@sun-asterisk/sunlint 1.3.18 → 1.3.19

package/rules/security/S028_file_upload_size_limits/symbol-based-analyzer.js

@@ -0,0 +1,530 @@
+/**
+ * S028 - Limit upload file size and number of files (Symbol-based Analyzer)
+ *
+ * Detects file upload configurations without proper size and quantity limits.
+ * Prevents DoS attacks and resource exhaustion.
+ *
+ * Based on:
+ * - OWASP A04:2021 - Insecure Design
+ * - CWE-400: Uncontrolled Resource Consumption
+ */
+
+const { Project, SyntaxKind } = require("ts-morph");
+
+class S028SymbolBasedAnalyzer {
+  constructor(semanticEngine = null) {
+    this.ruleId = "S028";
+    this.semanticEngine = semanticEngine;
+    this.verbose = process.env.SUNLINT_DEBUG || false;
+
+    // Recommended limits
+    this.maxFileSize = 10 * 1024 * 1024; // 10MB
+    this.maxFiles = 10;
+    this.highRiskThreshold = 50 * 1024 * 1024; // 50MB
+    this.mediumRiskThreshold = 20 * 1024 * 1024; // 20MB
+
+    // Framework patterns
+    this.multerPatterns = ["multer(", "multer({"];
+    this.fileInterceptorPatterns = [
+      "FileInterceptor",
+      "FilesInterceptor",
+      "FileFieldsInterceptor",
+    ];
+    this.expressPatterns = ["express.json", "express.urlencoded"];
+  }
+
+  async initialize(semanticEngine = null) {
+    if (semanticEngine) {
+      this.semanticEngine = semanticEngine;
+    }
+  }
+
+  /**
+   * Main analyze method
+   */
+  async analyze(sourceFile, filePath) {
+    const violations = [];
+    const reportedLines = new Set(); // Prevent duplicates
+
+    try {
+      // Create ts-morph project if not already a SourceFile
+      let tsSourceFile = sourceFile;
+      if (typeof sourceFile === "string") {
+        const project = new Project({ useInMemoryFileSystem: true });
+        tsSourceFile = project.createSourceFile(filePath, sourceFile);
+      }
+
+      // Check different upload patterns
+      this.checkMulterConfiguration(
+        tsSourceFile,
+        filePath,
+        violations,
+        reportedLines
+      );
+      this.checkFileInterceptor(
+        tsSourceFile,
+        filePath,
+        violations,
+        reportedLines
+      );
+      this.checkExpressMiddleware(
+        tsSourceFile,
+        filePath,
+        violations,
+        reportedLines
+      );
+
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] File: ${filePath} - Found ${violations.length} violations`
+        );
+      }
+    } catch (error) {
+      if (this.verbose) {
+        console.error(
+          `❌ [${this.ruleId}] Error analyzing ${filePath}:`,
+          error.message
+        );
+      }
+    }
+
+    return violations;
+  }
+
+  /**
+   * Check multer() configuration
+   * Pattern: multer({ dest, storage, limits, fileFilter })
+   */
+  checkMulterConfiguration(sourceFile, filePath, violations, reportedLines) {
+    try {
+      const callExpressions = sourceFile.getDescendantsOfKind(
+        SyntaxKind.CallExpression
+      );
+
+      callExpressions.forEach((callExpr) => {
+        const exprText = callExpr.getExpression().getText();
+
+        // Check if it's multer call
+        if (!exprText.includes("multer")) {
+          return;
+        }
+
+        const args = callExpr.getArguments();
+        if (args.length === 0) {
+          // multer() without arguments
+          const line = callExpr.getStartLineNumber();
+          if (reportedLines.has(line)) return;
+
+          violations.push({
+            ruleId: this.ruleId,
+            source: filePath,
+            filePath: filePath,
+            file: filePath,
+            line: line,
+            column: callExpr.getStartLinePos(),
+            message:
+              "Multer configuration missing size limits - add limits.fileSize and limits.files to prevent DoS attacks",
+            severity: "error",
+            category: "security",
+          });
+          reportedLines.add(line);
+          return;
+        }
+
+        // Check if config object has limits
+        const configArg = args[0];
+        if (!configArg) return;
+
+        const configText = configArg.getText();
+
+        // Check if limits object exists
+        if (!configText.includes("limits")) {
+          const line = callExpr.getStartLineNumber();
+          if (reportedLines.has(line)) return;
+
+          violations.push({
+            ruleId: this.ruleId,
+            source: filePath,
+            filePath: filePath,
+            file: filePath,
+            line: line,
+            column: callExpr.getStartLinePos(),
+            message:
+              "Multer configuration missing 'limits' object - add { limits: { fileSize: 10485760, files: 10 } }",
+            severity: "error",
+            category: "security",
+          });
+          reportedLines.add(line);
+          return;
+        }
+
