@sun-asterisk/sunlint 1.3.18 → 1.3.20

package/rules/security/S041_session_token_invalidation/symbol-based-analyzer.js

@@ -0,0 +1,674 @@
+/**
+ * S041 Symbol-Based Analyzer - Session Tokens must be invalidated after logout or expiration
+ * Uses TypeScript compiler API for semantic analysis
+ */
+
+const ts = require("typescript");
+
+class S041SymbolBasedAnalyzer {
+  constructor(semanticEngine = null) {
+    this.semanticEngine = semanticEngine;
+    this.ruleId = "S041";
+    this.category = "security";
+
+    // Session management methods that should invalidate tokens
+    this.sessionMethods = [
+      "logout",
+      "signOut", 
+      "logOut",
+      "destroy",
+      "clear",
+      "invalidate",
+      "revoke",
+      "expire",
+      "endSession",
+      "end-session",
+      "clear-session",
+      "destroy-session",
+      "remove-session"
+    ];
+
+    // Token-related methods and properties
+    this.tokenMethods = [
+      "removeToken",
+      "clearToken",
+      "invalidateToken",
+      "revokeToken",
+      "deleteToken",
+      "destroyToken"
+    ];
+
+    // Session storage methods
+    this.sessionStorageMethods = [
+      "removeItem",
+      "clear",
+      "destroy",
+      "delete"
+    ];
+
+    // JWT token methods
+    this.jwtMethods = [
+      "sign",
+      "verify",
+      "decode",
+      "invalidate",
+      "blacklist"
+    ];
+
+    // Express session methods
+    this.expressSessionMethods = [
+      "destroy",
+      "regenerate",
+      "reload",
+      "save"
+    ];
+
+    // Session data clearing patterns
+    this.sessionClearPatterns = [
+      "req.session.destroy",
+      "req.session = null",
+      "req.session = {}",
+      "session.destroy",
+      "session.clear",
+      "session.remove"
+    ];
+
+    // Token invalidation patterns
+    this.tokenInvalidationPatterns = [
+      "blacklist",
+      "revoke",
+      "invalidate",
+      "expire",
+      "remove",
+      "delete"
+    ];
+
+    // User input sources for session data
+    this.userInputSources = [
+      "req",
+      "request", 
+      "params",
+      "query",
+      "body",
+      "headers",
+      "cookies",
+      "session"
+    ];
+  }
+
+  /**
+   * Initialize analyzer with semantic engine
+   */
+  async initialize(semanticEngine) {
+    this.semanticEngine = semanticEngine;
+    if (this.verbose) {
+      console.log(`🔍 [${this.ruleId}] Symbol: Semantic engine initialized`);
+    }
+  }
+
+  async analyze(filePath) {
+    if (this.verbose) {
+      console.log(
+        `🔍 [${this.ruleId}] Symbol: Starting analysis for ${filePath}`
+      );
+    }
+
+    if (!this.semanticEngine) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: No semantic engine available, skipping`
+        );
+      }
+      return [];
+    }
+
+    try {
+      const sourceFile = this.semanticEngine.getSourceFile(filePath);
+      if (!sourceFile) {
+        if (this.verbose) {
+          console.log(
+            `🔍 [${this.ruleId}] Symbol: No source file found, trying ts-morph fallback`
+          );
+        }
+        return await this.analyzeTsMorph(filePath);
+      }
+
+      if (this.verbose) {
+        console.log(`🔧 [${this.ruleId}] Source file found, analyzing...`);
+      }
+
+      return await this.analyzeSourceFile(sourceFile, filePath);
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error in analysis:`,
+          error.message
+        );
+      }
+      return [];
+    }
+  }
+
+  async analyzeTsMorph(filePath) {
+    try {
+      if (this.verbose) {
+        console.log(`🔍 [${this.ruleId}] Symbol: Starting ts-morph analysis`);
+      }
+
+      const { Project } = require("ts-morph");
+      const project = new Project();
+      const sourceFile = project.addSourceFileAtPath(filePath);
+
+      return await this.analyzeSourceFile(sourceFile, filePath);
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: ts-morph analysis failed:`,
+          error.message
+        );
+      }
+      return [];
+    }
+  }
+
+  async analyzeSourceFile(sourceFile, filePath) {
+    const violations = [];
+
+    try {
+      if (this.verbose) {
+        console.log(`🔍 [${this.ruleId}] Symbol: Starting symbol-based analysis`);
+      }
+
+      const callExpressions = sourceFile.getDescendantsOfKind
+        ? sourceFile.getDescendantsOfKind(
+            require("typescript").SyntaxKind.CallExpression
