@quantakrypto/core 0.4.4 → 0.6.0

package/dist/detectors/dart.js

@@ -0,0 +1,177 @@
+import { eachMatch, findingFromRule, hasExtension, maskBlockComments, maskCommentLines, DART_EXTENSIONS, } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+// RSA key generation / raw RSA encryption engine (pointycastle). Both are
+// confidentiality-capable (a keypair can decrypt; the engine encrypts) → kem.
+const RE_DART_RSA_KEYGEN = /\b(?:RSAKeyGenerator|RSAEngine)\b/g;
+// RSA signature schemes: pointycastle `RSASigner`/`PSSSigner`, cryptography
+// `RsaPss`/`RsaSsaPkcs1v15`. Distinct casing keeps these off the keygen rule.
+const RE_DART_RSA_SIGN = /\b(?:RSASigner|PSSSigner|RsaPss|RsaSsaPkcs1v15)\b/g;
+// ECDSA SIGNING: pointycastle `ECDSASigner`, cryptography `Ecdsa`. `\bEcdsa\b`
+// requires a boundary, so `EcdsaP256`-style concatenations (rare) and the all-caps
+// `ECDSASigner` don't double-fire here. (EC keygen is a SEPARATE, HNDL-exposed rule.)
+const RE_DART_ECDSA = /\b(?:ECDSASigner|Ecdsa)\b/g;
+// EC KEY GENERATION (pointycastle `ECKeyGenerator`) is ambiguous — an EC key can
+// feed ECDSA signing OR ECDH agreement — so it is classified key-exchange/ECDH/
+// hndl:true (the fleet's HNDL-safe convention), NOT folded into the signing rule.
+const RE_DART_EC_KEYGEN = /\bECKeyGenerator\b/g;
+// ECDH key agreement: pointycastle `ECDHBasicAgreement`, cryptography `Ecdh`.
+// `\bEcdh\b` cannot match inside `Ecdsa` (different letters), so no overlap.
+const RE_DART_ECDH = /\b(?:ECDHBasicAgreement|Ecdh)\b/g;
+// Ed25519 signer (both packages spell it `Ed25519`).
+const RE_DART_ED25519 = /\bEd25519\b/g;
+// X25519 key agreement (cryptography `X25519`).
+const RE_DART_X25519 = /\bX25519\b/g;
+// Cheap fast-reject: distinctive substrings that gate the (precise) regex work.
+// If none is present the file cannot contain any of the tracked identifiers.
+const DART_FAST_REJECT = [
+    "RSA",
+    "Rsa",
+    "ECDSA",
+    "Ecdsa",
+    "ECDH",
+    "Ecdh",
+    "ECKeyGenerator",
+    "PSSSigner",
+    "Ed25519",
+    "X25519",
+];
+const RULE_DART_RSA_KEYGEN = {
+    id: "dart-rsa-keygen",
+    title: "Dart RSA key generation / encryption",
+    description: "pointycastle RSAKeyGenerator / RSAEngine",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA key generation / encryption (Dart, pointycastle) is not quantum-safe and RSA encryption is harvest-now-decrypt-later exposed.",
+    remediation: "Migrate to PQC (ML-KEM-768 for encryption / key transport) as Dart crypto packages add support.",
+};
+const RULE_DART_RSA_SIGN = {
+    id: "dart-rsa-sign",
+    title: "Dart RSA signature",
+    description: "pointycastle RSASigner/PSSSigner, cryptography RsaPss/RsaSsaPkcs1v15",
+    category: "signature",
+    // `high`, consistent with every sibling pack's signature severity (go/java/php/
+    // objc/elixir RSA-sign) — the same primitive must not flip CI exit codes by language.
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA signature (Dart) is forgeable by a quantum attacker.",
+    remediation: "Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.",
+};
+const RULE_DART_ECDSA = {
+    id: "dart-ecdsa",
+    title: "Dart ECDSA signature",
+    description: "pointycastle ECDSASigner, cryptography Ecdsa",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical ECDSA signing (Dart) is forgeable by a quantum attacker.",
+    remediation: "Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.",
+};
+const RULE_DART_EC_KEYGEN = {
+    id: "dart-ec-keygen",
+    title: "Dart EC key generation",
+    description: "pointycastle ECKeyGenerator (ambiguous EC key: ECDSA or ECDH)",
+    // Ambiguous EC keygen → key-exchange/ECDH/hndl:true (fleet HNDL-safe convention),
+    // since the key may feed ECDH agreement (harvest-now-decrypt-later exposed).
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "EC key generation (Dart, pointycastle); an EC key can feed ECDH key agreement (harvest-now-decrypt-later exposed) as well as ECDSA signing, and is not quantum-safe.",
+    remediation: "For key agreement migrate to hybrid X25519MLKEM768 (ML-KEM-768); for signatures ML-DSA-65 — as Dart crypto packages add support.",
+};
+const RULE_DART_ECDH = {
+    id: "dart-ecdh",
+    title: "Dart ECDH key agreement",
+    description: "pointycastle ECDHBasicAgreement, cryptography Ecdh",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Elliptic-curve Diffie-Hellman key agreement (Dart) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+    remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768) as Dart crypto packages add support.",
+};
+const RULE_DART_ED25519 = {
+    id: "dart-ed25519",
+    title: "Dart Ed25519 signature",
+    description: "pointycastle / cryptography Ed25519 signer",
+    category: "signature",
+    // `low`, aligned with Ed25519 across the other source packs (swift/rust/go/…) —
+    // the same primitive must not flip CI exit codes based on which language wrote it.
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Ed25519 (Dart) is a modern but still classical signature scheme, forgeable by a quantum attacker.",
+    remediation: "Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.",
+};
+const RULE_DART_X25519 = {
+    id: "dart-x25519",
+    title: "Dart X25519 key agreement",
+    description: "cryptography X25519 key agreement",
+    category: "key-exchange",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "X25519",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "X25519 (Dart) is modern but still classical key agreement — harvest-now-decrypt-later exposed.",
+    remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768) as Dart crypto packages add support.",
+};
+/** Detects classical asymmetric crypto in Dart / Flutter (pointycastle, cryptography). */
+export const dartDetector = {
+    id: "dart-crypto",
+    description: "Classical asymmetric crypto in Dart / Flutter (pointycastle, cryptography)",
+    scope: "source",
+    language: "dart",
+    rules: [
+        RULE_DART_RSA_KEYGEN,
+        RULE_DART_RSA_SIGN,
+        RULE_DART_ECDSA,
+        RULE_DART_EC_KEYGEN,
+        RULE_DART_ECDH,
+        RULE_DART_ED25519,
+        RULE_DART_X25519,
+    ],
+    appliesTo: (f) => hasExtension(f, DART_EXTENSIONS),
+    detect({ file, content }) {
+        // Fast-reject: nothing to do unless a distinctive token appears.
+        if (!DART_FAST_REJECT.some((t) => content.includes(t)))
+            return [];
+        // Suppress C-style comments so commented-out crypto isn't reported. Offsets
+        // are preserved (chars → spaces), so finding line/column stay exact.
+        const masked = maskCommentLines(maskBlockComments(content), ["//"]);
+        const findings = [];
+        // Scan the masked text, but build the finding (its snippet) from the ORIGINAL
+        // `content` so a line with a trailing comment renders live, not blanked.
+        const add = (re, rule) => eachMatch(re, masked, (m) => findings.push(findingFromRule(rule, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+        })));
+        add(RE_DART_RSA_KEYGEN, RULE_DART_RSA_KEYGEN);
+        add(RE_DART_RSA_SIGN, RULE_DART_RSA_SIGN);
+        add(RE_DART_ECDSA, RULE_DART_ECDSA);
+        add(RE_DART_EC_KEYGEN, RULE_DART_EC_KEYGEN);
+        add(RE_DART_ECDH, RULE_DART_ECDH);
+        add(RE_DART_ED25519, RULE_DART_ED25519);
+        add(RE_DART_X25519, RULE_DART_X25519);
+        return findings;
+    },
+};
+//# sourceMappingURL=dart.js.map

