before any rule regex runs, so\n// this detector never scans arbitrary JSON/YAML that merely happens to share\n// an attribute name (`KeySpec`, `kty`, …) with an unrelated schema.\nconst CFN_MARKERS: readonly string[] = [\n  \"AWS::KMS\",\n  \"AWS::CertificateManager\",\n  \"AWSTemplateFormatVersion\",\n  \"MinimumProtocolVersion\",\n  \"Microsoft.KeyVault\",\n  \"SslPolicy\", // unquoted so a YAML `SslPolicy:` key also gates the file in, not just JSON\n];\n\n/**\n * True when the content looks like a CloudFormation / ARM deployment template (one\n * of the {@link CFN_MARKERS} is present).\n */\nfunction isCloudTemplate(content: string): boolean {\n  return CFN_MARKERS.some((marker) => content.includes(marker));\n}\n\n/**\n * True when a file is one THIS detector actually scans (a `.json`/`.yaml`/`.yml`\n * template). The `cloud-kms` and `jwk` detectors defer to this detector ONLY on\n * such files — deferring on any extension that merely contains a marker string\n * (e.g. a `.ts` with an `AWS::KMS` comment) would drop a real finding, since this\n * detector never runs there.\n */\nexport function isCloudTemplateFile(file: string, content: string): boolean {\n  return hasExtension(file, CFN_EXTENSIONS) && isCloudTemplate(content);\n}\n\n// Each attribute is matched with an optional quote around the key and `:` as\n// the separator (both plain-JSON and YAML-block-scalar forms use `:`). The\n// `(?<![\\w\"-])` lookbehind stops a longer/prefixed attribute name from\n// matching on its suffix.\n// Match all three AWS KMS spec-key spellings so this detector fully owns KMS keys\n// inside a template (KeySpec, the KeyPair variant, and the legacy CustomerMasterKeySpec).\nconst RE_CFN_KMS_RSA =\n  /(?<![\\w\"-])\"?(?:KeySpec|KeyPairSpec|CustomerMasterKeySpec)\"?\\s*:\\s*\"?RSA_\\d+\"?/g;\nconst RE_CFN_KMS_EC =\n  /(?<![\\w\"-])\"?(?:KeySpec|KeyPairSpec|CustomerMasterKeySpec)\"?\\s*:\\s*\"?ECC_[A-Z0-9_]+\"?/g;\nconst RE_CFN_ACM_RSA = /(?<![\\w\"-])\"?KeyAlgorithm\"?\\s*:\\s*\"?RSA_\\d+\"?/g;\nconst RE_CFN_ACM_EC = /(?<![\\w\"-])\"?KeyAlgorithm\"?\\s*:\\s*\"?EC_[A-Za-z0-9]+\"?/g;\n// CloudFront: only the pre-2018 \"TLSv1\" / \"TLSv1_2016\" / \"TLSv1.1_2016\"\n// values are legacy; the lookahead delimiter stops this from matching a\n// \"TLSv1.2_2018\"-style value that merely starts with the same prefix.\nconst RE_CFN_CLOUDFRONT_TLS =\n  /(?<![\\w\"-])\"?MinimumProtocolVersion\"?\\s*:\\s*\"?(?:TLSv1(?:\\.1)?_2016|TLSv1|SSLv3)(?=[\"'\\s,}]|$)/gm;\n// ELB/ALB legacy SSL negotiation policies (named, dated policy strings). The value\n// quote is optional (`\"?`) so YAML block scalars (`SslPolicy: ELBSecurityPolicy-...`)\n// match too, with a delimiter lookahead so a longer/newer policy name that merely\n// shares the prefix is not matched.\nconst RE_CFN_ELB_TLS =\n  /(?<![\\w\"-])\"?SslPolicy\"?\\s*:\\s*\"?ELBSecurityPolicy-(?:2016-08|TLS-1-0-\\d{4}-\\d{2}|TLS-1-1-\\d{4}-\\d{2})(?=[\"'\\s,}]|$)/g;\n// Azure ARM Microsoft.KeyVault key resource `properties.kty`.\nconst RE_CFN_ARM_KV_RSA = /(?<![\\w\"-])\"?kty\"?\\s*:\\s*\"?RSA\"?(?!\\w)/g;\nconst RE_CFN_ARM_KV_EC = /(?<![\\w\"-])\"?kty\"?\\s*:\\s*\"?EC\"?(?!\\w)/g;\n\nconst RULE_CFN_KMS_RSA: RuleMeta = {\n  id: \"cfn-kms-rsa\",\n  title: \"CloudFormation KMS RSA key\",\n  description: 'AWS::KMS::Key KeySpec = \"RSA_*\"',\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"CloudFormation provisions a classical RSA KMS key (harvest-now-decrypt-later exposed for encryption CMKs).\",\n  remediation: \"Plan migration to PQC as cloud KMS adds ML-KEM / ML-DSA key specs.\",\n};\nconst RULE_CFN_KMS_EC: RuleMeta = {\n  id: \"cfn-kms-ec\",\n  title: \"CloudFormation KMS EC key\",\n  description: 'AWS::KMS::Key KeySpec = \"ECC_*\"',\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"CloudFormation provisions a classical EC KMS key; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_CFN_ACM_RSA: RuleMeta = {\n  id: \"cfn-acm-rsa\",\n  title: \"CloudFormation ACM RSA certificate\",\n  description: 'AWS::CertificateManager::Certificate KeyAlgorithm = \"RSA_*\"',\n  category: \"certificate\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"CloudFormation provisions an ACM certificate with a classical RSA key, which is not quantum-safe.