+          )
+        : [];
+
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Found ${callExpressions.length} call expressions`
+        );
+      }
+
+      for (const callNode of callExpressions) {
+        try {
+          // Analyze logout methods without proper session cleanup
+          const logoutViolation = this.analyzeLogoutMethod(callNode, sourceFile);
+          if (logoutViolation) {
+            violations.push(logoutViolation);
+          }
+
+          // Analyze session methods without token invalidation
+          const sessionViolation = this.analyzeSessionMethod(callNode, sourceFile);
+          if (sessionViolation) {
+            violations.push(sessionViolation);
+          }
+
+          // Analyze JWT token handling
+          const jwtViolation = this.analyzeJWTTokenHandling(callNode, sourceFile);
+          if (jwtViolation) {
+            violations.push(jwtViolation);
+          }
+
+        } catch (error) {
+          if (this.verbose) {
+            console.log(
+              `🔍 [${this.ruleId}] Symbol: Error analyzing call expression:`,
+              error.message
+            );
+          }
+        }
+      }
+
+      // Also check for function declarations that might be logout handlers
+      const functionDeclarations = sourceFile.getDescendantsOfKind
+        ? sourceFile.getDescendantsOfKind(
+            require("typescript").SyntaxKind.FunctionDeclaration
+          )
+        : [];
+
+      for (const funcNode of functionDeclarations) {
+        try {
+          const logoutHandlerViolation = this.analyzeLogoutHandler(funcNode, sourceFile);
+          if (logoutHandlerViolation) {
+            violations.push(logoutHandlerViolation);
+          }
+        } catch (error) {
+          if (this.verbose) {
+            console.log(
+              `🔍 [${this.ruleId}] Symbol: Error analyzing function declaration:`,
+              error.message
+            );
+          }
+        }
+      }
+
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Analysis completed. Found ${violations.length} violations`
+        );
+      }
+
+      return violations;
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error in source file analysis:`,
+          error.message
+        );
+      }
+      return [];
+    }
+  }
+
+  analyzeLogoutMethod(callNode, sourceFile) {
+    try {
+      const expression = callNode.getExpression();
+      const methodName = this.getMethodName(expression);
+
+      // Only check actual logout methods, not session cleanup methods
+      const actualLogoutMethods = ['logout', 'signOut', 'logOut', 'invalidate', 'revoke', 'expire'];
+      if (!actualLogoutMethods.includes(methodName)) {
+        return null;
+      }
+
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Logout method detected: ${methodName}`
+        );
+      }
+
+      // Check if session cleanup is performed in the same function
+      const hasSessionCleanup = this.hasSessionCleanupInContext(callNode, sourceFile);
+      if (!hasSessionCleanup) {
+        return this.createViolation(
+          sourceFile,
+          callNode,
+          `Session token invalidation vulnerability: ${methodName}() method should invalidate session tokens and clear session data`
+        );
+      }
+
+      return null;
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error analyzing logout method:`,
+          error.message
+        );
+      }
+      return null;
+    }
+  }
+
+  analyzeSessionMethod(callNode, sourceFile) {
+    try {
+      const expression = callNode.getExpression();
+      const methodName = this.getMethodName(expression);
+
+      // Check if it's a session-related method
+      const isSessionMethod = this.isSessionRelatedMethod(expression);
+      if (!isSessionMethod) {
+        return null;
+      }
+
+      // Only check in logout context
+      const isInLogoutContext = this.isInLogoutContext(callNode, sourceFile);
+      if (!isInLogoutContext) {
+        return null;
+      }
+
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Session method detected in logout context: ${methodName}`
+        );
+      }
+
+      // Check if token invalidation is performed
+      const hasTokenInvalidation = this.hasTokenInvalidationInContext(callNode, sourceFile);
+      if (!hasTokenInvalidation) {
+        return this.createViolation(
+          sourceFile,
