@quantakrypto/core 0.4.4 → 0.6.0

package/dist/detectors/source.js

@@ -1,4 +1,4 @@
-import { JS_TS_EXTENSIONS, DOC_EXTENSIONS, JWT_HOST_EXTENSIONS, eachMatch, findingFromRule, hasExtension, nearSortedCall, } from "../detect-utils.js";
+import { JS_TS_EXTENSIONS, DOC_EXTENSIONS, JWT_HOST_EXTENSIONS, eachMatch, enclosingObject, findingFromRule, hasExtension, nearSortedCall, } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 /* -------------------------------------------------------------------------- */
 /* Precompiled regexes (module scope — never recreated per file)              */
@@ -6,6 +6,14 @@ import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cw
 // `rsa-pss` is listed before `rsa` so the alternation consumes the full token
 // (ordered alternation would otherwise match `rsa` and reject the `-pss` tail).
 const RE_GENERATE_KEYPAIR = /generateKeyPair(?:Sync)?\s*\(\s*['"`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"`]/g;
+// Variable-typed key generation: `generateKeyPair(kind, …)` where the algorithm
+// argument is an IDENTIFIER (a variable), not a quoted literal, so the concrete
+// family is unknown at scan time but a classical key is still being generated.
+// The lookbehind anchors the call to a word boundary so it does not fire inside
+// a longer identifier (e.g. `myGenerateKeyPair(`); the first argument must be a
+// bare identifier immediately followed by `,` or `)` so a quoted-literal call
+// (handled by RE_GENERATE_KEYPAIR) never matches here.
+const RE_GENERATE_KEYPAIR_VAR = /(?<![\w$])generateKeyPair(?:Sync)?\s*\(\s*([A-Za-z_$][\w$]*)\s*[,)]/g;
 const KEYGEN_INFO = {
     rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
     // RSA-PSS is signature-only, so classify it as a (forgeable) signature
@@ -108,6 +116,18 @@ function escapeRe(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 const RE_CREATE_SIGN_VERIFY = /create(?:Sign|Verify)\s*\(/g;
+// Computed-member (bracket) access to a Node `crypto` method:
+// `crypto['createSign'](…)`, `c["createECDH"](…)`. Bracket access defeats the
+// dotted-call regexes above (which require `name(`), so match a quoted method
+// name inside a `[ '…' ]( ` computed call and route it to the right rule. The
+// method names here take no key-type argument, so no argument parsing is needed;
+// `generateKeyPair(Sync)` bracket access is handled separately (it carries the
+// key-type literal). None of these overlap the dotted regexes (those require the
+// name immediately before `(`, whereas here it is followed by a closing quote).
+const RE_BRACKET_CRYPTO_METHOD = /\[\s*['"`](createSign|createVerify|createECDH|createDiffieHellman|createDiffieHellmanGroup|publicEncrypt|privateDecrypt)['"`]\s*\]\s*\(/g;
+// `crypto['generateKeyPairSync']('rsa', …)`: bracket access carrying the quoted
+// key-type literal, classified exactly like the dotted `generateKeyPair` call.
+const RE_BRACKET_KEYGEN = /\[\s*['"`]generateKeyPair(?:Sync)?['"`]\s*\]\s*\(\s*['"`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"`]/g;
 // One-shot crypto.sign/verify(algorithm, data, key). A LOOKBEHIND (not a
 // consumed char) anchors it so it doesn't fire inside identifiers like `assign(`
 // or `createSign(` (handled by the dedicated createSign/createVerify rule) —
@@ -147,10 +167,14 @@ const RE_TLS_REJECT = /rejectUnauthorized\s*:\s*false/g;
 // Hardened cipher regex: bounded spans (no unbounded `[^'"`]*` straddling the
 // alternation), single-quote-style anchoring removed in favour of {0,256} bounds
 // so worst-case backtracking is linear in the bound, not the file (P0-6).
-// The `(?<![!-])` lookbehind skips OpenSSL EXCLUSION syntax — `!MD5` / `-RC4`
-// DISABLE those ciphers, so a hardened list like `...:!aNULL:!MD5:!RC4` must not
-// be flagged as weak (audit: crypto #7). A genuinely-enabled `RC4` still matches.
-const RE_TLS_WEAK_CIPHER = /ciphers\s*:\s*['"`][^'"`\n]{0,256}?\b(?<![!-])(RC4|DES|3DES|MD5|NULL|EXPORT|aNULL|eNULL)\b[^'"`\n]{0,256}?['"`]/gi;
+// Skip OpenSSL EXCLUSION syntax — `!MD5` / `:-RC4` / `!ECDHE-RSA-RC4-SHA` DISABLE
+// those ciphers, so a hardened list must not be flagged as weak (audit: crypto #7). The
+// single variable-length lookbehind walks back over the suite-name chars to the
+// ELEMENT boundary (`:` / whitespace / comma / quote / start) and rejects the match
+// when that element begins with `!` or `-` — covering a bare `!RC4`, a space-separated
+// `HIGH !RC4`, and a full-suite `!ECDHE-RSA-RC4-SHA`. The intra-name hyphen in a
+// genuinely-enabled `ECDHE-RSA-RC4-SHA` (no leading `!`/`-`) still matches.
