@soulbatical/tetra-dev-toolkit 1.20.19 → 1.20.21

package/lib/checks/codeQuality/dangerously-set-inner-html.js

@@ -0,0 +1,61 @@
+/**
+ * Detect dangerouslySetInnerHTML usage without sanitization.
+ * Safe alternatives: React elements, DOMPurify, or escapeHtml() from tetra-core.
+ */
+
+import { glob } from 'glob'
+import { readFileSync } from 'fs'
+
+export const meta = {
+  id: 'dangerously-set-inner-html',
+  name: 'dangerouslySetInnerHTML Detection',
+  category: 'codeQuality',
+  severity: 'medium',
+  description: 'Flags all dangerouslySetInnerHTML usage for XSS review'
+}
+
+export async function run(config, projectRoot) {
+  const results = {
+    passed: true,
+    findings: [],
+    summary: { total: 0, critical: 0, high: 0, medium: 0, low: 0 }
+  }
+
+  const files = await glob('**/*.{tsx,jsx}', {
+    cwd: projectRoot,
+    ignore: ['**/node_modules/**', '**/dist/**', '**/.next/**', ...config.ignore]
+  })
+
+  const PATTERN = /dangerouslySetInnerHTML/g
+
+  for (const file of files) {
+    if (file.includes('.test.') || file.includes('.spec.')) continue
+
+    try {
+      const content = readFileSync(`${projectRoot}/${file}`, 'utf-8')
+      const lines = content.split('\n')
+
+      PATTERN.lastIndex = 0
+      let match
+      while ((match = PATTERN.exec(content)) !== null) {
+        const lineNum = content.substring(0, match.index).split('\n').length
+        const lineContent = lines[lineNum - 1]?.trim() || ''
+
+        const nearbyLines = lines.slice(Math.max(0, lineNum - 4), lineNum + 2).join('\n')
+        const isSanitized = /DOMPurify|escapeHtml|sanitize/i.test(nearbyLines)
+
+        if (isSanitized) {
+          results.findings.push({ severity: 'low', file, line: lineNum, message: 'dangerouslySetInnerHTML with sanitization (review for completeness)', snippet: lineContent.substring(0, 120) })
+          results.summary.low++
+        } else {
+          results.findings.push({ severity: 'medium', file, line: lineNum, message: 'dangerouslySetInnerHTML without sanitization — XSS risk', snippet: lineContent.substring(0, 120) })
+          results.summary.medium++
+        }
+        results.summary.total++
+      }
+    } catch { /* skip unreadable */ }
+  }
+
+  results.passed = results.summary.critical === 0 && results.summary.high === 0
+  return results
+}

package/lib/checks/security/csp-disabled.js

@@ -0,0 +1,65 @@
+/**
+ * Detect when Content Security Policy is explicitly disabled.
+ * CSP is a critical XSS defense and should never be turned off.
+ */
+
+import { glob } from 'glob'
+import { readFileSync } from 'fs'
+
+export const meta = {
+  id: 'csp-disabled',
+  name: 'CSP Enforcement',
+  category: 'security',
+  severity: 'critical',
+  description: 'Detects when Content-Security-Policy is explicitly disabled in Helmet or security config'
+}
+
+const PATTERNS = [
+  { name: 'CSP disabled in Helmet', pattern: /contentSecurityPolicy\s*:\s*false/g },
+  { name: 'unsafe-eval in CSP', pattern: /['"]unsafe-eval['"]/g },
+]
+
+export async function run(config, projectRoot) {
+  const results = {
+    passed: true,
+    findings: [],
+    summary: { total: 0, critical: 0, high: 0, medium: 0, low: 0 }
+  }
+
+  const files = await glob('**/*.{ts,tsx,js,jsx,toml}', {
+    cwd: projectRoot,
+    ignore: ['**/node_modules/**', '**/dist/**', '**/.next/**', ...config.ignore]
+  })
+
+  for (const file of files) {
+    if (file.includes('.test.') || file.includes('.spec.')) continue
+
+    try {
+      const content = readFileSync(`${projectRoot}/${file}`, 'utf-8')
+      const lines = content.split('\n')
+
+      for (const { name, pattern } of PATTERNS) {
+        pattern.lastIndex = 0
+        let match
+        while ((match = pattern.exec(content)) !== null) {
+          const lineNum = content.substring(0, match.index).split('\n').length
+          const lineContent = lines[lineNum - 1]?.trim() || ''
+          const severity = name.includes('disabled') ? 'critical' : 'high'
+
+          results.findings.push({
+            severity,
+            file,
+            line: lineNum,
+            message: `${name}: CSP should be configured, not disabled. Use CSP directives instead.`,
+            snippet: lineContent.substring(0, 120)
+          })
+          results.summary[severity]++
+          results.summary.total++
+        }
+      }
+    } catch { /* skip unreadable */ }
+  }
+
+  results.passed = results.summary.critical === 0
+  return results
+}