package/dist/detectors/dart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dart.js","sourceRoot":"","sources":["../../src/detectors/dart.ts"],"names":[],"mappings":"AAgCA,OAAO,EACL,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;AAChE,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,+EAA+E;AAC/E,mFAAmF;AACnF,sFAAsF;AACtF,MAAM,aAAa,GAAG,4BAA4B,CAAC;AACnD,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAChD,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,YAAY,GAAG,kCAAkC,CAAC;AACxD,qDAAqD;AACrD,MAAM,eAAe,GAAG,cAAc,CAAC;AACvC,gDAAgD;AAChD,MAAM,cAAc,GAAG,aAAa,CAAC;AAErC,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,gBAAgB,GAAsB;IAC1C,KAAK;IACL,KAAK;IACL,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,WAAW;IACX,SAAS;IACT,QAAQ;CACT,CAAC;AAEF,MAAM,oBAAoB,GAAa;IACrC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6IAA6I;IAC/I,WAAW,EACT,iGAAiG;CACpG,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,sEAAsE;IACnF,QAAQ,EAAE,WAAW;IACrB,gFAAgF;IAChF,sFAAsF;IACtF,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,oEAAoE;IAC7E,WAAW,EACT,sFAAsF;CACzF,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,8CAA8C;IAC3D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,oEAAoE;IAC7E,WAAW,EACT,sFAAsF;CACzF,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,+DAA+D;IAC5E,kFAAkF;IAClF,6EAA6E;IAC7E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,sKAAsK;IACxK,WAAW,EACT,kIAAkI;CACrI,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,oDAAoD;IACjE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+GAA+G;IACjH,WAAW,EACT,kGAAkG;CACrG,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,4CAA4C;IACzD,QAAQ,EAAE,WAAW;IACrB,gFAAgF;IAChF,mFAAmF;IACnF,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mGAAmG;IACrG,WAAW,EACT,sFAAsF;CACzF,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,gGAAgG;IAClG,WAAW,EACT,kGAAkG;CACrG,CAAC;AAEF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,4EAA4E;IACzF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,MAAM;IAChB,KAAK,EAAE;QACL,oBAAoB;QACpB,kBAAkB;QAClB,eAAe;QACf,mBAAmB;QACnB,cAAc;QACd,iBAAiB;QACjB,gBAAgB;KACjB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,iEAAiE;QACjE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAElE,4EAA4E;QAC5E,qEAAqE;QACrE,MAAM,MAAM,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,8EAA8E;QAC9E,yEAAyE;QACzE,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAC1B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE;YACpB,IAAI;YACJ,OAAO;YACP,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;SACzB,CAAC,CACH,CACF,CAAC;QACJ,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;QAC9C,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAClC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source detector for classical asymmetric cryptography in Dart / Flutter.\n *\n * Dart has no asymmetric crypto in its standard library, so real-world code\n * reaches for one of the two dominant pub.dev packages, and both expose their\n * primitives through distinctive class names — which makes a lexical scan (the\n * same zero-dependency strategy as every other language pack here) precise:\n *\n *  - package:pointycastle (a Bouncy Castle port). RSA via `RSAKeyGenerator`,\n *    `RSAEngine`, `RSASigner`, `PSSSigner`; EC via `ECKeyGenerator`,\n *    `ECDSASigner`, `ECDHBasicAgreement`; Edwards via `Ed25519`.\n *  - package:cryptography (Dart-native). RSA via `RsaPss`, `RsaSsaPkcs1v15`;\n *    EC via `Ecdsa`, `Ecdh`; modern curves via `Ed25519`, `X25519`.\n *\n * HNDL (harvest-now-decrypt-later) reasoning — the field that drives urgency:\n *  - RSA encryption (`RSAEngine`) and RSA key generation (`RSAKeyGenerator`,\n *    which yields keys that can decrypt) are confidentiality surfaces → hndl:true.\n *  - (EC)DH key agreement (`ECDHBasicAgreement`, `Ecdh`, `X25519`) is the classic\n *    HNDL target — recorded ciphertext is decryptable once the curve falls → hndl:true.\n *  - Signatures (`RSASigner`/`PSSSigner`/`RsaPss`/`RsaSsaPkcs1v15`, `ECDSASigner`/\n *    `Ecdsa`, `Ed25519`) are forgeable by a quantum attacker but not retroactively\n *    breakable → hndl:false.\n *  - `ECKeyGenerator` is ambiguous (an EC key can feed either ECDSA or ECDH); it is\n *    classified conservatively as an ECDSA signing key (hndl:false), the Dart default.\n *\n * Comment suppression is C-style (`//` line + `/* … *\\/` block), matching Dart's\n * lexer, so commented-out crypto is not reported. The regexes are `\\b`-anchored on\n * the library-specific identifiers above; none matches a bare `RSA`/`EC` substring,\n * keeping false positives low. A cheap substring fast-reject skips the regex work on\n * the overwhelming majority of `.dart` files that touch no asymmetric crypto.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport {\n  eachMatch,\n  findingFromRule,\n  hasExtension,\n  maskBlockComments,\n  maskCommentLines,\n  DART_EXTENSIONS,\n} from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n// RSA key generation / raw RSA encryption engine (pointycastle). Both are\n// confidentiality-capable (a keypair can decrypt; the engine encrypts) → kem.\nconst RE_DART_RSA_KEYGEN = /\\b(?:RSAKeyGenerator|RSAEngine)\\b/g;\n// RSA signature schemes: pointycastle `RSASigner`/`PSSSigner`, cryptography\n// `RsaPss`/`RsaSsaPkcs1v15`. Distinct casing keeps these off the keygen rule.\nconst RE_DART_RSA_SIGN = /\\b(?:RSASigner|PSSSigner|RsaPss|RsaSsaPkcs1v15)\\b/g;\n// ECDSA SIGNING: pointycastle `ECDSASigner`, cryptography `Ecdsa`. `\\bEcdsa\\b`\n// requires a boundary, so `EcdsaP256`-style concatenations (rare) and the all-caps\n// `ECDSASigner` don't double-fire here. (EC keygen is a SEPARATE, HNDL-exposed rule.)\nconst RE_DART_ECDSA = /\\b(?:ECDSASigner|Ecdsa)\\b/g;\n// EC KEY GENERATION (pointycastle `ECKeyGenerator`) is ambiguous — an EC key can\n// feed ECDSA signing OR ECDH agreement — so it is classified key-exchange/ECDH/\n// hndl:true (the fleet's HNDL-safe convention), NOT folded into the signing rule.\nconst RE_DART_EC_KEYGEN = /\\bECKeyGenerator\\b/g;\n// ECDH key agreement: pointycastle `ECDHBasicAgreement`, cryptography `Ecdh`.\n// `\\bEcdh\\b` cannot match inside `Ecdsa` (different letters), so no overlap.\nconst RE_DART_ECDH = /\\b(?:ECDHBasicAgreement|Ecdh)\\b/g;\n// Ed25519 signer (both packages spell it `Ed25519`).\nconst RE_DART_ED25519 = /\\bEd25519\\b/g;\n// X25519 key agreement (cryptography `X25519`).\nconst RE_DART_X25519 = /\\bX25519\\b/g;\n\n// Cheap fast-reject: distinctive substrings that gate the (precise) regex work.\n// If none is present the file cannot contain any of the tracked identifiers.\nconst DART_FAST_REJECT: readonly string[] = [\n  \"RSA\",\n  \"Rsa\",\n  \"ECDSA\",\n  \"Ecdsa\",\n  \"ECDH\",\n  \"Ecdh\",\n  \"ECKeyGenerator\",\n  \"PSSSigner\",\n  \"Ed25519\",\n  \"X25519\",\n];\n\nconst RULE_DART_RSA_KEYGEN: RuleMeta = {\n  id: \"dart-rsa-keygen\",\n  title: \"Dart RSA key generation / encryption\",\n  description: \"pointycastle RSAKeyGenerator / RSAEngine\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical RSA key generation / encryption (Dart, pointycastle) is not quantum-safe and RSA encryption is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"Migrate to PQC (ML-KEM-768 for encryption / key transport) as Dart crypto packages add support.\",\n};\nconst RULE_DART_RSA_SIGN: RuleMeta = {\n  id: \"dart-rsa-sign\",\n  title: \"Dart RSA signature\",\n  description: \"pointycastle RSASigner/PSSSigner, cryptography RsaPss/RsaSsaPkcs1v15\",\n  category: \"signature\",\n  // `high`, consistent with every sibling pack's signature severity (go/java/php/\n  // objc/elixir RSA-sign) — the same primitive must not flip CI exit codes by language.\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical RSA signature (Dart) is forgeable by a quantum attacker.\",\n  remediation:\n    \"Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.\",\n};\nconst RULE_DART_ECDSA: RuleMeta = {\n  id: \"dart-ecdsa\",\n  title: \"Dart ECDSA signature\",\n  description: \"pointycastle ECDSASigner, cryptography Ecdsa\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical ECDSA signing (Dart) is forgeable by a quantum attacker.\",\n  remediation:\n    \"Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.\",\n};\nconst RULE_DART_EC_KEYGEN: RuleMeta = {\n  id: \"dart-ec-keygen\",\n  title: \"Dart EC key generation\",\n  description: \"pointycastle ECKeyGenerator (ambiguous EC key: ECDSA or ECDH)\",\n  // Ambiguous EC keygen → key-exchange/ECDH/hndl:true (fleet HNDL-safe convention),\n  // since the key may feed ECDH agreement (harvest-now-decrypt-later exposed).\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"EC key generation (Dart, pointycastle); an EC key can feed ECDH key agreement (harvest-now-decrypt-later exposed) as well as ECDSA signing, and is not quantum-safe.\",\n  remediation:\n    \"For key agreement migrate to hybrid X25519MLKEM768 (ML-KEM-768); for signatures ML-DSA-65 — as Dart crypto packages add support.\",\n};\nconst RULE_DART_ECDH: RuleMeta = {\n  id: \"dart-ecdh\",\n  title: \"Dart ECDH key agreement\",\n  description: \"pointycastle ECDHBasicAgreement, cryptography Ecdh\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman key agreement (Dart) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n  remediation:\n    \"Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768) as Dart crypto packages add support.\",\n};\nconst RULE_DART_ED25519: RuleMeta = {\n  id: \"dart-ed25519\",\n  title: \"Dart Ed25519 signature\",\n  description: \"pointycastle / cryptography Ed25519 signer\",\n  category: \"signature\",\n  // `low`, aligned with Ed25519 across the other source packs (swift/rust/go/…) —\n  // the same primitive must not flip CI exit codes based on which language wrote it.\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Ed25519 (Dart) is a modern but still classical signature scheme, forgeable by a quantum attacker.\",\n  remediation:\n    \"Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.\",\n};\nconst RULE_DART_X25519: RuleMeta = {\n  id: \"dart-x25519\",\n  title: \"Dart X25519 key agreement\",\n  description: \"cryptography X25519 key agreement\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"X25519 (Dart) is modern but still classical key agreement — harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768) as Dart crypto packages add support.\",\n};\n\n/** Detects classical asymmetric crypto in Dart / Flutter (pointycastle, cryptography). */\nexport const dartDetector: Detector = {\n  id: \"dart-crypto\",\n  description: \"Classical asymmetric crypto in Dart / Flutter (pointycastle, cryptography)\",\n  scope: \"source\",\n  language: \"dart\",\n  rules: [\n    RULE_DART_RSA_KEYGEN,\n    RULE_DART_RSA_SIGN,\n    RULE_DART_ECDSA,\n    RULE_DART_EC_KEYGEN,\n    RULE_DART_ECDH,\n    RULE_DART_ED25519,\n    RULE_DART_X25519,\n  ],\n  appliesTo: (f) => hasExtension(f, DART_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    // Fast-reject: nothing to do unless a distinctive token appears.\n    if (!DART_FAST_REJECT.some((t) => content.includes(t))) return [];\n\n    // Suppress C-style comments so commented-out crypto isn't reported. Offsets\n    // are preserved (chars → spaces), so finding line/column stay exact.\n    const masked = maskCommentLines(maskBlockComments(content), [\"//\"]);\n\n    const findings: Finding[] = [];\n    // Scan the masked text, but build the finding (its snippet) from the ORIGINAL\n    // `content` so a line with a trailing comment renders live, not blanked.\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, masked, (m) =>\n        findings.push(\n          findingFromRule(rule, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        ),\n      );\n    add(RE_DART_RSA_KEYGEN, RULE_DART_RSA_KEYGEN);\n    add(RE_DART_RSA_SIGN, RULE_DART_RSA_SIGN);\n    add(RE_DART_ECDSA, RULE_DART_ECDSA);\n    add(RE_DART_EC_KEYGEN, RULE_DART_EC_KEYGEN);\n    add(RE_DART_ECDH, RULE_DART_ECDH);\n    add(RE_DART_ED25519, RULE_DART_ED25519);\n    add(RE_DART_X25519, RULE_DART_X25519);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/database.d.ts

