@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/dist/src/rules/sql-injection.js

@@ -0,0 +1,299 @@
+/**
+ * SQL INJECTION  (CWE-89, OWASP A05:2025 - Injection)
+ *
+ * WHAT THE BUG IS, in plain language:
+ * A database doesn't receive "a question" - it receives a string of text that it
+ * reads as INSTRUCTIONS. If you build that string by gluing user input into it,
+ * the user gets to write part of your instructions.
+ *
+ *     db.query("SELECT * FROM users WHERE id = " + userId)
+ *
+ * If someone sends `userId = 1 OR 1=1`, the database is asked for every user.
+ * If they send `1; DROP TABLE users --`, it may be asked to delete the table.
+ * The database is not tricked or hacked; it does exactly what the text says.
+ * The mistake happened when data and instructions were mixed into one string.
+ *
+ * THE FIX, so the rule can suggest it:
+ * Parameterised queries (also called prepared statements). You send the query
+ * shape and the values SEPARATELY:
+ *
+ *     db.query("SELECT * FROM users WHERE id = ?", [userId])
+ *
+ * The driver never lets the value become part of the instruction, whatever it
+ * contains. This is not "escaping harder" - it is a structurally different
+ * thing, and it is why "we sanitise our inputs" is a weaker answer than
+ * "we parameterise our queries".
+ *
+ * WHAT THIS RULE ACTUALLY CHECKS (and does not):
+ * We look for a call to a known query-executing method whose argument was
+ * BUILT rather than written, and whose visible text looks like SQL. We do NOT
+ * know whether the spliced-in value came from an attacker. That is data-flow
+ * analysis. The taint engine does exactly that, and when it succeeds the
+ * verified finding supersedes this one. Everything the tracer could not confirm
+ * stays here, signature-based, saying so on the finding itself.
+ */
+import { asAssignment, asCall } from './contract.js';
+import { analyzeStringExpression, isStringBuildingExpression, looksLikeSql, expandsOnlyPlaceholders, constantProof, } from './lib/strings.js';
+import { partsAreGuarded } from './lib/guards.js';
+/**
+ * Methods that hand a string to a database engine.
+ * Case matters: Go and Java capitalise, JavaScript and Python do not.
+ */
+const QUERY_METHODS = {
+    javascript: [
+        'query', 'execute', 'exec', 'raw', 'prepare', 'run', 'all', 'get', 'each',
+        'queryRaw', '$queryRawUnsafe', '$executeRawUnsafe', 'unsafe', 'sequelize.query',
+    ],
+    typescript: [
+        'query', 'execute', 'exec', 'raw', 'prepare', 'run', 'all', 'get', 'each',
+        'queryRaw', '$queryRawUnsafe', '$executeRawUnsafe', 'unsafe',
+    ],
+    python: [
+        'execute', 'executemany', 'executescript', 'raw', 'text', 'query', 'from_statement',
+    ],
+    java: [
+        'executeQuery', 'executeUpdate', 'execute', 'prepareStatement', 'prepareCall',
+        'createQuery', 'createNativeQuery', 'createSQLQuery', 'rawQuery', 'addBatch',
+        'queryForObject', 'queryForList', 'update',
+    ],
+    go: [
+        'Query', 'QueryRow', 'QueryContext', 'QueryRowContext', 'Exec', 'ExecContext',
+        'Prepare', 'PrepareContext', 'Raw', 'MustExec', 'Select', 'Get', 'NamedExec',
+    ],
+    // PHP mixes procedural functions (mysqli_query) with PDO/mysqli methods
+    // ($pdo->query). Both are bare names by the time the shape reaches us, so
+    // one list covers both. `prepare` is included on purpose: a prepared
+    // statement built by concatenation is not parameterised, it is just a slower
+    // injection.
+    php: [
+        'query', 'exec', 'prepare', 'unprepared', 'statement', 'select', 'selectOne',
+        'mysqli_query', 'mysqli_real_query', 'mysqli_multi_query', 'mysqli_prepare',
+        'pg_query', 'pg_send_query', 'sqlite_query', 'sqlsrv_query',
+        'mysql_query', 'db_query',
+    ],
+    /*
+     * C database APIs are plain functions, not methods, and every one of them
+     * takes the SQL as a bare char* - there is no query builder to be confused
+     * with. The parameterised forms have DIFFERENT names (mysql_stmt_prepare,
+     * PQexecParams, sqlite3_prepare_v2), so they are absent here and the correct
+     * code stays quiet, which is the same distinction the other languages draw
+     * between `query` and `prepare`.
+     */
+    c: [
+        'mysql_query', 'mysql_real_query', 'PQexec', 'sqlite3_exec',
+        'sqlite3_get_table', 'dbsqlexec', 'SQLExecDirect',
+    ],
+    // C++ adds the method-call forms that wrapper libraries expose.