+        // Check if limits.fileSize exists
+        if (!configText.includes("fileSize")) {
+          const line = callExpr.getStartLineNumber();
+          if (reportedLines.has(line)) return;
+
+          violations.push({
+            ruleId: this.ruleId,
+            source: filePath,
+            filePath: filePath,
+            file: filePath,
+            line: line,
+            column: callExpr.getStartLinePos(),
+            message:
+              "Multer limits missing 'fileSize' - add limits.fileSize to prevent large file uploads (recommend ≤ 10MB)",
+            severity: "error",
+            category: "security",
+          });
+          reportedLines.add(line);
+          return;
+        }
+
+        if (process.env.SUNLINT_DEBUG) {
+          console.log(
+            `🔍 [S028] Line ${callExpr.getStartLineNumber()}: Has fileSize, checking threshold...`
+          );
+        }
+
+        // Validate fileSize threshold - try to evaluate expression
+        let fileSize = null;
+
+        // Try to evaluate expression first (handles both "100" and "100 * 1024 * 1024")
+        const expressionMatch = configText.match(/fileSize\s*:\s*([^,}]+)/);
+        if (expressionMatch) {
+          const expression = expressionMatch[1]
+            .trim()
+            .replace(/\/\/.*/g, "")
+            .trim();
+          if (process.env.SUNLINT_DEBUG) {
+            console.log(
+              `🔍 [S028] Line ${callExpr.getStartLineNumber()}: Evaluating expression: "${expression}"`
+            );
+          }
+          try {
+            // Safe evaluation of numeric expressions only
+            fileSize = eval(expression);
+            if (process.env.SUNLINT_DEBUG) {
+              console.log(
+                `🔍 [S028] Evaluated fileSize: ${fileSize} bytes = ${(
+                  fileSize /
+                  (1024 * 1024)
+                ).toFixed(0)}MB`
+              );
+            }
+          } catch (e) {
+            // If eval fails, skip threshold check
+            if (process.env.SUNLINT_DEBUG) {
+              console.log(`🔍 [S028] Eval failed: ${e.message}`);
+            }
+            fileSize = null;
+          }
+        }
+
+        if (fileSize && !isNaN(fileSize)) {
+          if (fileSize > this.highRiskThreshold) {
+            const line = callExpr.getStartLineNumber();
+            if (reportedLines.has(line)) return;
+
+            const fileSizeMB = (fileSize / (1024 * 1024)).toFixed(0);
+            violations.push({
+              ruleId: this.ruleId,
+              source: filePath,
+              filePath: filePath,
+              file: filePath,
+              line: line,
+              column: callExpr.getStartLinePos(),
+              message: `File size limit too high (${fileSizeMB}MB) - recommend ≤ 10MB to prevent DoS attacks`,
+              severity: "error",
+              category: "security",
+            });
+            reportedLines.add(line);
+          } else if (fileSize > this.mediumRiskThreshold) {
+            const line = callExpr.getStartLineNumber();
+            if (reportedLines.has(line)) return;
+
+            const fileSizeMB = (fileSize / (1024 * 1024)).toFixed(0);
+            violations.push({
+              ruleId: this.ruleId,
+              source: filePath,
+              filePath: filePath,
+              file: filePath,
+              line: line,
+              column: callExpr.getStartLinePos(),
+              message: `File size limit (${fileSizeMB}MB) exceeds recommended threshold - consider reducing to ≤ 10MB`,
+              severity: "warning",
+              category: "security",
+            });
+            reportedLines.add(line);
+          }
+        }
+
+        // Check if limits.files exists (optional but recommended)
+        if (!configText.includes("files")) {
+          const line = callExpr.getStartLineNumber();
+          // Don't report if already reported fileSize issue
+          if (reportedLines.has(line)) return;
+
+          // This is a warning, not error (files limit is optional)
+          violations.push({
+            ruleId: this.ruleId,
+            source: filePath,
+            filePath: filePath,
+            file: filePath,
+            line: line,
+            column: callExpr.getStartLinePos(),
+            message:
+              "Multer limits missing 'files' count - consider adding limits.files to prevent excessive uploads (recommend ≤ 10)",
+            severity: "warning",
+            category: "security",
+          });
+          reportedLines.add(line);
+        }
+      });
+    } catch (error) {
+      if (this.verbose) {
+        console.error(
+          `❌ [${this.ruleId}] Error checking multer:`,
+          error.message
+        );
+      }
+    }
+  }
+
+  /**
+   * Check @UseInterceptors(FileInterceptor(...))