+          callNode,
+          `Session token invalidation vulnerability: Session method ${methodName}() should invalidate tokens during logout`
+        );
+      }
+
+      return null;
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error analyzing session method:`,
+          error.message
+        );
+      }
+      return null;
+    }
+  }
+
+  analyzeJWTTokenHandling(callNode, sourceFile) {
+    try {
+      const expression = callNode.getExpression();
+      const methodName = this.getMethodName(expression);
+
+      if (!this.jwtMethods.includes(methodName)) {
+        return null;
+      }
+
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: JWT method detected: ${methodName}`
+        );
+      }
+
+      // Check if it's in a logout context and if token is properly invalidated
+      const isInLogoutContext = this.isInLogoutContext(callNode, sourceFile);
+      if (isInLogoutContext && methodName === "sign") {
+        return this.createViolation(
+          sourceFile,
+          callNode,
+          `Session token invalidation vulnerability: JWT token should be invalidated/blacklisted during logout, not signed`
+        );
+      }
+
+      return null;
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error analyzing JWT token handling:`,
+          error.message
+        );
+      }
+      return null;
+    }
+  }
+
+  analyzeLogoutHandler(funcNode, sourceFile) {
+    try {
+      const functionName = funcNode.getName();
+      const functionText = funcNode.getText();
+
+      // Check if it's a logout handler
+      const isLogoutHandler = this.isLogoutHandler(functionName, functionText);
+      if (!isLogoutHandler) {
+        return null;
+      }
+
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Logout handler detected: ${functionName}`
+        );
+      }
+
+      // Check if session cleanup is performed
+      const hasSessionCleanup = this.hasSessionCleanupInFunction(funcNode);
+      if (!hasSessionCleanup) {
+        return this.createViolation(
+          sourceFile,
+          funcNode,
+          `Session token invalidation vulnerability: Logout handler should clear session data and invalidate tokens`
+        );
+      }
+
+      return null;
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error analyzing logout handler:`,
+          error.message
+        );
+      }
+      return null;
+    }
+  }
+
+  isSessionRelatedMethod(expression) {
+    try {
+      const expressionText = expression.getText();
+      
+      // Don't detect session cleanup methods as violations
+      const sessionCleanupMethods = [
+        'req.session.destroy',
+        'session.destroy',
+        'res.clearCookie',
+        'sessionStorage.clear',
+        'localStorage.clear',
+        'req.session.reload',
+        'req.session.regenerate'
+      ];
+      
+      if (sessionCleanupMethods.some(method => expressionText.includes(method))) {
+        return false;
+      }
+      
+      return this.sessionStorageMethods.some(method => 
+        expressionText.includes(method)
+      ) || this.expressSessionMethods.some(method =>
+        expressionText.includes(method)
+      );
+    } catch (error) {
+      return false;
+    }
+  }
+
+  isLogoutRelatedMethod(methodName) {
+    return this.sessionMethods.includes(methodName) || 
+           this.tokenMethods.includes(methodName);
+  }
+
+  isLogoutHandler(functionName, functionText) {
+    const logoutPatterns = [
+      /logout/i,
+      /signout/i,
+      /sign_out/i,
+      /log_out/i,
+      /destroy.*session/i,
+      /clear.*session/i,
+      /end.*session/i,
+      /endSession/i
+    ];
+
+    return logoutPatterns.some(pattern => 
+      pattern.test(functionName) || pattern.test(functionText)
+    );
+  }
+
+  isInLogoutContext(node, sourceFile) {
+    try {
+      // Get the parent function to check context
+      let parent = node.getParent();
+      while (parent && !this.isFunctionLike(parent)) {
+        parent = parent.getParent();
+      }
+
+      if (!parent) {
+        return false;
+      }
+
+      const functionText = parent.getText();
+      const functionName = this.getFunctionName(parent);
+      
+      // Check if function name or content indicates logout
+      const logoutPatterns = [
+        /logout/i,
+        /signout/i,
+        /sign_out/i,
+        /log_out/i,
+        /destroy.*session/i,