+    cpp: [
+        'mysql_query', 'mysql_real_query', 'PQexec', 'sqlite3_exec',
+        'sqlite3_get_table', 'SQLExecDirect',
+        'query', 'execute', 'exec',
+    ],
+};
+const METHOD_SETS = {
+    javascript: new Set(QUERY_METHODS.javascript),
+    typescript: new Set(QUERY_METHODS.typescript),
+    python: new Set(QUERY_METHODS.python),
+    java: new Set(QUERY_METHODS.java),
+    go: new Set(QUERY_METHODS.go),
+    php: new Set(QUERY_METHODS.php),
+    c: new Set(QUERY_METHODS.c),
+    cpp: new Set(QUERY_METHODS.cpp),
+};
+const MECHANISM_WORDS = {
+    concatenation: 'string concatenation (+)',
+    interpolation: 'string interpolation (template literal / f-string)',
+    'format-call': 'a string-formatting call (Sprintf / .format / String.format)',
+    opaque: 'a variable whose contents we cannot see here',
+};
+export const sqlInjectionRule = {
+    id: 'sql-injection',
+    name: 'SQL query assembled from a built string',
+    cwe: 'CWE-89',
+    owasp: 'A05:2025 Injection',
+    severity: 'critical',
+    summary: 'The SQL query text is built from pieces; if any piece comes from outside, it can rewrite what the query does.',
+    fix: 'Use a parameterised query: keep the SQL fixed with placeholders and pass values separately, e.g. cursor.execute("... WHERE name = ?", (name,)).',
+    explanation: 'A database reads the string you give it as instructions, not as a question. ' +
+        'When a query is glued together from pieces, anything spliced in can change what ' +
+        'the query does - reading other users\' rows, bypassing a login check, or deleting ' +
+        'a table. The fix is parameterised queries: send the query and the values ' +
+        'separately, so a value can never be read as an instruction.',
+    limitations: 'UNVERIFIED (signature-based): we confirmed the query string was built rather than ' +
+        'written literally. We did NOT confirm that any part of it is attacker-controlled. ' +
+        'If every spliced value is a hard-coded constant or an internal enum, this is safe ' +
+        'and is a false positive. When the data-flow engine CAN confirm the source, the ' +
+        'finding is upgraded to flow-verified and this text is replaced by a traced path. ' +
+        'When every spliced value is PROVABLY a fixed literal - including a write in a ' +
+        'branch that cannot run, a condition decided at compile time, literals joined ' +
+        'with `+`, a Java helper reached through `new X().m()` or through a local that ' +
+        'certainly holds a `new X()` (declared once, never written again, used only as the ' +
+        'receiver of calls), a private/static method, ' +
+        'or a static method named through its class (`Utils.m()`, in this file or another, ' +
+        'when exactly one class of that full name and one method of that name exist in ' +
+        'the scan) whose returns are built from literals and parameters passed fixed ' +
+        'values, a read from a local Java map or list that returns a literal - or a local ' +
+        'name fixed where it was stored - put under that key or at that position, or a ' +
+        'dirty write that is certainly overwritten ' +
+        'before the query - the guess is withdrawn and listed as proved clean with the ' +
+        'reason, rather than reported. That proof stops at one helper level, does not ' +
+        'follow helpers outside Java or choose between overloads, does not use the ' +
+        'last-write rule in C or C++, and does not model String methods or any collection ' +
+        'other than those local maps and lists, so a value fixed by any of those is still ' +
+        'reported here. A name must be declared where the read can see it (Java, JavaScript, ' +
+        'TypeScript, Go block scoping); one declared outside the reading function counts only ' +
+        'when no other function in its file writes it, and a Java field only when it is ' +
+        'private or final; inside a helper, a field written from a parameter is input, ' +
+        'since it keeps what an EARLIER call passed. What the proof does NOT see, and so ' +
+        'can wrongly call fixed: a ' +
+        'write from ANOTHER file to a JavaScript or Python module-level name or a Go package ' +
+        'variable declared in this file; a member inherited from a superclass outside the ' +
+        'scan (a library class such as HttpServlet), which could shadow a name or supply an ' +
+        'overload; a write made by reflection (`Field.set` with setAccessible, from code ' +
+        'that never names the field); and a write made through `new Function(...)` or ' +
+        'a string handed to setTimeout. A withdrawal whose values are all plain literals ' +
+        'leaves no proved-clean record. Three rounds of an agent trying to break this proof ' +
+        'found 70 ways in; every one is fixed and kept as a test in tests/probes/, and a ' +
+        'fourth round would likely find more.',
+    shapes: ['call', 'assignment'],
+    support: {
+        javascript: {