@@ -7,9 +7,11 @@
  * Covered:
  *  - pgcrypto `pgp_pub_encrypt` / `pgp_pub_decrypt` in `.sql` (RSA/ElGamal public-key
  *    encryption of column data) → `hndl:true`.
- *  - libpq `sslmode = disable | allow | prefer | require` in any config/connection
- *    file — a mode that does NOT verify the server certificate, so the classical
- *    TLS session it does (or doesn't) negotiate is both MITM-able and harvestable.
+ *  - libpq `sslmode = allow | prefer | require` in any config/connection file — a
+ *    mode that does NOT verify the server certificate, so the classical TLS session
+ *    it negotiates is both MITM-able and harvestable. `disable` is excluded: it
+ *    negotiates no TLS at all, so there is no key exchange to harvest (a plaintext
+ *    concern, out of scope for a PQC-readiness scanner).
  */
 import type { Detector } from "../types.js";
 /** Detects classical database at-rest / transport crypto. */

package/dist/detectors/database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/detectors/database.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAqC/D,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,EAAE,QAoC9B,CAAC"}
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/detectors/database.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAoE/D,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,EAAE,QAwD9B,CAAC"}

package/dist/detectors/database.js

@@ -1,7 +1,16 @@
-import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension, maskCommentLines, } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION } from "../cwe.js";
 const RE_PGCRYPTO = /\bpgp_pub_(?:encrypt|decrypt)\b/g;
-const RE_WEAK_SSLMODE = /\bsslmode\s*=\s*["']?(?:disable|allow|prefer|require)\b/gi;
+// Matches the no-verification TLS modes across libpq (`sslmode=require`), the
+// `PGSSLMODE` env var, MySQL (`ssl-mode=PREFERRED`/`REQUIRED`, hyphenated), and YAML
+// connection config (`sslmode: require`) — i.e. an optional `pg` prefix, `-`/`_` or no
+// separator, `:` or `=`, and the libpq/MySQL value spellings.
+const RE_WEAK_SSLMODE = /\b(?:pg)?ssl[-_]?mode\s*[:=]\s*["']?(?:allow|prefer(?:red)?|require[d]?)\b/gi;
+// SQL Server TDE: the database encryption key is protected by a classical RSA
+// asymmetric key / certificate. `CREATE ASYMMETRIC KEY … WITH ALGORITHM = RSA_2048`
+// is the distinctive form; the span between the two clauses is lazily bounded to keep
+// matching linear.
+const RE_MSSQL_TDE_RSA = /\bCREATE\s+ASYMMETRIC\s+KEY\b[\s\S]{0,300}?\bALGORITHM\s*=\s*RSA_\d+/gi;
 const RULE_PGCRYPTO = {
     id: "db-pgcrypto-pubkey",
     title: "pgcrypto public-key encryption",
@@ -15,10 +24,23 @@ const RULE_PGCRYPTO = {
     message: "Column data is encrypted with pgcrypto public-key crypto (classical RSA/ElGamal); stored ciphertext is harvest-now-decrypt-later exposed.",
     remediation: "Plan migration to a post-quantum KEM (ML-KEM-768) envelope for at-rest data; re-encrypt long-lived rows.",
 };
+const RULE_MSSQL_TDE_RSA = {
+    id: "db-tde-rsa",
+    title: "SQL Server TDE RSA key",
+    description: "SQL Server CREATE ASYMMETRIC KEY ... WITH ALGORITHM = RSA_* (TDE key protection)",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Transparent Data Encryption protects the database encryption key with a classical RSA asymmetric key; the at-rest data is harvest-now-decrypt-later exposed once the RSA key falls.",
+    remediation: "Plan migration to a PQC KEM (ML-KEM-768) for TDE key protection as the database engine adds support; re-key long-lived encrypted databases.",
+};
 const RULE_WEAK_SSLMODE = {
     id: "db-weak-sslmode",
     title: "Database sslmode without verification",
-    description: "libpq sslmode is disable/allow/prefer/require (no certificate verification)",
+    description: "libpq sslmode is allow/prefer/require (no certificate verification)",
     category: "tls",
     severity: "medium",
     confidence: "high",
@@ -30,24 +52,39 @@ const RULE_WEAK_SSLMODE = {
 /** Detects classical database at-rest / transport crypto. */
 export const databaseDetector = {
     id: "database-crypto",
-    description: "Classical crypto in database usage (pgcrypto public-key, weak client sslmode)",
+    description: "Classical crypto in database usage (pgcrypto public-key, SQL Server TDE, weak client sslmode)",
     scope: "config",
     language: "any",
-    rules: [RULE_PGCRYPTO, RULE_WEAK_SSLMODE],
+    rules: [RULE_PGCRYPTO, RULE_MSSQL_TDE_RSA, RULE_WEAK_SSLMODE],
     // Skip prose/docs: a README showing `sslmode=require` is not a live connection string.
     appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
     detect({ file, content }) {
         const findings = [];
+        // Mask SQL (`--`, single-line `/* … */`), shell/ini (`#`), and ini (`;`) line
+        // comments: a commented `-- pgp_pub_encrypt` or `; sslmode=require` is not active.
+        const scan = maskCommentLines(content, ["#", "--", ";", "/*"]);
         if (file.toLowerCase().endsWith(".sql") && content.includes("pgp_pub_")) {
-            eachMatch(RE_PGCRYPTO, content, (m) => findings.push(findingFromRule(RULE_PGCRYPTO, {
+            eachMatch(RE_PGCRYPTO, scan, (m) => findings.push(findingFromRule(RULE_PGCRYPTO, {
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+            })));
+        }
+        const lc = content.toLowerCase();
+        // Cheap prefilter; matches the separators the RE_WEAK_SSLMODE regex accepts
+        // (`sslmode`, `ssl-mode`, `ssl_mode`) so no supported form is gated out.
+        if (lc.includes("sslmode") || lc.includes("ssl-mode") || lc.includes("ssl_mode")) {
+            eachMatch(RE_WEAK_SSLMODE, scan, (m) => findings.push(findingFromRule(RULE_WEAK_SSLMODE, {
                 file,
                 content,
                 index: m.index,
                 matchLength: m[0].length,
             })));
         }
-        if (content.includes("sslmode")) {
-            eachMatch(RE_WEAK_SSLMODE, content, (m) => findings.push(findingFromRule(RULE_WEAK_SSLMODE, {
+        // SQL Server TDE: a classical RSA asymmetric key protecting the DEK.
+        if (lc.includes("asymmetric key")) {
+            eachMatch(RE_MSSQL_TDE_RSA, scan, (m) => findings.push(findingFromRule(RULE_MSSQL_TDE_RSA, {
                 file,
                 content,
                 index: m.index,