+   * Pattern: @UseInterceptors(FileInterceptor('file', { limits: {...} }))
+   */
+  checkFileInterceptor(sourceFile, filePath, violations, reportedLines) {
+    try {
+      const decorators = sourceFile.getDescendantsOfKind(SyntaxKind.Decorator);
+
+      decorators.forEach((decorator) => {
+        const decoratorText = decorator.getText();
+
+        // Check if it's FileInterceptor decorator
+        const isFileInterceptor = this.fileInterceptorPatterns.some((pattern) =>
+          decoratorText.includes(pattern)
+        );
+
+        if (!isFileInterceptor) {
+          return;
+        }
+
+        // Check if it has limits configuration
+        if (!decoratorText.includes("limits")) {
+          const line = decorator.getStartLineNumber();
+          if (reportedLines.has(line)) return;
+
+          const interceptorType = decoratorText.includes("FilesInterceptor")
+            ? "FilesInterceptor"
+            : decoratorText.includes("FileFieldsInterceptor")
+            ? "FileFieldsInterceptor"
+            : "FileInterceptor";
+
+          violations.push({
+            ruleId: this.ruleId,
+            source: filePath,
+            filePath: filePath,
+            file: filePath,
+            line: line,
+            column: decorator.getStartLinePos(),
+            message: `${interceptorType} missing 'limits' configuration - add { limits: { fileSize: 10485760 } } to prevent large uploads`,
+            severity: "error",
+            category: "security",
+          });
+          reportedLines.add(line);
+          return;
+        }
+
+        // Check if limits.fileSize exists
+        if (!decoratorText.includes("fileSize")) {
+          const line = decorator.getStartLineNumber();
+          if (reportedLines.has(line)) return;
+
+          violations.push({
+            ruleId: this.ruleId,
+            source: filePath,
+            filePath: filePath,
+            file: filePath,
+            line: line,
+            column: decorator.getStartLinePos(),
+            message:
+              "FileInterceptor limits missing 'fileSize' - add limits.fileSize to prevent large file uploads (recommend ≤ 10MB)",
+            severity: "error",
+            category: "security",
+          });
+          reportedLines.add(line);
+          return;
+        }
+
+        // Validate fileSize threshold - try to evaluate expression
+        let fileSize = null;
+
+        // Try to evaluate expression first (handles both "100" and "100 * 1024 * 1024")
+        const expressionMatch = decoratorText.match(/fileSize\s*:\s*([^,}]+)/);
+        if (expressionMatch) {
+          const expression = expressionMatch[1]
+            .trim()
+            .replace(/\/\/.*/g, "")
+            .trim();
+          try {
+            // Safe evaluation of numeric expressions only
+            fileSize = eval(expression);
+          } catch (e) {
+            // If eval fails, skip threshold check
+            fileSize = null;
+          }
+        }
+
+        if (fileSize && !isNaN(fileSize)) {
+          if (fileSize > this.highRiskThreshold) {
+            const line = decorator.getStartLineNumber();
+            if (reportedLines.has(line)) return;
+
+            const fileSizeMB = (fileSize / (1024 * 1024)).toFixed(0);
+            violations.push({
+              ruleId: this.ruleId,
+              source: filePath,
+              filePath: filePath,
+              file: filePath,
+              line: line,
+              column: decorator.getStartLinePos(),
+              message: `File size limit too high (${fileSizeMB}MB) - recommend ≤ 10MB to prevent DoS attacks`,
+              severity: "error",
+              category: "security",
+            });
+            reportedLines.add(line);
+          } else if (fileSize > this.mediumRiskThreshold) {
+            const line = decorator.getStartLineNumber();
+            if (reportedLines.has(line)) return;
+
+            const fileSizeMB = (fileSize / (1024 * 1024)).toFixed(0);
+            violations.push({
+              ruleId: this.ruleId,