+            status: 'implemented',
+            note: 'Covers node-postgres, mysql/mysql2, sqlite3, knex .raw, Prisma $queryRawUnsafe, Sequelize .query.',
+        },
+        typescript: {
+            status: 'implemented',
+            note: 'Same coverage as JavaScript; type annotations are ignored because a `string` type says nothing about trust.',
+        },
+        python: {
+            status: 'implemented',
+            note: 'Covers DB-API cursor.execute/executemany, SQLAlchemy text()/raw(). ORM query-builder misuse is not modelled.',
+        },
+        java: {
+            status: 'implemented',
+            note: 'Covers JDBC Statement/PreparedStatement, JPA createQuery/createNativeQuery, Spring JdbcTemplate. StringBuilder.append chains that build SQL over several statements are NOT followed: the tracer tracks variables, not the interior of a mutable object.',
+        },
+        go: {
+            status: 'implemented',
+            note: 'Covers database/sql and sqlx. Go code frequently builds SQL with fmt.Sprintf even when every value is a constant, so the signature pass is noisier here than elsewhere - the data-flow engine is what separates the real ones.',
+        },
+        php: {
+            status: 'implemented',
+            note: 'Covers PDO and mysqli in both their forms - the procedural functions (mysqli_query, pg_query) and the object methods ($pdo->query, ->prepare). `prepare` is watched on purpose: a prepared statement whose SQL was concatenated is not parameterised, it is a slower injection. NOT covered: an ORM that builds SQL inside its own package, and .blade.php / .twig templates, which are not parsed.',
+        },
+        c: {
+            status: 'implemented',
+            note: 'Covers the C database APIs, which are plain functions taking the statement as a bare char*: mysql_query, mysql_real_query, PQexec, sqlite3_exec, sqlite3_get_table and SQLExecDirect. The parameterised forms have DIFFERENT names (mysql_stmt_prepare, PQexecParams, sqlite3_prepare_v2) so correct code stays quiet. Queries are almost always built by sprintf into a char buffer, which the out-parameter tracking follows.',
+        },
+        cpp: {
+            status: 'implemented',
+            note: 'Every C entry applies unchanged, since C++ inherits the whole libc surface and real code still uses it. Namespace-qualified calls (std::system) and method calls on objects are recognised in addition.',
+        },
+    },
+    check(shape, ctx) {
+        const language = ctx.language;
+        /* ---- Case 1: the query text is visible right at the call site ---- */
+        const call = asCall(shape);
+        if (call) {
+            if (!METHOD_SETS[language].has(call.calleeName))
+                return null;
+            for (const arg of call.args) {
+                // Only look at arguments that could BE a string. An options object
+                // `{ text: "...", values: [...] }` is a container, not a query.
+                if (!isStringBuildingExpression(arg, language))
+                    continue;
+                const built = analyzeStringExpression(arg, language);
+                // Two conditions, both required:
+                //   1. the string was assembled, not written whole, and
+                //   2. what we CAN read of it actually looks like SQL.
+                // Condition 2 is what stops us shouting about `log("hi " + name)`.
+                if (!built.isDynamic)
+                    continue;
+                if (!looksLikeSql(built.literalText))
+                    continue;
+                // "Assembled" from values that are all fixed literals is not assembled
+                // in any way a reader cares about. When saying so took reasoning - a
+                // branch that cannot run, a condition fixed at compile time - the
+                // withdrawal leaves a receipt, because reasoning can be wrong.
+                const argProof = constantProof(arg, built.dynamicParts, language, { staticMethod: ctx.staticMethod, javaTypeInScan: ctx.javaTypeInScan });
+                if (argProof) {
+                    if (argProof.reasoned)
+                        ctx.noteClean?.('sql-injection', arg, argProof.reason);
+                    continue;
+                }
+                /*
+                 * A VALIDATION GUARD. `is_numeric($octet[0])` transforms nothing, so the
+                 * sanitiser model never saw it - but inside the branch it guards, the
+                 * value provably holds no metacharacter. This is DVWA's own fix for
+                 * command injection, and reporting it was the seventh time this project
+                 * punished a corrected file. See lib/guards.ts for how narrow the list is.
+                 */
+                if (partsAreGuarded(arg, built.dynamicParts, language, 'sql'))
+                    continue;
+                // `${new Array(n).fill('(?,?)').join(',')}` expands to placeholders,
+                // never to data. Reporting it punishes the correct bulk-insert form.