package/dist/detectors/database.js.map

@@ -1 +1 @@
-{"version":3,"file":"database.js","sourceRoot":"","sources":["../../src/detectors/database.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,WAAW,GAAG,kCAAkC,CAAC;AACvD,MAAM,eAAe,GAAG,2DAA2D,CAAC;AAEpF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,gCAAgC;IACvC,WAAW,EAAE,kFAAkF;IAC/F,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2IAA2I;IAC7I,WAAW,EACT,0GAA0G;CAC7G,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,6EAA6E;IAC1F,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EACL,sIAAsI;IACxI,WAAW,EACT,oGAAoG;CACvG,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,iBAAiB;IACrB,WAAW,EAAE,+EAA+E;IAC5F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC;IACzC,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CACpC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,aAAa,EAAE;gBAC7B,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CACxC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,iBAAiB,EAAE;gBACjC,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical crypto in database usage — public-key encryption of\n * stored data (pgcrypto) and weak client TLS posture. Data-at-rest is the sharpest\n * harvest-now-decrypt-later target: a column encrypted to an RSA key today is a\n * time capsule an adversary can hold until key recovery is cheap.\n *\n * Covered:\n *  - pgcrypto `pgp_pub_encrypt` / `pgp_pub_decrypt` in `.sql` (RSA/ElGamal public-key\n *    encryption of column data) → `hndl:true`.\n *  - libpq `sslmode = disable | allow | prefer | require` in any config/connection\n *    file — a mode that does NOT verify the server certificate, so the classical\n *    TLS session it does (or doesn't) negotiate is both MITM-able and harvestable.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION } from \"../cwe.js\";\n\nconst RE_PGCRYPTO = /\\bpgp_pub_(?:encrypt|decrypt)\\b/g;\nconst RE_WEAK_SSLMODE = /\\bsslmode\\s*=\\s*[\"']?(?:disable|allow|prefer|require)\\b/gi;\n\nconst RULE_PGCRYPTO: RuleMeta = {\n  id: \"db-pgcrypto-pubkey\",\n  title: \"pgcrypto public-key encryption\",\n  description: \"Postgres pgcrypto pgp_pub_encrypt / pgp_pub_decrypt (RSA/ElGamal) on stored data\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Column data is encrypted with pgcrypto public-key crypto (classical RSA/ElGamal); stored ciphertext is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"Plan migration to a post-quantum KEM (ML-KEM-768) envelope for at-rest data; re-encrypt long-lived rows.\",\n};\nconst RULE_WEAK_SSLMODE: RuleMeta = {\n  id: \"db-weak-sslmode\",\n  title: \"Database sslmode without verification\",\n  description: \"libpq sslmode is disable/allow/prefer/require (no certificate verification)\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_CERT_VALIDATION,\n  message:\n    \"Database sslmode does not verify the server certificate; the classical TLS session is MITM-able and its key exchange is harvestable.\",\n  remediation:\n    \"Use sslmode=verify-full and TLS 1.3; track PQC-hybrid KEX (X25519MLKEM768) for database transport.\",\n};\n\n/** Detects classical database at-rest / transport crypto. */\nexport const databaseDetector: Detector = {\n  id: \"database-crypto\",\n  description: \"Classical crypto in database usage (pgcrypto public-key, weak client sslmode)\",\n  scope: \"config\",\n  language: \"any\",\n  rules: [RULE_PGCRYPTO, RULE_WEAK_SSLMODE],\n  // Skip prose/docs: a README showing `sslmode=require` is not a live connection string.\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    if (file.toLowerCase().endsWith(\".sql\") && content.includes(\"pgp_pub_\")) {\n      eachMatch(RE_PGCRYPTO, content, (m) =>\n        findings.push(\n          findingFromRule(RULE_PGCRYPTO, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        ),\n      );\n    }\n    if (content.includes(\"sslmode\")) {\n      eachMatch(RE_WEAK_SSLMODE, content, (m) =>\n        findings.push(\n          findingFromRule(RULE_WEAK_SSLMODE, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        ),\n      );\n    }\n    return findings;\n  },\n};\n"]}
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../src/detectors/database.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,cAAc,EACd,SAAS,EACT,eAAe,EACf,YAAY,EACZ,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,WAAW,GAAG,kCAAkC,CAAC;AACvD,8EAA8E;AAC9E,qFAAqF;AACrF,uFAAuF;AACvF,8DAA8D;AAC9D,MAAM,eAAe,GACnB,8EAA8E,CAAC;AACjF,8EAA8E;AAC9E,oFAAoF;AACpF,sFAAsF;AACtF,mBAAmB;AACnB,MAAM,gBAAgB,GAAG,wEAAwE,CAAC;AAElG,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,gCAAgC;IACvC,WAAW,EAAE,kFAAkF;IAC/F,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2IAA2I;IAC7I,WAAW,EACT,0GAA0G;CAC7G,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,kFAAkF;IAC/F,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,qLAAqL;IACvL,WAAW,EACT,6IAA6I;CAChJ,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,qEAAqE;IAClF,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EACL,sIAAsI;IACxI,WAAW,EACT,oGAAoG;CACvG,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,iBAAiB;IACrB,WAAW,EACT,+FAA+F;IACjG,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,CAAC,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,CAAC;IAC7D,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,8EAA8E;QAC9E,mFAAmF;QACnF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxE,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACjC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,aAAa,EAAE;gBAC7B,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CACF,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACjC,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjF,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACrC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,iBAAiB,EAAE;gBACjC,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CACF,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,IAAI,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACtC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,kBAAkB,EAAE;gBAClC,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CACF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical crypto in database usage — public-key encryption of\n * stored data (pgcrypto) and weak client TLS posture. Data-at-rest is the sharpest\n * harvest-now-decrypt-later target: a column encrypted to an RSA key today is a\n * time capsule an adversary can hold until key recovery is cheap.\n *\n * Covered:\n *  - pgcrypto `pgp_pub_encrypt` / `pgp_pub_decrypt` in `.sql` (RSA/ElGamal public-key\n *    encryption of column data) → `hndl:true`.\n *  - libpq `sslmode = allow | prefer | require` in any config/connection file — a\n *    mode that does NOT verify the server certificate, so the classical TLS session\n *    it negotiates is both MITM-able and harvestable. `disable` is excluded: it\n *    negotiates no TLS at all, so there is no key exchange to harvest (a plaintext\n *    concern, out of scope for a PQC-readiness scanner).\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport {\n  DOC_EXTENSIONS,\n  eachMatch,\n  findingFromRule,\n  hasExtension,\n  maskCommentLines,\n} from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION } from \"../cwe.js\";\n\nconst RE_PGCRYPTO = /\\bpgp_pub_(?:encrypt|decrypt)\\b/g;\n// Matches the no-verification TLS modes across libpq (`sslmode=require`), the\n// `PGSSLMODE` env var, MySQL (`ssl-mode=PREFERRED`/`REQUIRED`, hyphenated), and YAML\n// connection config (`sslmode: require`) — i.e. an optional `pg` prefix, `-`/`_` or no\n// separator, `:` or `=`, and the libpq/MySQL value spellings.