@reliabilityworks/core 0.3.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reliabilityworks/core",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {

package/test/expressRulesetCoverage.test.js

@@ -0,0 +1,29 @@
+const assert = require('node:assert/strict')
+const fs = require('node:fs/promises')
+const path = require('node:path')
+const test = require('node:test')
+
+const { scanProject } = require('../dist/index.js')
+
+test('express ruleset has fixture coverage', async () => {
+  const fixtureRoot = path.join(__dirname, 'fixtures', 'monorepo', 'apps', 'api')
+  const rulesPath = path.join(__dirname, '..', '..', 'rulesets', 'express', 'rules.json')
+
+  const raw = await fs.readFile(rulesPath, 'utf8')
+  const rules = JSON.parse(raw)
+
+  assert.ok(Array.isArray(rules))
+  assert.ok(rules.length >= 60, `Expected at least 60 express rules, got ${rules.length}`)
+
+  const expectedIds = rules.map((r) => r.id)
+  const result = await scanProject({
+    rootDir: fixtureRoot,
+    pathBaseDir: fixtureRoot,
+    additionalRules: rules,
+  })
+
+  const foundIds = new Set(result.findings.map((finding) => finding.ruleId))
+  const missing = expectedIds.filter((id) => !foundIds.has(id))
+
+  assert.equal(missing.length, 0, `Missing express fixture coverage for: ${missing.join(', ')}`)
+})

package/test/fixtures/monorepo/apps/api/express-rules.ts

@@ -4,6 +4,71 @@ export const expressRulesFixture = {
   session: {
     cookie: {
       secure: false,
+      httpOnly: false,
+      sameSite: 'none',
+      domain: '.example.com',
+      path: '/',
     },
   },
 }
+
+export const expressSecurityFixtures = `
+app.set('trust proxy', true)
+trust proxy
+helmet()
+credentials: true
+Access-Control-Allow-Headers', '*'
+Access-Control-Allow-Methods', '*'
+X-Powered-By
+Content-Security-Policy', "script-src 'self' 'unsafe-inline'"
+Content-Security-Policy', "script-src 'self' 'unsafe-eval'"
+cookieParser('super-secret-cookie-parser')
+jwt.sign(payload, 'super-secret-jwt')
+algorithms: ['none']
+bcrypt.hash(password, 10)
+password === input
+bodyParser.json()
+express.json()
+express.urlencoded()
+upload.any()
+"/tmp/uploads"
+SELECT * FROM users + req.query.id
+$where
+new RegExp(req.query.q)
+res.redirect(req.query.next)
+res.redirect(302, req.query.next)
+debug: true
+morgan('dev')
+authorization console.log
+console.log(process.env.SECRET)
+eval(userInput)
+new Function('return 1')()
+exec('id')
+execSync('id')
+spawn('sh', ['-c', 'id'])
+spawnSync('sh', ['-c', 'id'])
+fork('worker.js')
+createHash('md5')
+createHash('sha1')
+Math.random()
+'http://example.com'
+process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0'
+rejectUnauthorized: false
+path.join(req.params.file)
+readFile(req.query.path)
+writeFile(req.query.path)
+http://localhost
+http://127.0.0.1
+169.254.169.254
+app.set('view engine', 'ejs')
+xml2js
+graphql-playground
+rateLimit()
+csrf: false
+secret: 'hardcoded-session-secret'
+passport-local
+allowlist
+req.body
+JSON.parse(req.body)
+new RegExp(userInput)
+`