+const RE_TLS_WEAK_CIPHER = /ciphers\s*:\s*['"`][^'"`\n]{0,256}?\b(?<![:'"`,\s]\s*[!-][\w-]{0,64})(RC4|DES|3DES|MD5|NULL|EXPORT|aNULL|eNULL)\b[^'"`\n]{0,256}?['"`]/gi;
 /* -------------------------------------------------------------------------- */
 /* Node.js `crypto` module                                                    */
 /* -------------------------------------------------------------------------- */
@@ -280,6 +304,19 @@ const nodeCryptoDetector = {
         eachMatch(RE_GENERATE_KEYPAIR, content, (m) => {
             pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length);
         });
+        // generateKeyPair(Sync)(<variable>, …): key type passed as a variable, so the
+        // family is unknown; emit the generic keygen rule (unknown / key-exchange /
+        // HNDL-conservative) rather than missing the classical key generation.
+        eachMatch(RE_GENERATE_KEYPAIR_VAR, content, (m) => {
+            findings.push(findingFromRule(RULE_NODE_KEYGEN, { file, content, index: m.index, matchLength: m[0].length }, {
+                title: "Classical key generation (variable key type)",
+                message: "Generates a classical asymmetric key pair (key type passed as a variable), which is not quantum-safe.",
+            }));
+        });
+        // Bracket (computed-member) key generation: crypto['generateKeyPairSync']('rsa').
+        eachMatch(RE_BRACKET_KEYGEN, content, (m) => {
+            pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length);
+        });
         // Import-alias resolution: follow `import { generateKeyPairSync as gk }` (and
         // the CommonJS destructure-rename) so an aliased call still detects. Only the
         // keygen / ECDH / DH constructors are resolved — their classification is
@@ -322,6 +359,25 @@ const nodeCryptoDetector = {
                 matchLength: m[0].length,
             }));
         });
+        // Bracket (computed-member) access to argument-free crypto methods:
+        // crypto['createSign'](…), c["createECDH"](…). Route each to its rule.
+        eachMatch(RE_BRACKET_CRYPTO_METHOD, content, (m) => {
+            const loc = { file, content, index: m.index, matchLength: m[0].length };
+            const method = m[1];
+            if (method === "createSign" || method === "createVerify") {
+                findings.push(findingFromRule(RULE_NODE_SIGN, loc));
+            }
+            else if (method === "createECDH") {
+                findings.push(findingFromRule(RULE_NODE_ECDH, loc));
+            }
+            else if (method === "publicEncrypt" || method === "privateDecrypt") {
+                findings.push(findingFromRule(RULE_NODE_RSA_ENCRYPT, loc));
+            }
+            else {
+                // createDiffieHellman / createDiffieHellmanGroup: finite-field DH.
+                findings.push(findingFromRule(RULE_NODE_DH, loc));
+            }
+        });
         // One-shot crypto.sign(algorithm, data, key) / crypto.verify(...) (Node ≥ 12).
         eachMatch(RE_ONESHOT_SIGN_VERIFY, content, (m) => {
             findings.push(findingFromRule(RULE_NODE_SIGN_ONESHOT, {
@@ -433,7 +489,9 @@ const webCryptoDetector = {
                 algorithm = name === "X448" ? "X448" : "X25519";
                 category = "key-exchange";
                 hndl = true;
-                severity = "low"; // modern but classical
+                // `medium`, aligned with X25519/X448 key agreement in node/rust/go — HNDL-exposed
+                // key agreement scores the same regardless of which surface uses it.
+                severity = "medium";
             }
             else if (name === "ED25519" || name === "ED448") {
                 algorithm = "EdDSA";
@@ -659,8 +717,21 @@ const jwtDetector = {
     appliesTo: (f) => hasExtension(f, JWT_HOST_EXTENSIONS),
     detect({ file, content }) {
         const findings = [];
+        // Deferral guards against double-counting:
+        //  - webCryptoDetector owns a quoted `RSA-OAEP`/`ECDH-ES` sitting next to a
+        //    `subtle.*(` call (it matches the `RSA-OAEP`/`ECDH` name). Collect the subtle
+        //    call offsets so the JOSE key-management loops can skip those. (In non-JS host
+        //    files there are no subtle calls, so nothing is skipped.)
+        //  - jwkDetector owns any alg/`kty` that lives inside a JWK object; skip a token
+        //    whose enclosing `{…}` carries a `"kty"` so a JWK's own `alg` is not counted by
+        //    both detectors. Mirrors the same guard jose.ts applies for other languages.