\nconst RE_WEAK_SSLMODE =\n  /\\b(?:pg)?ssl[-_]?mode\\s*[:=]\\s*[\"']?(?:allow|prefer(?:red)?|require[d]?)\\b/gi;\n// SQL Server TDE: the database encryption key is protected by a classical RSA\n// asymmetric key / certificate. `CREATE ASYMMETRIC KEY … WITH ALGORITHM = RSA_2048`\n// is the distinctive form; the span between the two clauses is lazily bounded to keep\n// matching linear.\nconst RE_MSSQL_TDE_RSA = /\\bCREATE\\s+ASYMMETRIC\\s+KEY\\b[\\s\\S]{0,300}?\\bALGORITHM\\s*=\\s*RSA_\\d+/gi;\n\nconst RULE_PGCRYPTO: RuleMeta = {\n  id: \"db-pgcrypto-pubkey\",\n  title: \"pgcrypto public-key encryption\",\n  description: \"Postgres pgcrypto pgp_pub_encrypt / pgp_pub_decrypt (RSA/ElGamal) on stored data\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Column data is encrypted with pgcrypto public-key crypto (classical RSA/ElGamal); stored ciphertext is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"Plan migration to a post-quantum KEM (ML-KEM-768) envelope for at-rest data; re-encrypt long-lived rows.\",\n};\nconst RULE_MSSQL_TDE_RSA: RuleMeta = {\n  id: \"db-tde-rsa\",\n  title: \"SQL Server TDE RSA key\",\n  description: \"SQL Server CREATE ASYMMETRIC KEY ... WITH ALGORITHM = RSA_* (TDE key protection)\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Transparent Data Encryption protects the database encryption key with a classical RSA asymmetric key; the at-rest data is harvest-now-decrypt-later exposed once the RSA key falls.\",\n  remediation:\n    \"Plan migration to a PQC KEM (ML-KEM-768) for TDE key protection as the database engine adds support; re-key long-lived encrypted databases.\",\n};\nconst RULE_WEAK_SSLMODE: RuleMeta = {\n  id: \"db-weak-sslmode\",\n  title: \"Database sslmode without verification\",\n  description: \"libpq sslmode is allow/prefer/require (no certificate verification)\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_CERT_VALIDATION,\n  message:\n    \"Database sslmode does not verify the server certificate; the classical TLS session is MITM-able and its key exchange is harvestable.\",\n  remediation:\n    \"Use sslmode=verify-full and TLS 1.3; track PQC-hybrid KEX (X25519MLKEM768) for database transport.\",\n};\n\n/** Detects classical database at-rest / transport crypto. */\nexport const databaseDetector: Detector = {\n  id: \"database-crypto\",\n  description:\n    \"Classical crypto in database usage (pgcrypto public-key, SQL Server TDE, weak client sslmode)\",\n  scope: \"config\",\n  language: \"any\",\n  rules: [RULE_PGCRYPTO, RULE_MSSQL_TDE_RSA, RULE_WEAK_SSLMODE],\n  // Skip prose/docs: a README showing `sslmode=require` is not a live connection string.\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    // Mask SQL (`--`, single-line `/* … */`), shell/ini (`#`), and ini (`;`) line\n    // comments: a commented `-- pgp_pub_encrypt` or `; sslmode=require` is not active.\n    const scan = maskCommentLines(content, [\"#\", \"--\", \";\", \"/*\"]);\n    if (file.toLowerCase().endsWith(\".sql\") && content.includes(\"pgp_pub_\")) {\n      eachMatch(RE_PGCRYPTO, scan, (m) =>\n        findings.push(\n          findingFromRule(RULE_PGCRYPTO, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        ),\n      );\n    }\n    const lc = content.toLowerCase();\n    // Cheap prefilter; matches the separators the RE_WEAK_SSLMODE regex accepts\n    // (`sslmode`, `ssl-mode`, `ssl_mode`) so no supported form is gated out.\n    if (lc.includes(\"sslmode\") || lc.includes(\"ssl-mode\") || lc.includes(\"ssl_mode\")) {\n      eachMatch(RE_WEAK_SSLMODE, scan, (m) =>\n        findings.push(\n          findingFromRule(RULE_WEAK_SSLMODE, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        ),\n      );\n    }\n    // SQL Server TDE: a classical RSA asymmetric key protecting the DEK.\n    if (lc.includes(\"asymmetric key\")) {\n      eachMatch(RE_MSSQL_TDE_RSA, scan, (m) =>\n        findings.push(\n          findingFromRule(RULE_MSSQL_TDE_RSA, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        ),\n      );\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/dkim.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Config detector: classical DKIM email-signing keys and algorithms in DNS
+ * zone files, mail-server signer config (OpenDKIM), and captured
+ * `DKIM-Signature:` header fields (RFC 6376 + RFC 8463).
+ *
+ * DKIM (DomainKeys Identified Mail) authenticates the *origin* of email: the
+ * sending MTA signs selected header/body content with a private key, publishes
+ * the matching public key as a DNS TXT record at
+ * `<selector>._domainkey.<domain>`, and receivers verify the `DKIM-Signature`
+ * header against that published key. Like DNSSEC (see `dnssec.ts`), this is a
+ * pure *signature* surface: there is no confidentiality to harvest, so a DKIM
+ * key is NOT harvest-now-decrypt-later exposed (`hndl: false`). What breaks
+ * once a cryptographically-relevant quantum computer (CRQC) exists is
+ * unforgeability — an attacker who can derive the private key from the
+ * published public key can mint valid `DKIM-Signature` headers and spoof mail
+ * that passes DKIM/DMARC. So these findings are `category: "signature"`.
+ *
+ * Crypto surface, mapped to {@link AlgorithmFamily}:
+ *  - `k=rsa` DNS key-type tag / `a=rsa-sha256` / `a=rsa-sha1` (DKIM-Signature
+ *    algorithm tag) / OpenDKIM `SigningAlgorithm rsa-sha256|rsa-sha1`   → RSA
+ *  - `k=ed25519` DNS key-type tag / `a=ed25519-sha256` / OpenDKIM
+ *    `SigningAlgorithm ed25519-sha256` (RFC 8463)                        → EdDSA
+ *
+ * Ed25519 DKIM (RFC 8463) is MODERN but still CLASSICAL: rotating an RSA DKIM
+ * key to Ed25519 shrinks the DNS record and is good hygiene, but it is NOT a
+ * post-quantum fix — an Ed25519 signature is just as forgeable under a CRQC.
+ * The remediation text says so honestly: there is no standardized PQC DKIM yet;
+ * the only real action is to track IETF work.
+ *
+ * Two match shapes are covered per family, both gated to a small config
+ * extension set AND to a file-level DKIM marker (see `hasDkimMarker`) so the
+ * short tag tokens (`k=rsa`, `a=rsa-sha256`) can't fire on unrelated config:
+ *
+ *  1. DNS KEY-TYPE tag — `k=rsa` / `k=ed25519` inside a published DKIM TXT
+ *     record (`v=DKIM1; k=rsa; p=MIGf...`). Whitespace around `=` is tolerated.
+ *  2. SIGNING-ALGORITHM tag — the `a=` tag of a `DKIM-Signature` header
+ *     (`a=rsa-sha256`, `a=ed25519-sha256`) and the OpenDKIM `SigningAlgorithm`
+ *     directive (`SigningAlgorithm rsa-sha256`). The RSA variant deliberately
+ *     also matches the legacy `rsa-sha1`.
+ *
+ * Fast reject: `detect()` bails unless the file carries a DKIM-specific marker
+ * (`v=DKIM1`, `_domainkey`, a `DKIM-Signature` field, an OpenDKIM
+ * `SigningAlgorithm` directive, or a bare `k=rsa`/`k=ed25519` key-type tag).
+ * This stops the generic-looking `k=rsa` / `a=rsa-sha256` tokens from firing on
+ * an unrelated `.conf` that happens to contain an `a=`/`k=` assignment for its
+ * own reasons. Prose is excluded twice over: `appliesTo` restricts to config
+ * extensions (README/`.md` never applies), and `detect()` re-guards against
+ * {@link DOC_EXTENSIONS} defensively so a docs file that slipped through a
+ * broader gate could never be flagged for mentioning `k=rsa` in a sentence.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical DKIM signing keys/algorithms in zone files and mail signer config. */
+export declare const dkimDetector: Detector;
+//# sourceMappingURL=dkim.d.ts.map