+              source: filePath,
+              filePath: filePath,
+              file: filePath,
+              line: line,
+              column: decorator.getStartLinePos(),
+              message: `File size limit (${fileSizeMB}MB) exceeds recommended threshold - consider reducing to ≤ 10MB`,
+              severity: "warning",
+              category: "security",
+            });
+            reportedLines.add(line);
+          }
+        }
+      });
+    } catch (error) {
+      if (this.verbose) {
+        console.error(
+          `❌ [${this.ruleId}] Error checking FileInterceptor:`,
+          error.message
+        );
+      }
+    }
+  }
+
+  /**
+   * Check Express middleware: express.json() and express.urlencoded()
+   * Pattern: app.use(express.json({ limit: '10mb' }))
+   */
+  checkExpressMiddleware(sourceFile, filePath, violations, reportedLines) {
+    try {
+      const callExpressions = sourceFile.getDescendantsOfKind(
+        SyntaxKind.CallExpression
+      );
+
+      callExpressions.forEach((callExpr) => {
+        const exprText = callExpr.getExpression().getText();
+
+        // Check if it's express.json or express.urlencoded
+        const isExpressJson = exprText.includes("express.json");
+        const isExpressUrlencoded = exprText.includes("express.urlencoded");
+
+        if (!isExpressJson && !isExpressUrlencoded) {
+          return;
+        }
+
+        const args = callExpr.getArguments();
+
+        // Check if it has limit configuration
+        const hasLimitConfig =
+          args.length > 0 && args[0].getText().includes("limit");
+
+        if (!hasLimitConfig) {
+          const line = callExpr.getStartLineNumber();
+          if (reportedLines.has(line)) return;
+
+          const methodName = isExpressJson
+            ? "express.json()"
+            : "express.urlencoded()";
+          violations.push({
+            ruleId: this.ruleId,
+            source: filePath,
+            filePath: filePath,
+            file: filePath,
+            line: line,
+            column: callExpr.getStartLinePos(),
+            message: `${methodName} missing body size limit - add { limit: '10mb' } to prevent large payload attacks`,
+            severity: "warning",
+            category: "security",
+          });
+          reportedLines.add(line);
+          return;
+        }
+
+        // Validate limit threshold
+        const configText = args[0].getText();
+        const limitMatch = configText.match(
+          /limit\s*:\s*['"](\d+)(mb|kb|gb)?['"]/i
+        );
+
+        if (limitMatch) {
+          const limitValue = parseInt(limitMatch[1], 10);
+          const limitUnit = (limitMatch[2] || "").toLowerCase();
+
+          let limitBytes = limitValue;
+          if (limitUnit === "kb") {
+            limitBytes = limitValue * 1024;
+          } else if (limitUnit === "mb") {
+            limitBytes = limitValue * 1024 * 1024;
+          } else if (limitUnit === "gb") {
+            limitBytes = limitValue * 1024 * 1024 * 1024;
+          }
+
+          if (limitBytes > this.mediumRiskThreshold) {
+            const line = callExpr.getStartLineNumber();
+            if (reportedLines.has(line)) return;
+
+            const limitMB = (limitBytes / (1024 * 1024)).toFixed(0);
+            violations.push({
+              ruleId: this.ruleId,
+              source: filePath,
+              filePath: filePath,
+              file: filePath,
+              line: line,
+              column: callExpr.getStartLinePos(),
+              message: `Body size limit (${limitMB}MB) exceeds recommended threshold - consider reducing to ≤ 10MB`,
+              severity: "warning",
+              category: "security",
+            });
+            reportedLines.add(line);
+          }
+        }
+      });
+    } catch (error) {
+      if (this.verbose) {
+        console.error(
+          `❌ [${this.ruleId}] Error checking Express middleware:`,
+          error.message
+        );
+      }
+    }
+  }
+
+  async cleanup() {
+    // Cleanup if needed
+  }
+}
+
+module.exports = S028SymbolBasedAnalyzer;