+        /clear.*session/i
+      ];
+
+      // Check function name
+      if (functionName && logoutPatterns.some(pattern => pattern.test(functionName))) {
+        return true;
+      }
+
+      // Check function content for logout patterns
+      return logoutPatterns.some(pattern => pattern.test(functionText));
+    } catch (error) {
+      return false;
+    }
+  }
+
+  getFunctionName(node) {
+    try {
+      if (node.getName) {
+        return node.getName();
+      }
+      return "";
+    } catch (error) {
+      return "";
+    }
+  }
+
+  hasSessionCleanupInContext(node, sourceFile) {
+    try {
+      // Get the parent function to check for session cleanup
+      let parent = node.getParent();
+      while (parent && !this.isFunctionLike(parent)) {
+        parent = parent.getParent();
+      }
+
+      if (!parent) {
+        return false;
+      }
+
+      const functionText = parent.getText();
+      
+      // Check for session cleanup patterns
+      const cleanupPatterns = [
+        /req\.session\.destroy/,
+        /req\.session\s*=\s*null/,
+        /req\.session\s*=\s*\{\}/,
+        /session\.destroy/,
+        /session\.clear/,
+        /session\.remove/,
+        /\.removeItem/,
+        /\.clear\(\)/,
+        /\.delete\(/,
+        /res\.clearCookie/,
+        /sessionStorage\.clear/,
+        /localStorage\.clear/,
+        /req\.session\.regenerate/
+      ];
+
+      return cleanupPatterns.some(pattern => pattern.test(functionText));
+    } catch (error) {
+      return false;
+    }
+  }
+
+  hasSessionCleanupInFunction(funcNode) {
+    try {
+      const functionText = funcNode.getText();
+      
+      // Check for session cleanup patterns
+      const cleanupPatterns = [
+        /req\.session\.destroy/,
+        /req\.session\s*=\s*null/,
+        /req\.session\s*=\s*\{\}/,
+        /session\.destroy/,
+        /session\.clear/,
+        /session\.remove/,
+        /\.removeItem/,
+        /\.clear\(\)/,
+        /\.delete\(/
+      ];
+
+      return cleanupPatterns.some(pattern => pattern.test(functionText));
+    } catch (error) {
+      return false;
+    }
+  }
+
+  hasTokenInvalidationInContext(node, sourceFile) {
+    try {
+      // Get the parent function to check for token invalidation
+      let parent = node.getParent();
+      while (parent && !this.isFunctionLike(parent)) {
+        parent = parent.getParent();
+      }
+
+      if (!parent) {
+        return false;
+      }
+
+      const functionText = parent.getText();
+      
+      // Check for token invalidation patterns
+      const invalidationPatterns = [
+        /blacklist/,
+        /revoke/,
+        /invalidate/,
+        /expire/,
+        /remove.*token/,
+        /delete.*token/,
+        /clear.*token/,
+        /destroy.*token/
+      ];
+
+      return invalidationPatterns.some(pattern => pattern.test(functionText));
+    } catch (error) {
+      return false;
+    }
+  }
+
+  isFunctionLike(node) {
+    try {
+      const SyntaxKind = require("typescript").SyntaxKind;
+      const kind = node.getKind();
+      
+      return kind === SyntaxKind.FunctionDeclaration ||
+             kind === SyntaxKind.FunctionExpression ||
+             kind === SyntaxKind.ArrowFunction ||
+             kind === SyntaxKind.MethodDeclaration;
+    } catch (error) {
+      return false;
+    }
+  }
+
+  getMethodName(expression) {
+    try {
+      const ts = require("typescript");
+
+      if (expression.getKind() === ts.SyntaxKind.PropertyAccessExpression) {
+        return expression.getNameNode().getText();
+      }
+
+      if (expression.getKind() === ts.SyntaxKind.Identifier) {
+        return expression.getText();
+      }
+
+      return "";
+    } catch (error) {
+      return "";
+    }
+  }
+
+  createViolation(sourceFile, node, message) {
+    try {
+      const start = node.getStart();
+      const lineAndChar = sourceFile.getLineAndColumnAtPos(start);
+
+      return {
+        rule: this.ruleId,
+        source: sourceFile.getFilePath(),
+        category: this.category,
+        line: lineAndChar.line,
+        column: lineAndChar.column,
+        message: message,
+        severity: "error",
+      };
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error creating violation:`,
+          error.message
+        );
+      }
+      return null;
+    }
+  }
+}
+
+module.exports = S041SymbolBasedAnalyzer;