package/lib/checks/security/reflected-xss.js

@@ -0,0 +1,65 @@
+/**
+ * Detect reflected XSS: request query/body/params interpolated into HTML responses
+ * without escaping. Use escapeHtml() from tetra-core before rendering.
+ */
+
+import { glob } from 'glob'
+import { readFileSync } from 'fs'
+
+export const meta = {
+  id: 'reflected-xss',
+  name: 'Reflected XSS Detection',
+  category: 'security',
+  severity: 'critical',
+  description: 'Detects req.query/body/params interpolated into HTML responses without escaping'
+}
+
+const PATTERNS = [
+  { name: 'req.query in HTML send', pattern: /res\.send\s*\(\s*[`'"][^`'"]*\$\{[^}]*req\.(query|params|body)/g },
+  { name: 'req.query in HTML template', pattern: /`[^`]*<[^`]*\$\{[^}]*req\.(query|params|body)/g },
+  { name: 'res.send with unescaped error', pattern: /res\.send\s*\(\s*[`'"][^`'"]*<[^`'"]*\$\{[^}]*error/g },
+]
+
+export async function run(config, projectRoot) {
+  const results = {
+    passed: true,
+    findings: [],
+    summary: { total: 0, critical: 0, high: 0, medium: 0, low: 0 }
+  }
+
+  const files = await glob('**/*.{ts,tsx,js,jsx}', {
+    cwd: projectRoot,
+    ignore: ['**/node_modules/**', '**/dist/**', '**/.next/**', ...config.ignore]
+  })
+
+  for (const file of files) {
+    if (file.includes('.test.') || file.includes('.spec.')) continue
+
+    try {
+      const content = readFileSync(`${projectRoot}/${file}`, 'utf-8')
+      const lines = content.split('\n')
+
+      for (const { name, pattern } of PATTERNS) {
+        pattern.lastIndex = 0
+        let match
+        while ((match = pattern.exec(content)) !== null) {
+          const lineNum = content.substring(0, match.index).split('\n').length
+          const lineContent = lines[lineNum - 1]?.trim() || ''
+
+          results.findings.push({
+            severity: 'critical',
+            file,
+            line: lineNum,
+            message: `${name}: escape with escapeHtml() from tetra-core before rendering in HTML`,
+            snippet: lineContent.substring(0, 120)
+          })
+          results.summary.critical++
+          results.summary.total++
+        }
+      }
+    } catch { /* skip unreadable */ }
+  }
+
+  results.passed = results.summary.critical === 0
+  return results
+}