+                if (built.dynamicParts.every((part) => expandsOnlyPlaceholders(part)))
+                    continue;
+                const how = MECHANISM_WORDS[built.mechanism] ?? built.mechanism;
+                return {
+                    node: arg,
+                    message: `SQL passed to ${call.calleeText}() is built with ${built.mechanism}`,
+                    reasoning: `\`${call.calleeText}()\` is a database query method. Its argument is not a ` +
+                        `fixed string - it was assembled using ${how}. The literal part reads like SQL ` +
+                        `("${built.literalText.replace(/\s+/g, ' ').trim().slice(0, 70)}"), and the ` +
+                        `spliced-in part${built.dynamicParts.length === 1 ? ' is' : 's are'} ` +
+                        `${built.dynamicParts.slice(0, 3).map((p) => `\`${p}\``).join(', ')}. ` +
+                        `If any of those can be influenced by a user, they can rewrite the query.`,
+                };
+            }
+            return null;
+        }
+        /* ---- Case 2: SQL is built into a variable first ----
+         * `const sql = "SELECT ... " + id;` then later `db.query(sql)`.
+         * The SIGNATURE pass cannot connect those two statements - that is data-flow
+         * analysis, and the taint engine does it now. This branch stays as the
+         * fallback for everything the tracer could not confirm: no recognised
+         * source, a value arriving from another file, a framework we do not model.
+         * When the tracer DOES confirm it, the verified finding supersedes this one
+         * automatically, so the two never both appear.                          */
+        const assignment = asAssignment(shape);
+        if (assignment) {
+            // The scope gate. Without it, assigning a large object literal to a
+            // variable let every string inside it merge into one fake "query".
+            // This is the check that stopped Defuse reporting its own rule files.
+            if (!isStringBuildingExpression(assignment.value, language))
+                return null;
+            const built = analyzeStringExpression(assignment.value, language);
+            if (!built.isDynamic)
+                return null;
+            if (!looksLikeSql(built.literalText))
+                return null;
+            const buildProof = constantProof(assignment.value, built.dynamicParts, language, { staticMethod: ctx.staticMethod, javaTypeInScan: ctx.javaTypeInScan });
+            if (buildProof) {
+                if (buildProof.reasoned)
+                    ctx.noteClean?.('sql-injection', assignment.node, buildProof.reason);
+                return null;
+            }
+            if (partsAreGuarded(assignment.value, built.dynamicParts, language, 'sql'))
+                return null;
+            if (built.dynamicParts.every((part) => expandsOnlyPlaceholders(part)))
+                return null;
+            return {
+                node: assignment.node,
+                severity: 'high',
+                message: `SQL string \`${assignment.targetName}\` is built with ${built.mechanism}`,
+                reasoning: `\`${assignment.targetName}\` is assigned a string that reads like SQL and was ` +
+                    `assembled using ${MECHANISM_WORDS[built.mechanism] ?? built.mechanism}. ` +
+                    `The tracer did not confirm that this variable reaches a database call, so ` +
+                    `this is reported as dangerous construction, not as a confirmed injection.`,
+                limitations: 'UNVERIFIED (signature-based): we saw SQL text being assembled. We did NOT verify ' +
+                    'that it reaches a query method, and we did NOT verify that any part is ' +
+                    'attacker-controlled. The data-flow engine ran and could not confirm either step ' +
+                    'here - most often because no recognised source feeds it, or the value comes from ' +
+                    'another file.',
+            };
+        }
+        return null;
+    },
+};
+//# sourceMappingURL=sql-injection.js.map

package/dist/src/rules/sql-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-injection.js","sourceRoot":"","sources":["../../../src/rules/sql-injection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAC9E,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,YAAY,EACZ,uBAAuB,EACvB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;GAGG;AACH,MAAM,aAAa,GAA0C;IAC3D,UAAU,EAAE;QACV,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;QACzE,UAAU,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,iBAAiB;KAChF;IACD,UAAU,EAAE;QACV,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;QACzE,UAAU,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,QAAQ;KAC7D;IACD,MAAM,EAAE;QACN,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB;KACpF;IACD,IAAI,EAAE;QACJ,cAAc,EAAE,eAAe,EAAE,SAAS,EAAE,kBAAkB,EAAE,aAAa;QAC7E,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU;QAC5E,gBAAgB,EAAE,cAAc,EAAE,QAAQ;KAC3C;IACD,EAAE,EAAE;QACF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa;QAC7E,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW;KAC7E;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,6EAA6E;IAC7E,aAAa;IACb,GAAG,EAAE;QACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW;QAC5E,cAAc,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,gBAAgB;QAC3E,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc;QAC3D,aAAa,EAAE,UAAU;KAC1B;IACD;;;;;;;OAOG;IACH,CAAC,EAAE;QACD,aAAa,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc;QAC3D,mBAAmB,EAAE,WAAW,EAAE,eAAe;KAClD;IACD,gEAAgE;IAChE,GAAG,EAAE;QACH,aAAa,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc;QAC3D,mBAAmB,EAAE,eAAe;QACpC,OAAO,EAAE,SAAS,EAAE,MAAM;KAC3B;CACF,CAAC;AAEF,MAAM,WAAW,GAA4C;IAC3D,UAAU,EAAE,IAAI,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC;IAC7C,UAAU,EAAE,IAAI,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC;IAC7C,MAAM,EAAE,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC;IACjC,EAAE,EAAE,IAAI,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;IAC7B,GAAG,EAAE,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC;IAC/B,CAAC,EAAE,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3B,GAAG,EAAE,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC;CAChC,CAAC;AAEF,MAAM,eAAe,GAA2B;IAC9C,aAAa,EAAE,0BAA0B;IACzC,aAAa,EAAE,oDAAoD;IACnE,aAAa,EAAE,8DAA8D;IAC7E,MAAM,EAAE,8CAA8C;CACvD,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAS;IACpC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,yCAAyC;IAC/C,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,+GAA+G;IACxH,GAAG,EACD,iJAAiJ;IACnJ,WAAW,EACT,8EAA8E;QAC9E,kFAAkF;QAClF,oFAAoF;QACpF,2EAA2E;QAC3E,6DAA6D;IAC/D,WAAW,EACT,oFAAoF;QACpF,oFAAoF;QACpF,oFAAoF;QACpF,iFAAiF;QACjF,mFAAmF;QACnF,gFAAgF;QAChF,+EAA+E;QAC/E,gFAAgF;QAChF,oFAAoF;QACpF,+CAA+C;QAC/C,oFAAoF;QACpF,gFAAgF;QAChF,8EAA8E;QAC9E,mFAAmF;QACnF,gFAAgF;QAChF,4CAA4C;QAC5C,gFAAgF;QAChF,+EAA+E;QAC/E,4EAA4E;QAC5E,mFAAmF;QACnF,mFAAmF;QACnF,sFAAsF;QACtF,uFAAuF;QACvF,iFAAiF;QACjF,gFAAgF;QAChF,kFAAkF;QAClF,4BAA4B;QAC5B,sFAAsF;QACtF,mFAAmF;QACnF,qFAAqF;QACrF,kFAAkF;QAClF,+EAA+E;QAC/E,kFAAkF;QAClF,qFAAqF;QACrF,kFAAkF;QAClF,sCAAsC;IACxC,MAAM,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,mGAAmG;SAC1G;QACD,UAAU,EAAE;YACV,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,6GAA6G;SACpH;QACD,MAAM,EAAE;YACN,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,8GAA8G;SACrH;QACD,IAAI,EAAE;YACJ,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,0PAA0P;SACjQ;QACD,EAAE,EAAE;YACF,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,gOAAgO;SACvO;QACD,GAAG,EAAE;YACH,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,qYAAqY;SAC5Y;QACD,CAAC,EAAE;YACD,MAAM,EAAE,aAAa;YACrB,IAAI,EACF,iaAAia;SACpa;QACD,GAAG,EAAE;YACH,MAAM,EAAE,aAAa;YACrB,IAAI,EACF,yMAAyM;SAC5M;KACF;IACD,KAAK,CAAC,KAAK,EAAE,GAAG;QACd,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE9B,wEAAwE;QACxE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;YAE7D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,mEAAmE;gBACnE,gEAAgE;gBAChE,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC;oBAAE,SAAS;gBACzD,MAAM,KAAK,GAAG,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACrD,iCAAiC;gBACjC,wDAAwD;gBACxD,uDAAuD;gBACvD,mEAAmE;gBACnE,IAAI,CAAC,KAAK,CAAC,SAAS;oBAAE,SAAS;gBAC/B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;oBAAE,SAAS;gBAC/C,uEAAuE;gBACvE,qEAAqE;gBACrE,kEAAkE;gBAClE,+DAA+D;gBAC/D,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;gBAC1I,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,QAAQ,CAAC,QAAQ;wBAAE,GAAG,CAAC,SAAS,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC9E,SAAS;gBACX,CAAC;gBACD;;;;;;mBAMG;gBACH,IAAI,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC;oBAAE,SAAS;gBACxE,qEAAqE;gBACrE,qEAAqE;gBACrE,IAAI,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;oBAAE,SAAS;gBAEhF,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC;gBAChE,OAAO;oBACL,IAAI,EAAE,GAAG;oBACT,OAAO,EAAE,iBAAiB,IAAI,CAAC,UAAU,oBAAoB,KAAK,CAAC,SAAS,EAAE;oBAC9E,SAAS,EACP,KAAK,IAAI,CAAC,UAAU,yDAAyD;wBAC7E,yCAAyC,GAAG,oCAAoC;wBAChF,KAAK,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc;wBAC7E,kBAAkB,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG;wBACtE,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;wBACvE,0EAA0E;iBAC7E,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;;;;mFAO2E;QAC3E,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,UAAU,EAAE,CAAC;YACf,oEAAoE;YACpE,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzE,MAAM,KAAK,GAAG,uBAAuB,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAClC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClD,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;YACzJ,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,UAAU,CAAC,QAAQ;oBAAE,GAAG,CAAC,SAAS,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC9F,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,eAAe,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxF,IAAI,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEnF,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,gBAAgB,UAAU,CAAC,UAAU,oBAAoB,KAAK,CAAC,SAAS,EAAE;gBACnF,SAAS,EACP,KAAK,UAAU,CAAC,UAAU,sDAAsD;oBAChF,mBAAmB,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI;oBAC1E,4EAA4E;oBAC5E,2EAA2E;gBAC7E,WAAW,EACT,mFAAmF;oBACnF,yEAAyE;oBACzE,kFAAkF;oBAClF,mFAAmF;oBACnF,eAAe;aAClB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC"}

package/dist/src/rules/ssrf.d.ts

@@ -0,0 +1,39 @@
+/**
+ * SERVER-SIDE REQUEST FORGERY - SSRF  (CWE-918, OWASP A01:2025 - Broken Access Control)
+ *
+ * WHAT THE BUG IS, in plain language:
+ * Your server fetches a URL that the user chose. That sounds harmless - it is
+ * just an HTTP request - until you remember WHERE your server is standing.