package/dist/detectors/dkim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dkim.d.ts","sourceRoot":"","sources":["../../src/detectors/dkim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA2F/D,2FAA2F;AAC3F,eAAO,MAAM,YAAY,EAAE,QA6B1B,CAAC"}

package/dist/detectors/dkim.js

@@ -0,0 +1,92 @@
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension, maskCommentLines, } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+// DKIM records live in DNS zone files (`.zone`/`.db`), mail-server signer config
+// (`.conf`), and captured header/TXT fixtures (`.txt`). Gated further by
+// `hasDkimMarker` so the short tag tokens can't fire on unrelated config.
+const DKIM_EXTENSIONS = [".zone", ".db", ".conf", ".txt"];
+// --- RSA (k=rsa / rsa-sha256 / rsa-sha1) ---
+// DNS key-type tag: `k=rsa` in a published DKIM TXT record. Whitespace tolerated
+// around `=`; case-insensitive since tags are conventionally lowercase but not
+// required to be. `\b` after `rsa` keeps it from matching `rsa-...` substrings.
+const RE_RSA_KEYTAG = /\bk\s*=\s*rsa\b/gi;
+// DKIM-Signature `a=` tag: `a=rsa-sha256` / `a=rsa-sha1`.
+const RE_RSA_ALGTAG = /\ba\s*=\s*rsa-sha(?:256|1)\b/gi;
+// OpenDKIM signer directive: `SigningAlgorithm rsa-sha256` / `rsa-sha1`.
+const RE_RSA_OPENDKIM = /\bSigningAlgorithm\s+rsa-sha(?:256|1)\b/gi;
+// --- EdDSA (k=ed25519 / ed25519-sha256, RFC 8463) ---
+const RE_EDDSA_KEYTAG = /\bk\s*=\s*ed25519\b/gi;
+const RE_EDDSA_ALGTAG = /\ba\s*=\s*ed25519-sha256\b/gi;
+const RE_EDDSA_OPENDKIM = /\bSigningAlgorithm\s+ed25519-sha256\b/gi;
+const RULE_DKIM_RSA = {
+    id: "dkim-rsa-key",
+    title: "DKIM RSA signing key/algorithm",
+    description: "DKIM email signing configured with a classical RSA key/algorithm (k=rsa, a=rsa-sha256/rsa-sha1)",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "DKIM email signing uses a classical RSA key/algorithm (k=rsa / rsa-sha256 / rsa-sha1); DKIM-Signature headers become forgeable once a CRQC exists, allowing DKIM/DMARC-passing spoofed mail.",
+    remediation: "There is no standardized post-quantum DKIM algorithm yet — track IETF work; note that rotating RSA to Ed25519 (RFC 8463) is good hygiene but NOT a PQC fix, since Ed25519 is still classical and equally forgeable under a CRQC.",
+};
+const RULE_DKIM_EDDSA = {
+    id: "dkim-ed25519-key",
+    title: "DKIM Ed25519 signing key/algorithm",
+    description: "DKIM email signing configured with a classical Ed25519 key/algorithm (k=ed25519, a=ed25519-sha256, RFC 8463)",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "DKIM email signing uses an Ed25519 key/algorithm (k=ed25519 / ed25519-sha256, RFC 8463) — modern but still classical; DKIM-Signature headers become forgeable once a CRQC exists.",
+    remediation: "There is no standardized post-quantum DKIM algorithm yet — track IETF work. Ed25519 is already the smaller/modern DKIM choice but is NOT post-quantum: it stays forgeable under a CRQC, so no rotation today resolves the quantum exposure.",
+};
+/**
+ * True when `content` carries a DKIM-specific marker. Deliberately does NOT accept
+ * a bare `k=rsa` / `k=ed25519` tag as its own marker: that tag is exactly what the
+ * RSA/EdDSA rules match, so treating it as the gate would be self-satisfying and
+ * fire on unrelated prose ("set `k=rsa` for the legacy importer"). A real DKIM
+ * record always also carries `v=DKIM1`, `_domainkey`, a `DKIM-Signature` field, or
+ * the OpenDKIM `SigningAlgorithm` directive — one of those must be present.
+ */
+function hasDkimMarker(content) {
+    return (/\bDKIM1\b/i.test(content) ||
+        content.includes("_domainkey") ||
+        /DKIM-Signature/i.test(content) ||
+        /\bSigningAlgorithm\b/i.test(content));
+}
+const DKIM_RULES = [
+    { meta: RULE_DKIM_RSA, res: [RE_RSA_KEYTAG, RE_RSA_ALGTAG, RE_RSA_OPENDKIM] },
+    { meta: RULE_DKIM_EDDSA, res: [RE_EDDSA_KEYTAG, RE_EDDSA_ALGTAG, RE_EDDSA_OPENDKIM] },
+];
+/** Detects classical DKIM signing keys/algorithms in zone files and mail signer config. */
+export const dkimDetector = {
+    id: "dkim-crypto",
+    description: "Classical DKIM email signing keys/algorithms in zone files / mail signer config",
+    scope: "config",
+    language: "any",
+    rules: DKIM_RULES.map((r) => r.meta),
+    appliesTo: (f) => hasExtension(f, DKIM_EXTENSIONS) && !hasExtension(f, DOC_EXTENSIONS),
+    detect({ file, content }) {
+        // Defensive doc guard: even if a broader gate ever let a prose file through,
+        // a README mentioning `k=rsa` in a sentence must never be flagged.
+        if (hasExtension(file, DOC_EXTENSIONS))
+            return [];
+        if (!hasDkimMarker(content))
+            return [];
+        // Mask whole comment lines so a commented-out record can't fire: zone files
+        // use `;`, mail/OpenDKIM config uses `#` and `//`. Offsets are preserved so
+        // finding line/column/snippet stay exact for the live lines that remain.
+        const scan = maskCommentLines(content, [";", "#", "//"]);
+        const findings = [];
+        for (const { meta, res } of DKIM_RULES) {
+            for (const re of res) {
+                eachMatch(re, scan, (m) => findings.push(findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length })));
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=dkim.js.map