package/lib/checks/security/shell-injection.js

@@ -0,0 +1,69 @@
+/**
+ * Detect shell injection risks: child_process calls with template literals
+ * or string concatenation instead of array-based arguments.
+ *
+ * Safe alternative: use execFileSync with array arguments,
+ * or tetra-core's safeExecCommand() utility.
+ */
+
+import { glob } from 'glob'
+import { readFileSync } from 'fs'
+
+export const meta = {
+  id: 'shell-injection',
+  name: 'Shell Injection Detection',
+  category: 'security',
+  severity: 'high',
+  description: 'Detects child_process calls with template literals or string interpolation (shell injection risk)'
+}
+
+// Patterns that indicate unsafe shell command construction
+const DANGEROUS_PATTERNS = [
+  { name: 'child_process call with template literal', pattern: /(?:execSync|spawnSync)\s*\(\s*`[^`]*\$\{/g },
+  { name: 'child_process call with string concat', pattern: /(?:execSync|spawnSync)\s*\([^)]*\+/g },
+  { name: 'spawn with shell:true', pattern: /spawn\s*\([^)]*shell\s*:\s*true/g },
+]
+
+export async function run(config, projectRoot) {
+  const results = {
+    passed: true,
+    findings: [],
+    summary: { total: 0, critical: 0, high: 0, medium: 0, low: 0 }
+  }
+
+  const files = await glob('**/*.{ts,tsx,js,jsx}', {
+    cwd: projectRoot,
+    ignore: ['**/node_modules/**', '**/dist/**', '**/.next/**', ...config.ignore]
+  })
+
+  for (const file of files) {
+    if (file.includes('.test.') || file.includes('.spec.')) continue
+
+    try {
+      const content = readFileSync(`${projectRoot}/${file}`, 'utf-8')
+      const lines = content.split('\n')
+
+      for (const { name, pattern } of DANGEROUS_PATTERNS) {
+        pattern.lastIndex = 0
+        let match
+        while ((match = pattern.exec(content)) !== null) {
+          const lineNum = content.substring(0, match.index).split('\n').length
+          const lineContent = lines[lineNum - 1]?.trim() || ''
+
+          results.findings.push({
+            severity: 'high',
+            file,
+            line: lineNum,
+            message: `${name}: use execFileSync/safeExecCommand with array args instead`,
+            snippet: lineContent.substring(0, 120)
+          })
+          results.summary.high++
+          results.summary.total++
+        }
+      }
+    } catch { /* skip unreadable */ }
+  }
+
+  results.passed = results.summary.high === 0 && results.summary.critical === 0
+  return results
+}

package/lib/checks/security/timing-unsafe-secrets.js

@@ -0,0 +1,76 @@
+/**
+ * Detect timing-unsafe comparisons on secrets, keys, passwords, and hashes.
+ * These should use crypto.timingSafeEqual() to prevent side-channel attacks.
+ */
+
+import { glob } from 'glob'
+import { readFileSync } from 'fs'
+
+export const meta = {
+  id: 'timing-unsafe-secrets',
+  name: 'Timing-Unsafe Secret Comparison',
+  category: 'security',
+  severity: 'high',
+  description: 'Detects === or !== comparisons on variables named key/secret/password/hash/token'
+}
+
+// Match lines where a variable with secret-like name is compared with === or !==
+const SECRET_COMPARE_PATTERN = /\b(\w*(?:key|secret|password|hash|token|apiKey|apikey|api_key)\w*)\s*(?:!==|===)\s*/gi
+
+// Allowlist: these comparisons are safe (checking existence, not comparing values)
+const SAFE_PATTERNS = [
+  /!==\s*(?:undefined|null|''|"")/,
+  /===\s*(?:undefined|null|''|"")/,
+  /!==\s*['"]none['"]/,
+  /\.length\s*[!=]==/,
+]
+
+export async function run(config, projectRoot) {
+  const results = {
+    passed: true,
+    findings: [],
+    summary: { total: 0, critical: 0, high: 0, medium: 0, low: 0 }
+  }
+
+  const files = await glob('**/*.{ts,tsx,js,jsx}', {
+    cwd: projectRoot,
+    ignore: ['**/node_modules/**', '**/dist/**', '**/.next/**', ...config.ignore]
+  })
+
+  for (const file of files) {
+    if (file.includes('.test.') || file.includes('.spec.')) continue
+
+    try {
+      const content = readFileSync(`${projectRoot}/${file}`, 'utf-8')
+      const lines = content.split('\n')
+
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i]
+        SECRET_COMPARE_PATTERN.lastIndex = 0
+        const match = SECRET_COMPARE_PATTERN.exec(line)
+        if (!match) continue
+
+        // Skip safe patterns (null/undefined checks)
+        const restOfLine = line.substring(match.index)
+        if (SAFE_PATTERNS.some(p => p.test(restOfLine))) continue
+
+        // Skip comments
+        const trimmed = line.trim()
+        if (trimmed.startsWith('//') || trimmed.startsWith('*')) continue
+
+        results.findings.push({
+          severity: 'high',
+          file,
+          line: i + 1,
+          message: `Timing-unsafe comparison on '${match[1]}': use crypto.timingSafeEqual() instead`,
+          snippet: trimmed.substring(0, 120)
+        })
+        results.summary.high++
+        results.summary.total++
+      }
+    } catch { /* skip unreadable */ }
+  }
+
+  results.passed = results.summary.high === 0
+  return results
+}