+ *
+ *     const data = await fetch(req.query.target);
+ *
+ * The attacker's browser cannot reach your database, your admin panel on
+ * port 8080, or `169.254.169.254` - the cloud metadata endpoint that hands out
+ * your instance's credentials to anything inside the network. Your server can
+ * reach all three. So the attacker stops trying to get in, and asks your server
+ * to go and fetch it for them. The firewall sees a request from a trusted
+ * machine and lets it through.
+ *
+ * THE FIX is an allowlist of hosts, not a blocklist. Blocklists lose, always:
+ * `localhost` has `127.0.0.1`, `127.1`, `0.0.0.0`, `[::1]`, `2130706433`, a
+ * DNS name that resolves to loopback, and a redirect from a public host to a
+ * private one. Decide the small set of hosts you MEANT to talk to, resolve the
+ * URL, and check membership - then fetch.
+ *
+ * ============================================================================
+ * WHY THIS RULE HAS NO SIGNATURE PASS
+ * ============================================================================
+ * Every one of the other rules can say something useful from shape alone: a
+ * query built by concatenation is suspicious whatever flows into it. This one
+ * cannot. "This code makes an HTTP request" is not a finding - it is what
+ * servers do all day, and a signature pass here would report every API client,
+ * every webhook, every health check in the codebase.
+ *
+ * The finding only exists when the URL is attacker-chosen, and that is a
+ * data-flow question, not a pattern. So `check()` deliberately returns null
+ * always, and every SSRF finding this tool produces is flow-verified with a
+ * printed path. It is the first rule where "we cannot say anything without the
+ * tracer" is the honest answer rather than a limitation to apologise for.
+ */
+import { type Rule } from './contract.js';
+export declare const ssrfRule: Rule;

package/dist/src/rules/ssrf.js

@@ -0,0 +1,111 @@
+/**
+ * SERVER-SIDE REQUEST FORGERY - SSRF  (CWE-918, OWASP A01:2025 - Broken Access Control)
+ *
+ * WHAT THE BUG IS, in plain language:
+ * Your server fetches a URL that the user chose. That sounds harmless - it is
+ * just an HTTP request - until you remember WHERE your server is standing.
+ *
+ *     const data = await fetch(req.query.target);
+ *
+ * The attacker's browser cannot reach your database, your admin panel on
+ * port 8080, or `169.254.169.254` - the cloud metadata endpoint that hands out
+ * your instance's credentials to anything inside the network. Your server can
+ * reach all three. So the attacker stops trying to get in, and asks your server
+ * to go and fetch it for them. The firewall sees a request from a trusted
+ * machine and lets it through.
+ *
+ * THE FIX is an allowlist of hosts, not a blocklist. Blocklists lose, always:
+ * `localhost` has `127.0.0.1`, `127.1`, `0.0.0.0`, `[::1]`, `2130706433`, a
+ * DNS name that resolves to loopback, and a redirect from a public host to a
+ * private one. Decide the small set of hosts you MEANT to talk to, resolve the
+ * URL, and check membership - then fetch.
+ *
+ * ============================================================================
+ * WHY THIS RULE HAS NO SIGNATURE PASS
+ * ============================================================================
+ * Every one of the other rules can say something useful from shape alone: a
+ * query built by concatenation is suspicious whatever flows into it. This one
+ * cannot. "This code makes an HTTP request" is not a finding - it is what
+ * servers do all day, and a signature pass here would report every API client,
+ * every webhook, every health check in the codebase.