package/dist/detectors/dkim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dkim.js","sourceRoot":"","sources":["../../src/detectors/dkim.ts"],"names":[],"mappings":"AAmDA,OAAO,EACL,cAAc,EACd,SAAS,EACT,eAAe,EACf,YAAY,EACZ,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,iFAAiF;AACjF,yEAAyE;AACzE,0EAA0E;AAC1E,MAAM,eAAe,GAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAE7E,8CAA8C;AAC9C,iFAAiF;AACjF,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,0DAA0D;AAC1D,MAAM,aAAa,GAAG,gCAAgC,CAAC;AACvD,yEAAyE;AACzE,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAEpE,uDAAuD;AACvD,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAChD,MAAM,eAAe,GAAG,8BAA8B,CAAC;AACvD,MAAM,iBAAiB,GAAG,yCAAyC,CAAC;AAEpE,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,gCAAgC;IACvC,WAAW,EACT,iGAAiG;IACnG,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,8LAA8L;IAChM,WAAW,EACT,kOAAkO;CACrO,CAAC;AAEF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,oCAAoC;IAC3C,WAAW,EACT,8GAA8G;IAChH,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mLAAmL;IACrL,WAAW,EACT,6OAA6O;CAChP,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,CACL,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC9B,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAC/B,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CACtC,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,GAAwB;IACtC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC,EAAE;IAC7E,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,iBAAiB,CAAC,EAAE;CACtF,CAAC;AAEF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,iFAAiF;IAC9F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IACtF,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,6EAA6E;QAC7E,mEAAmE;QACnE,IAAI,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC;YAAE,OAAO,EAAE,CAAC;QAClD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAEvC,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,CAAC;YACvC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACxB,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical DKIM email-signing keys and algorithms in DNS\n * zone files, mail-server signer config (OpenDKIM), and captured\n * `DKIM-Signature:` header fields (RFC 6376 + RFC 8463).\n *\n * DKIM (DomainKeys Identified Mail) authenticates the *origin* of email: the\n * sending MTA signs selected header/body content with a private key, publishes\n * the matching public key as a DNS TXT record at\n * `<selector>._domainkey.<domain>`, and receivers verify the `DKIM-Signature`\n * header against that published key. Like DNSSEC (see `dnssec.ts`), this is a\n * pure *signature* surface: there is no confidentiality to harvest, so a DKIM\n * key is NOT harvest-now-decrypt-later exposed (`hndl: false`). What breaks\n * once a cryptographically-relevant quantum computer (CRQC) exists is\n * unforgeability — an attacker who can derive the private key from the\n * published public key can mint valid `DKIM-Signature` headers and spoof mail\n * that passes DKIM/DMARC. So these findings are `category: \"signature\"`.\n *\n * Crypto surface, mapped to {@link AlgorithmFamily}:\n *  - `k=rsa` DNS key-type tag / `a=rsa-sha256` / `a=rsa-sha1` (DKIM-Signature\n *    algorithm tag) / OpenDKIM `SigningAlgorithm rsa-sha256|rsa-sha1`   → RSA\n *  - `k=ed25519` DNS key-type tag / `a=ed25519-sha256` / OpenDKIM\n *    `SigningAlgorithm ed25519-sha256` (RFC 8463)                        → EdDSA\n *\n * Ed25519 DKIM (RFC 8463) is MODERN but still CLASSICAL: rotating an RSA DKIM\n * key to Ed25519 shrinks the DNS record and is good hygiene, but it is NOT a\n * post-quantum fix — an Ed25519 signature is just as forgeable under a CRQC.\n * The remediation text says so honestly: there is no standardized PQC DKIM yet;\n * the only real action is to track IETF work.\n *\n * Two match shapes are covered per family, both gated to a small config\n * extension set AND to a file-level DKIM marker (see `hasDkimMarker`) so the\n * short tag tokens (`k=rsa`, `a=rsa-sha256`) can't fire on unrelated config:\n *\n *  1. DNS KEY-TYPE tag — `k=rsa` / `k=ed25519` inside a published DKIM TXT\n *     record (`v=DKIM1; k=rsa; p=MIGf...`). Whitespace around `=` is tolerated.\n *  2. SIGNING-ALGORITHM tag — the `a=` tag of a `DKIM-Signature` header\n *     (`a=rsa-sha256`, `a=ed25519-sha256`) and the OpenDKIM `SigningAlgorithm`\n *     directive (`SigningAlgorithm rsa-sha256`). The RSA variant deliberately\n *     also matches the legacy `rsa-sha1`.\n *\n * Fast reject: `detect()` bails unless the file carries a DKIM-specific marker\n * (`v=DKIM1`, `_domainkey`, a `DKIM-Signature` field, an OpenDKIM\n * `SigningAlgorithm` directive, or a bare `k=rsa`/`k=ed25519` key-type tag).\n * This stops the generic-looking `k=rsa` / `a=rsa-sha256` tokens from firing on\n * an unrelated `.conf` that happens to contain an `a=`/`k=` assignment for its\n * own reasons. Prose is excluded twice over: `appliesTo` restricts to config\n * extensions (README/`.md` never applies), and `detect()` re-guards against\n * {@link DOC_EXTENSIONS} defensively so a docs file that slipped through a\n * broader gate could never be flagged for mentioning `k=rsa` in a sentence.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport {\n  DOC_EXTENSIONS,\n  eachMatch,\n  findingFromRule,\n  hasExtension,\n  maskCommentLines,\n} from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n// DKIM records live in DNS zone files (`.zone`/`.db`), mail-server signer config\n// (`.conf`), and captured header/TXT fixtures (`.txt`). Gated further by\n// `hasDkimMarker` so the short tag tokens can't fire on unrelated config.\nconst DKIM_EXTENSIONS: readonly string[] = [\".zone\", \".db\", \".conf\", \".txt\"];\n\n// --- RSA (k=rsa / rsa-sha256 / rsa-sha1) ---\n// DNS key-type tag: `k=rsa` in a published DKIM TXT record. Whitespace tolerated\n// around `=`; case-insensitive since tags are conventionally lowercase but not\n// required to be. `\\b` after `rsa` keeps it from matching `rsa-...` substrings.\nconst RE_RSA_KEYTAG = /\\bk\\s*=\\s*rsa\\b/gi;\n// DKIM-Signature `a=` tag: `a=rsa-sha256` / `a=rsa-sha1`.\nconst RE_RSA_ALGTAG = /\\ba\\s*=\\s*rsa-sha(?:256|1)\\b/gi;\n// OpenDKIM signer directive: `SigningAlgorithm rsa-sha256` / `rsa-sha1`.\nconst RE_RSA_OPENDKIM = /\\bSigningAlgorithm\\s+rsa-sha(?:256|1)\\b/gi;\n\n// --- EdDSA (k=ed25519 / ed25519-sha256, RFC 8463) ---\nconst RE_EDDSA_KEYTAG = /\\bk\\s*=\\s*ed25519\\b/gi;\nconst RE_EDDSA_ALGTAG = /\\ba\\s*=\\s*ed25519-sha256\\b/gi;\nconst RE_EDDSA_OPENDKIM = /\\bSigningAlgorithm\\s+ed25519-sha256\\b/gi;\n\nconst RULE_DKIM_RSA: RuleMeta = {\n  id: \"dkim-rsa-key\",\n  title: \"DKIM RSA signing key/algorithm\",\n  description:\n    \"DKIM email signing configured with a classical RSA key/algorithm (k=rsa, a=rsa-sha256/rsa-sha1)\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"DKIM email signing uses a classical RSA key/algorithm (k=rsa / rsa-sha256 / rsa-sha1); DKIM-Signature headers become forgeable once a CRQC exists, allowing DKIM/DMARC-passing spoofed mail.\",\n  remediation:\n    \"There is no standardized post-quantum DKIM algorithm yet — track IETF work; note that rotating RSA to Ed25519 (RFC 8463) is good hygiene but NOT a PQC fix, since Ed25519 is still classical and equally forgeable under a CRQC.\",\n};\n\nconst RULE_DKIM_EDDSA: RuleMeta = {\n  id: \"dkim-ed25519-key\",\n  title: \"DKIM Ed25519 signing key/algorithm\",\n  description:\n    \"DKIM email signing configured with a classical Ed25519 key/algorithm (k=ed25519, a=ed25519-sha256, RFC 8463)\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"DKIM email signing uses an Ed25519 key/algorithm (k=ed25519 / ed25519-sha256, RFC 8463) — modern but still classical; DKIM-Signature headers become forgeable once a CRQC exists.\",\n  remediation:\n    \"There is no standardized post-quantum DKIM algorithm yet — track IETF work. Ed25519 is already the smaller/modern DKIM choice but is NOT post-quantum: it stays forgeable under a CRQC, so no rotation today resolves the quantum exposure.\",\n};\n\n/**\n * True when `content` carries a DKIM-specific marker. Deliberately does NOT accept\n * a bare `k=rsa` / `k=ed25519` tag as its own marker: that tag is exactly what the\n * RSA/EdDSA rules match, so treating it as the gate would be self-satisfying and\n * fire on unrelated prose (\"set `k=rsa` for the legacy importer\"). A real DKIM\n * record always also carries `v=DKIM1`, `_domainkey`, a `DKIM-Signature` field, or\n * the OpenDKIM `SigningAlgorithm` directive — one of those must be present.\n */\nfunction hasDkimMarker(content: string): boolean {\n  return (\n    /\\bDKIM1\\b/i.test(content) ||\n    content.includes(\"_domainkey\") ||\n    /DKIM-Signature/i.test(content) ||\n    /\\bSigningAlgorithm\\b/i.test(content)\n  );\n}\n\ninterface DkimRule {\n  meta: RuleMeta;\n  res: readonly RegExp[];\n}\n\nconst DKIM_RULES: readonly DkimRule[] = [\n  { meta: RULE_DKIM_RSA, res: [RE_RSA_KEYTAG, RE_RSA_ALGTAG, RE_RSA_OPENDKIM] },\n  { meta: RULE_DKIM_EDDSA, res: [RE_EDDSA_KEYTAG, RE_EDDSA_ALGTAG, RE_EDDSA_OPENDKIM] },\n];\n\n/** Detects classical DKIM signing keys/algorithms in zone files and mail signer config. */\nexport const dkimDetector: Detector = {\n  id: \"dkim-crypto\",\n  description: \"Classical DKIM email signing keys/algorithms in zone files / mail signer config\",\n  scope: \"config\",\n  language: \"any\",\n  rules: DKIM_RULES.map((r) => r.meta),\n  appliesTo: (f) => hasExtension(f, DKIM_EXTENSIONS) && !hasExtension(f, DOC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    // Defensive doc guard: even if a broader gate ever let a prose file through,\n    // a README mentioning `k=rsa` in a sentence must never be flagged.\n    if (hasExtension(file, DOC_EXTENSIONS)) return [];\n    if (!hasDkimMarker(content)) return [];\n\n    // Mask whole comment lines so a commented-out record can't fire: zone files\n    // use `;`, mail/OpenDKIM config uses `#` and `//`. Offsets are preserved so\n    // finding line/column/snippet stay exact for the live lines that remain.\n    const scan = maskCommentLines(content, [\";\", \"#\", \"//\"]);\n    const findings: Finding[] = [];\n    for (const { meta, res } of DKIM_RULES) {\n      for (const re of res) {\n        eachMatch(re, scan, (m) =>\n          findings.push(\n            findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),\n          ),\n        );\n      }\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/dnssec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dnssec.d.ts","sourceRoot":"","sources":["../../src/detectors/dnssec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA+G/D,mFAAmF;AACnF,eAAO,MAAM,cAAc,EAAE,QAsB5B,CAAC"}
+{"version":3,"file":"dnssec.d.ts","sourceRoot":"","sources":["../../src/detectors/dnssec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAoH/D,mFAAmF;AACnF,eAAO,MAAM,cAAc,EAAE,QA0B5B,CAAC"}