package/lib/checks/stability/local-deps.js

@@ -0,0 +1,91 @@
+/**
+ * Detect local file/link dependencies that break Railway/CI deploys.
+ *
+ * Blocks push when package.json contains:
+ * - "file:../..." or "file:../../..." local path references
+ * - "link:..." npm link references
+ * - workspace:* protocol references outside the monorepo
+ *
+ * Also ensures @soulbatical/* packages use the latest published versions.
+ */
+
+import { glob } from 'glob'
+import { readFileSync } from 'fs'
+
+export const meta = {
+  id: 'local-deps',
+  name: 'Local Dependency Detection',
+  category: 'stability',
+  severity: 'critical',
+  description: 'Blocks deploy-breaking file: and link: dependencies in package.json'
+}
+
+const TETRA_PACKAGES = {
+  '@soulbatical/tetra-core': '0.3.5',
+  '@soulbatical/tetra-ui': '0.7.2',
+  '@soulbatical/tetra-dev-toolkit': '1.20.20',
+}
+
+export async function run(config, projectRoot) {
+  const results = {
+    passed: true,
+    findings: [],
+    summary: { total: 0, critical: 0, high: 0, medium: 0, low: 0 }
+  }
+
+  const files = await glob('**/package.json', {
+    cwd: projectRoot,
+    ignore: ['**/node_modules/**', '**/dist/**', '**/.next/**', ...config.ignore]
+  })
+
+  for (const file of files) {
+    try {
+      const content = readFileSync(`${projectRoot}/${file}`, 'utf-8')
+      const pkg = JSON.parse(content)
+      const allDeps = {
+        ...(pkg.dependencies || {}),
+        ...(pkg.devDependencies || {})
+      }
+
+      for (const [name, version] of Object.entries(allDeps)) {
+        const ver = String(version)
+
+        // Block file: and link: references
+        if (ver.startsWith('file:') || ver.startsWith('link:')) {
+          results.findings.push({
+            severity: 'critical',
+            file,
+            line: 0,
+            message: `"${name}": "${ver}" — local dependency will break Railway/CI deploy. Use npm version instead.`,
+            snippet: `${name}: ${ver}`
+          })
+          results.summary.critical++
+          results.summary.total++
+          results.passed = false
+        }
+
+        // Check @soulbatical/* packages are on latest
+        if (TETRA_PACKAGES[name]) {
+          const minVersion = TETRA_PACKAGES[name]
+          // Extract version number from range (^0.3.5 -> 0.3.5)
+          const versionNum = ver.replace(/^[\^~>=<]*/, '')
+          if (ver.startsWith('file:') || ver.startsWith('link:')) {
+            // Already caught above
+          } else if (versionNum && versionNum < minVersion && !ver.includes('||')) {
+            results.findings.push({
+              severity: 'medium',
+              file,
+              line: 0,
+              message: `"${name}": "${ver}" — outdated. Latest: ${minVersion}. Run: npm install ${name}@latest`,
+              snippet: `${name}: ${ver} (latest: ^${minVersion})`
+            })
+            results.summary.medium++
+            results.summary.total++
+          }
+        }
+      }
+    } catch { /* skip unparseable */ }
+  }
+
+  return results
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulbatical/tetra-dev-toolkit",
-  "version": "1.20.19",
+  "version": "1.20.21",
   "publishConfig": {
     "access": "restricted"
   },