+ *
+ * The finding only exists when the URL is attacker-chosen, and that is a
+ * data-flow question, not a pattern. So `check()` deliberately returns null
+ * always, and every SSRF finding this tool produces is flow-verified with a
+ * printed path. It is the first rule where "we cannot say anything without the
+ * tracer" is the honest answer rather than a limitation to apologise for.
+ */
+export const ssrfRule = {
+    id: 'ssrf',
+    name: 'Server fetches a URL the user chose',
+    cwe: 'CWE-918',
+    owasp: 'A01:2025 Broken Access Control',
+    severity: 'high',
+    summary: 'The server fetches a URL the request may choose, so an attacker could make it reach internal systems.',
+    fix: 'Only fetch hosts on an allowlist, checked after the URL is resolved, and do not follow redirects off it.',
+    explanation: 'Your server sits inside the network. It can reach the database, the admin ' +
+        'panel, and the cloud metadata endpoint that hands out instance credentials - ' +
+        'and the attacker\'s browser cannot. When the URL your server fetches is chosen ' +
+        'by a request, the attacker stops trying to get past the firewall and simply ' +
+        'asks your server to fetch the thing for them. The fix is an allowlist of hosts ' +
+        'you meant to talk to, checked after resolving the URL. A blocklist loses: ' +
+        'localhost is also 127.1, 0.0.0.0, [::1], 2130706433, a DNS name pointing at ' +
+        'loopback, and a redirect from a public host to a private one.',
+    limitations: 'FLOW-VERIFIED ONLY: this rule has no pattern pass, because "makes an HTTP ' +
+        'request" describes almost every server and would report every API client in ' +
+        'the codebase. A finding here always comes from a traced path from a request ' +
+        'value to the fetch. Only one that can choose the DESTINATION is proven: a value ' +
+        'spliced in after a fixed start of the address (`https://host/path/`, `${base}/`, ' +
+        '`./`), or one read from a browser-only source (the address bar, browser storage), ' +
+        'cannot send the request to a server the attacker picks, and is reported as to ' +
+        'review with that reason instead. DELIBERATE GAP: we cannot see a host allowlist. Code that ' +
+        'correctly resolves the URL and checks the hostname against a fixed set is ' +
+        'still reported, because recognising a correct allowlist means understanding ' +
+        'what the check compares and what it does on failure - which is beyond what ' +
+        'this engine models. Treat an SSRF finding as "confirm the host check", not as ' +
+        '"this is definitely exploitable". A REDIRECT from an allowed host to an ' +
+        'internal one is invisible to any static tool, allowlist or not.',
+    shapes: ['call'],
+    support: {
+        javascript: {
+            status: 'implemented',
+            note: 'Data-flow only. Covers http/https get and request, fetch, axios, got, node-fetch and request. NOT covered: a URL assembled inside an options object (fetch({url: dirty})) - we read the URL argument positionally.',
+        },
+        typescript: {
+            status: 'implemented',
+            note: 'Data-flow only. Identical to JavaScript.',
+        },
+        python: {
+            status: 'implemented',
+            note: 'Data-flow only. Covers requests (get/post/put/delete/head/request), urllib.request.urlopen and httpx. NOT covered: aiohttp sessions, where the URL is passed to a method on a session object we do not model.',
+        },
+        java: {
+            status: 'partial',
+            note: 'PARTIAL, data-flow only. Covers new URL(x), URI.create(x), HttpRequest.newBuilder(x), and RestTemplate getForObject/getForEntity/postForObject/exchange on a receiver named or typed RestTemplate (or `rest`). The URL or URI being built is the sink, so new URL(x) used only to read its host is reported too. NOT covered: new URI(x) on its own, HttpRequest.newBuilder().uri(x), WebClient, OkHttp, Apache HttpClient, and a URL held in an object field.',
+        },
+        php: {
+            status: 'implemented',
+            note: 'Data-flow only. Covers file_get_contents, fopen, curl_setopt with CURLOPT_URL, and curl_init with a URL argument. Note that file_get_contents doubles as a file reader, so a finding here may be path traversal wearing a URL\'s clothes - both are worth the same second look.',
+        },
+        go: {
+            status: 'partial',
+            note: 'PARTIAL, data-flow only. Covers the net/http package functions http.Get, http.Post, http.Head, http.PostForm, http.NewRequest and http.NewRequestWithContext. NOT covered: the same methods on a client (client.Get(u), http.DefaultClient.Get(u)), because the receiver is not `http`, and third-party clients such as resty.',
+        },
+        c: {
+            status: 'not-implemented',
+            note: 'libcurl is how C makes outbound requests - curl_easy_setopt(handle, CURLOPT_URL, url) - and it is NOT modelled: the URL is one argument of a variadic setter whose meaning depends on the option constant next to it, which this engine does not read. Server-side request forgery written with libcurl is missed entirely.',
+        },
+        cpp: {
+            status: 'not-implemented',
+            note: 'Not implemented. C++ code reaches the network through libcurl (not modelled - the URL is one argument of a variadic setter), or through a framework HTTP client such as cpp-httplib or Boost.Beast, none of which are in the sink tables.',
+        },
+    },
+    /*
+     * Deliberately silent. See the header: there is no honest pattern for this
+     * bug, only a flow. The taint engine emits every finding for this rule id.