+        const subtleCalls = [];
+        eachMatch(RE_SUBTLE_CALL, content, (m) => subtleCalls.push(m.index));
+        const inJwk = (index) => enclosingObject(content, index).includes('"kty"');
         // Classical JWS signature alg tokens. Anchored to quotes to avoid words.
         eachMatch(RE_JWT_ALG, content, (m) => {
+            if (inJwk(m.index))
+                return; // jwk-{rsa,ec,eddsa} owns a JWK's own alg
             const alg = m[1];
             let algorithm;
             if (alg.startsWith("RS") || alg.startsWith("PS"))
@@ -677,6 +748,10 @@ const jwtDetector = {
         });
         // JOSE ECDH-ES key agreement (and ECDH-ES+A*KW) — confidentiality, HNDL.
         eachMatch(RE_JOSE_ECDH, content, (m) => {
+            if (inJwk(m.index))
+                return; // jwk-ec owns a JWK's own alg
+            if (nearSortedCall(subtleCalls, m.index, 400))
+                return; // webcrypto owns it
             findings.push(findingFromRule(RULE_JOSE_ECDH, { file, content, index: m.index, matchLength: m[0].length }, {
                 title: `JOSE key agreement ${m[1]}`,
                 message: `JOSE "${m[1]}" performs classical ECDH key agreement — harvest-now-decrypt-later exposed.`,
@@ -684,6 +759,12 @@ const jwtDetector = {
         });
         // JOSE RSA key transport (RSA-OAEP / RSA1_5) — classical RSA encryption, HNDL.
         eachMatch(RE_JOSE_KEM, content, (m) => {
+            if (inJwk(m.index))
+                return; // jwk-rsa owns a JWK's own alg
+            // webCryptoDetector's regex matches `RSA-OAEP` but NOT `RSA1_5`, so only defer the
+            // OAEP form near a subtle call — deferring RSA1_5 would drop it entirely.
+            if (m[1].startsWith("RSA-OAEP") && nearSortedCall(subtleCalls, m.index, 400))
+                return;
             findings.push(findingFromRule(RULE_JOSE_RSA_OAEP, { file, content, index: m.index, matchLength: m[0].length }, {
                 title: `JOSE RSA key transport ${m[1]}`,
                 message: `JOSE "${m[1]}" is classical RSA key transport — harvest-now-decrypt-later exposed.`,
@@ -782,6 +863,20 @@ const RE_CERT_SIG_ALG = /\b(sha(?:1|256|384|512)WithRSAEncryption|ecdsa-with-SHA
 // Shor-broken key agreement — the harvest-now-decrypt-later surface a lexical
 // scan misses when only the `crypto/*` API is matched, not the negotiated kex.
 const RE_SSH_KEX = /\b(diffie-hellman-group(?:1|14|15|16|17|18)(?:-sha1|-sha256|-sha512)?|diffie-hellman-group-exchange-sha(?:1|256)|ecdh-sha2-nistp(?:256|384|521)|curve25519-sha256)\b/g;
+/**
+ * True when the match at `index` sits inside a DOCUMENTATION field value — a
+ * `description` / `help` / `summary` / `doc` / `comment` / `note` assignment
+ * (`key = "…"` or `key: "…"`), as used by Terraform/Packer variable descriptions,
+ * JSON-schema docs, etc. Classical KEX/cipher algorithm names LISTED in such a field
+ * are prose ("acceptable values include ecdh-sha2-nistp256, …"), not an active
+ * setting, so a transport-token rule must not fire on them. Scans the current line's
+ * prefix only (cheap; the common single-line description case).
+ */
+function inDocFieldValue(content, index) {
+    const lineStart = content.lastIndexOf("\n", index - 1) + 1;
+    const prefix = content.slice(lineStart, index);
+    return /\b(?:description|help|summary|doc|comment|note)\b\s*[:=]/i.test(prefix);
+}
 // A bare key-type token (`ssh-rsa`, `ssh-ed25519`, …) is real SSH crypto only
 // when it is EITHER (a) followed by base64 key material — an actual
 // authorized_keys / known_hosts entry — OR (b) one of ≥2 DISTINCT ssh key/host-key
@@ -910,6 +1005,8 @@ const sshCertDetector = {
         });
         // SSH key-exchange algorithm identifiers (finite-field DH / ECDH / X25519).
         eachMatch(RE_SSH_KEX, content, (m) => {
+            if (inDocFieldValue(content, m.index))
+                return; // names listed in a doc string
             const tok = m[1];
             const algorithm = tok.startsWith("diffie-hellman")
                 ? "DH"
@@ -965,6 +1062,8 @@ const tlsClassicalKexDetector = {
     detect({ file, content }) {
         const findings = [];
         eachMatch(RE_TLS_CLASSICAL_KEX, content, (m) => {
+            if (inDocFieldValue(content, m.index))
+                return; // names listed in a doc string
             const tok = m[0];
             const algorithm = tok.includes("ECDH") ? "ECDH" : "DH";
             findings.push(findingFromRule(RULE_TLS_CLASSICAL_KEX, { file, content, index: m.index, matchLength: m[0].length }, {