\",\n  remediation: \"Plan migration to PQC (ML-KEM-768 for encryption, ML-DSA-65 for signatures).\",\n};\nconst RULE_CFN_ACM_EC: RuleMeta = {\n  id: \"cfn-acm-ec\",\n  title: \"CloudFormation ACM EC certificate\",\n  description: 'AWS::CertificateManager::Certificate KeyAlgorithm = \"EC_*\"',\n  category: \"certificate\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"CloudFormation provisions an ACM certificate with a classical EC key, forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).\",\n};\nconst RULE_CFN_CLOUDFRONT_TLS: RuleMeta = {\n  id: \"cfn-cloudfront-legacy-tls\",\n  title: \"CloudFormation CloudFront legacy TLS\",\n  description: 'CloudFront Distribution MinimumProtocolVersion = \"TLSv1\" / \"TLSv1.1\"',\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_WEAK_STRENGTH,\n  message: \"CloudFront distribution permits TLS 1.0/1.1, which are deprecated and insecure.\",\n  remediation:\n    \"Set MinimumProtocolVersion to TLSv1.2_2021 (or later) and prefer PQC-hybrid key exchange.\",\n};\nconst RULE_CFN_ELB_TLS: RuleMeta = {\n  id: \"cfn-elb-legacy-tls\",\n  title: \"CloudFormation ELB/ALB legacy TLS policy\",\n  description: \"Elastic Load Balancer SslPolicy naming a pre-2017 legacy policy\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_WEAK_STRENGTH,\n  message: \"Load balancer listener uses a legacy SSL negotiation policy permitting TLS 1.0/1.1.\",\n  remediation: \"Use ELBSecurityPolicy-TLS13-1-2-2021-06 (or the latest FS+TLS1.2/1.3 policy).\",\n};\nconst RULE_CFN_ARM_KV_RSA: RuleMeta = {\n  id: \"cfn-arm-keyvault-rsa\",\n  title: \"ARM template Key Vault RSA key\",\n  description: 'Microsoft.KeyVault key resource kty = \"RSA\"',\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"ARM template provisions a classical RSA Azure Key Vault key, which is not quantum-safe.\",\n  remediation: \"Plan migration to PQC (ML-KEM-768 / ML-DSA-65).\",\n};\nconst RULE_CFN_ARM_KV_EC: RuleMeta = {\n  id: \"cfn-arm-keyvault-ec\",\n  title: \"ARM template Key Vault EC key\",\n  description: 'Microsoft.KeyVault key resource kty = \"EC\"',\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"ARM template provisions a classical EC Azure Key Vault key; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n};\n\n/**\n * Detects classical asymmetric crypto and legacy TLS config declared in\n * AWS CloudFormation / Azure ARM (incl. Bicep-compiled JSON) templates.\n */\nexport const cloudformationDetector: Detector = {\n  id: \"cloudformation-crypto\",\n  description:\n    \"Classical asymmetric crypto and legacy TLS config declared in CloudFormation / ARM templates (IaC)\",\n  scope: \"config\",\n  language: \"any\",\n  rules: [\n    RULE_CFN_KMS_RSA,\n    RULE_CFN_KMS_EC,\n    RULE_CFN_ACM_RSA,\n    RULE_CFN_ACM_EC,\n    RULE_CFN_CLOUDFRONT_TLS,\n    RULE_CFN_ELB_TLS,\n    RULE_CFN_ARM_KV_RSA,\n    RULE_CFN_ARM_KV_EC,\n  ],\n  appliesTo: (f) => hasExtension(f, CFN_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    if (!CFN_MARKERS.some((marker) => content.includes(marker))) return [];\n\n    // Mask whole `#` comment lines (YAML CFN/ARM templates ship large commented-out\n    // blocks); harmless for JSON, which has no comments. Offsets preserved so finding\n    // locations stay exact. `.yaml`/`.json` are not centrally comment-stripped.\n    const scan = maskCommentLines(content, [\"#\"]);\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, scan, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    add(RE_CFN_KMS_RSA, RULE_CFN_KMS_RSA);\n    add(RE_CFN_KMS_EC, RULE_CFN_KMS_EC);\n    add(RE_CFN_ACM_RSA, RULE_CFN_ACM_RSA);\n    add(RE_CFN_ACM_EC, RULE_CFN_ACM_EC);\n    add(RE_CFN_CLOUDFRONT_TLS, RULE_CFN_CLOUDFRONT_TLS);\n    add(RE_CFN_ELB_TLS, RULE_CFN_ELB_TLS);\n    // The bare `kty` attribute is generic (every JWK has it), so only treat it as\n    // an ARM Key Vault key when the ARM resource type is actually present — otherwise\n    // a JWK in a file gated in by another marker (e.g. SslPolicy) would misfire here.\n    if (content.includes(\"Microsoft.KeyVault\")) {\n      add(RE_CFN_ARM_KV_RSA, RULE_CFN_ARM_KV_RSA);\n      add(RE_CFN_ARM_KV_EC, RULE_CFN_ARM_KV_EC);\n    }\n    return findings;\n  },\n};\n"]}