package/dist/detectors/dnssec.js

@@ -1,4 +1,4 @@
-import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO } from "../cwe.js";
 const DNSSEC_EXTENSIONS = [".zone", ".db", ".conf"];
 // IANA DNSSEC algorithm numbers, grouped by family.
@@ -7,18 +7,23 @@ const NUM_ECDSA = "13|14"; // ECDSAP256SHA256, ECDSAP384SHA384
 const NUM_EDDSA = "15|16"; // ED25519, ED448
 const NUM_DSA = "3|6"; // DSA, DSA-NSEC3-SHA1
 // --- NAMED form: mnemonic algorithm names in signer/policy config or CLI args. ---
-const RE_NAMED_RSA = /\bRSASHA(?:256|512|1(?:-NSEC3-SHA1)?)\b/g;
-const RE_NAMED_ECDSA = /\bECDSAP(?:256SHA256|384SHA384)\b/g;
-const RE_NAMED_EDDSA = /\bED(?:25519|448)\b/g;
+// Case-insensitive: BIND `dnssec-policy` and Knot config conventionally write the
+// mnemonics in lowercase (`algorithm rsasha256;`, `algorithm ed25519;`), so a
+// case-sensitive match would miss the primary real-world signer-config syntax. Still
+// gated by `hasDnssecMarker` + the DNSSEC extensions, so generic tokens can't fire.
+const RE_NAMED_RSA = /\bRSASHA(?:256|512|1(?:-NSEC3-SHA1)?)\b/gi;
+const RE_NAMED_ECDSA = /\bECDSAP(?:256SHA256|384SHA384)\b/gi;
+const RE_NAMED_EDDSA = /\bED(?:25519|448)\b/gi;
 // Bare "DSA" is too generic to key off alone; require it right after an
 // `algorithm` keyword (Knot/BIND config / dnssec-policy style), optionally
 // quoted or separated by `:`/`=`.
 const RE_NAMED_DSA = /\balgorithm\s*[:=]?\s*"?DSA(?:-NSEC3-SHA1)?"?\b/gi;
-// --- STRUCTURAL form: `DNSKEY <flags> 3 <algorithm>` presentation RDATA (RFC 4034 §2). ---
-const RE_DNSKEY_RSA = new RegExp(`\\bDNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_RSA})\\b`, "g");
-const RE_DNSKEY_ECDSA = new RegExp(`\\bDNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_ECDSA})\\b`, "g");
-const RE_DNSKEY_EDDSA = new RegExp(`\\bDNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_EDDSA})\\b`, "g");
-const RE_DNSKEY_DSA = new RegExp(`\\bDNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_DSA})\\b`, "g");
+// --- STRUCTURAL form: `[C]DNSKEY <flags> 3 <algorithm>` presentation RDATA (RFC 4034
+// §2). `C?` also matches CDNSKEY (child-zone key with identical RDATA, RFC 7344). ---
+const RE_DNSKEY_RSA = new RegExp(`\\bC?DNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_RSA})\\b`, "g");
+const RE_DNSKEY_ECDSA = new RegExp(`\\bC?DNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_ECDSA})\\b`, "g");
+const RE_DNSKEY_EDDSA = new RegExp(`\\bC?DNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_EDDSA})\\b`, "g");
+const RE_DNSKEY_DSA = new RegExp(`\\bC?DNSKEY\\s+\\d+\\s+3\\s+(?:${NUM_DSA})\\b`, "g");
 const RULE_DNSSEC_RSA = {
     id: "dnssec-rsa-sig",
     title: "DNSSEC RSA signing algorithm",
@@ -95,10 +100,14 @@ export const dnssecDetector = {
     detect({ file, content }) {
         if (!hasDnssecMarker(content))
             return [];
+        // Mask whole comment lines so a commented-out algorithm can't fire: zone files
+        // use `;`, named.conf uses `#` and `//`. These extensions are not centrally
+        // stripped; offsets are preserved so finding locations stay exact.
+        const scan = maskCommentLines(content, [";", "#", "//"]);
         const findings = [];
         for (const { meta, res } of DNSSEC_RULES) {
             for (const re of res) {
-                eachMatch(re, content, (m) => findings.push(findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length })));
+                eachMatch(re, scan, (m) => findings.push(findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length })));
             }
         }
         return findings;