+     */
+    check() {
+        return null;
+    },
+};
+//# sourceMappingURL=ssrf.js.map

package/dist/src/rules/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../../src/rules/ssrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,MAAM,CAAC,MAAM,QAAQ,GAAS;IAC5B,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,qCAAqC;IAC3C,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,gCAAgC;IACvC,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,uGAAuG;IAChH,GAAG,EACD,0GAA0G;IAC5G,WAAW,EACT,4EAA4E;QAC5E,+EAA+E;QAC/E,iFAAiF;QACjF,8EAA8E;QAC9E,iFAAiF;QACjF,4EAA4E;QAC5E,8EAA8E;QAC9E,+DAA+D;IACjE,WAAW,EACT,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E;QAC9E,kFAAkF;QAClF,mFAAmF;QACnF,oFAAoF;QACpF,gFAAgF;QAChF,6FAA6F;QAC7F,4EAA4E;QAC5E,8EAA8E;QAC9E,6EAA6E;QAC7E,gFAAgF;QAChF,0EAA0E;QAC1E,iEAAiE;IACnE,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,OAAO,EAAE;QACP,UAAU,EAAE;YACV,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,oNAAoN;SAC3N;QACD,UAAU,EAAE;YACV,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,0CAA0C;SACjD;QACD,MAAM,EAAE;YACN,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,+MAA+M;SACtN;QACD,IAAI,EAAE;YACJ,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,gcAAgc;SACvc;QACD,GAAG,EAAE;YACH,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,iRAAiR;SACxR;QACD,EAAE,EAAE;YACF,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,gUAAgU;SACvU;QACD,CAAC,EAAE;YACD,MAAM,EAAE,iBAAiB;YACzB,IAAI,EACF,6TAA6T;SAChU;QACD,GAAG,EAAE;YACH,MAAM,EAAE,iBAAiB;YACzB,IAAI,EACF,2OAA2O;SAC9O;KACF;IACD;;;OAGG;IACH,KAAK;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC"}

package/dist/src/rules/unbounded-copy.d.ts

@@ -0,0 +1,37 @@
+/**
+ * COPIES WITH NO LENGTH BOUND  (CWE-120)
+ *
+ * READ THE NAME OF THIS RULE CAREFULLY. It is not `buffer-overflow`, and the
+ * difference is the entire honesty argument for shipping it.
+ *
+ * A buffer overflow is a SIZE bug. Whether `strcpy(dst, src)` overflows depends
+ * on how big `dst` is, how long `src` turns out to be at runtime, and whether
+ * any pointer between them aliases something else. This engine models none of
+ * that - it tracks VALUES, not sizes, allocation lifetimes or aliasing. It
+ * cannot tell you whether a copy overflows and does not claim to.
+ *
+ * What it CAN prove from data flow alone is narrower and still worth saying:
+ *
+ *     attacker-controlled data reaches a function that writes until it
+ *     meets a NUL byte, and the attacker chooses where that byte is.
+ *
+ * That is what a finding here asserts, and the wording says so. A `strcpy` into
+ * a destination that genuinely is large enough is a FALSE POSITIVE of this
+ * rule. That is declared here, in the finding text and in the coverage report,
+ * rather than left for somebody to discover and lose trust over.
+ *
+ * It is still worth reporting, because the unbounded functions have no safe
+ * upper bound by construction. Every one of them has a bounded sibling that
+ * takes a length - strncpy, strncat, snprintf, strlcpy - and those are
+ * registered as sanitisers for this sink kind, so switching to them retracts
+ * the finding. A rule that cannot be satisfied by fixing the code is a rule
+ * nobody will act on.
+ *
+ * gets() IS THE EXCEPTION, and it needs no data flow at all. It has no length
+ * parameter and no way to acquire one, which is why C11 removed it from the
+ * standard library outright. There is nothing to trace, so it is reported on
+ * sight as a SIGNATURE finding - honestly labelled as unverified flow, because
+ * there is no flow to verify, not because we failed to find one.
+ */
+import { type Rule } from './contract.js';
+export declare const unboundedCopyRule: Rule;