@sun-asterisk/sunlint 1.3.18 → 1.3.20

package/rules/security/S045_brute_force_protection/symbol-based-analyzer.js

@@ -0,0 +1,646 @@
+/**
+ * S045 Symbol-Based Analyzer - Brute-force Protection
+ * Uses TypeScript compiler API for semantic analysis
+ */
+
+const ts = require("typescript");
+
+class S045SymbolBasedAnalyzer {
+  constructor(semanticEngine = null) {
+    this.semanticEngine = semanticEngine;
+    this.ruleId = "S045";
+    this.category = "security";
+
+    // Authentication endpoint patterns
+    this.authEndpoints = [
+      "login",
+      "signin", 
+      "authenticate",
+      "auth",
+      "password",
+      "reset",
+      "forgot",
+      "signup",
+      "register"
+    ];
+
+    // Rate limiting libraries and decorators
+    this.rateLimitLibraries = [
+      "express-rate-limit",
+      "express-slow-down",
+      "@nestjs/throttler",
+      "rate-limiter-flexible",
+      "bottleneck",
+      "limiter"
+    ];
+
+    // Account lockout libraries
+    this.lockoutLibraries = [
+      "express-slow-down",
+      "rate-limiter-flexible", 
+      "express-brute",
+      "express-brute-mongo"
+    ];
+
+    // CAPTCHA libraries
+    this.captchaLibraries = [
+      "recaptcha",
+      "hcaptcha",
+      "turnstile",
+      "captcha"
+    ];
+
+    // Protection decorators and middleware
+    this.protectionDecorators = [
+      "Throttle",
+      "RateLimit",
+      "ThrottleGuard",
+      "RateLimitGuard"
+    ];
+
+    // Protection patterns in code
+    this.protectionPatterns = [
+      "rate.*limit",
+      "throttle",
+      "lockout",
+      "captcha",
+      "brute.*force.*protection",
+      "max.*attempts",
+      "cooldown",
+      "windowMs",
+      "max.*requests"
+    ];
+
+    // Vulnerable patterns that indicate missing protection
+    this.vulnerablePatterns = [
+      "login.*without.*rate.*limit",
+      "auth.*without.*throttle", 
+      "password.*without.*lockout",
+      "signin.*without.*captcha"
+    ];
+  }
+
+  /**
+   * Initialize analyzer with semantic engine
+   */
+  async initialize(semanticEngine) {
+    this.semanticEngine = semanticEngine;
+    if (this.verbose) {
+      console.log(`🔍 [${this.ruleId}] Symbol: Semantic engine initialized`);
+    }
+  }
+
+  async analyze(filePath) {
+    if (this.verbose) {
+      console.log(
+        `🔍 [${this.ruleId}] Symbol: Starting analysis for ${filePath}`
+      );
+    }
+
+    if (!this.semanticEngine) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: No semantic engine available, skipping`
+        );
+      }
+      return [];
+    }
+
+    try {
+      const sourceFile = this.semanticEngine.getSourceFile(filePath);
+      console.log('sourceFile', sourceFile);
+      if (!sourceFile) {
+        if (this.verbose) {
+          console.log(
+            `🔍 [${this.ruleId}] Symbol: No source file found, trying ts-morph fallback`
+          );
+        }
+        return await this.analyzeTsMorph(filePath);
+      }
+
+      if (this.verbose) {
+        console.log(`🔧 [${this.ruleId}] Source file found, analyzing...`);
+      }
+
+      return await this.analyzeSourceFile(sourceFile, filePath);
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error in analysis:`,
+          error.message
+        );
+      }
+      return [];
+    }
+  }
+
+  async analyzeTsMorph(filePath) {
+    try {
+      if (this.verbose) {
+        console.log(`🔍 [${this.ruleId}] Symbol: Starting ts-morph analysis`);
+      }
+
+      const { Project } = require("ts-morph");
+      const project = new Project();
+      const sourceFile = project.addSourceFileAtPath(filePath);
+
+      return await this.analyzeSourceFile(sourceFile, filePath);
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: ts-morph analysis failed:`,
+          error.message
+        );
+      }
+      return [];
+    }
+  }
+
+  async analyzeSourceFile(sourceFile, filePath) {
+    const violations = [];
+    const startTime = Date.now();
+
+    try {
+      if (this.verbose) {
+        console.log(`🔍 [${this.ruleId}] Symbol: Starting symbol-based analysis for ${filePath}`);
+      }
+
+      // Find all method declarations and decorators
+      const methodDeclarations = sourceFile.getDescendantsOfKind
+        ? sourceFile.getDescendantsOfKind(
+            require("typescript").SyntaxKind.MethodDeclaration
+          )
+        : [];
+
+      const functionDeclarations = sourceFile.getDescendantsOfKind
+        ? sourceFile.getDescendantsOfKind(
+            require("typescript").SyntaxKind.FunctionDeclaration
+          )
+        : [];
+
+      const arrowFunctions = sourceFile.getDescendantsOfKind
+        ? sourceFile.getDescendantsOfKind(
+            require("typescript").SyntaxKind.ArrowFunction
+          )
+        : [];
+
+      const allFunctions = [
+        ...methodDeclarations,
+        ...functionDeclarations,
+        ...arrowFunctions
+      ];
+
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Found ${allFunctions.length} functions (${methodDeclarations.length} methods, ${functionDeclarations.length} functions, ${arrowFunctions.length} arrow functions)`
+        );
+      }
+
+      let authChecked = 0;
+      let rateLimitChecked = 0;
+      let lockoutChecked = 0;
+      let funcErrors = 0;
+
+      for (const func of allFunctions) {
+        try {
+          const funcName = this.getFunctionName(func);
+          
+          if (this.verbose) {
+            console.log(`🔍 [${this.ruleId}] Symbol: Analyzing function '${funcName}'`);
+          }
+
+          // Check for authentication endpoints without protection
+          const authViolation = this.analyzeAuthenticationEndpoint(func, sourceFile);
+          authChecked++;
+          if (authViolation) {
+            violations.push(authViolation);
+            if (this.verbose) {
+              console.log(`⚠️  [${this.ruleId}] Symbol: Auth violation found in '${funcName}'`);
+            }
+          }
+
+          // Check for missing rate limiting
+          const rateLimitViolation = this.analyzeRateLimiting(func, sourceFile);
+          rateLimitChecked++;
+          if (rateLimitViolation) {
+            violations.push(rateLimitViolation);
+            if (this.verbose) {
+              console.log(`⚠️  [${this.ruleId}] Symbol: Rate limit violation found in '${funcName}'`);
+            }
+          }
+
+          // Check for missing account lockout
+          const lockoutViolation = this.analyzeAccountLockout(func, sourceFile);
+          lockoutChecked++;
+          if (lockoutViolation) {
+            violations.push(lockoutViolation);
+            if (this.verbose) {
+              console.log(`⚠️  [${this.ruleId}] Symbol: Account lockout violation found in '${funcName}'`);
+            }
+          }
+
+        } catch (error) {
+          funcErrors++;
+          if (this.verbose) {
+            console.log(
+              `🔍 [${this.ruleId}] Symbol: Error analyzing function:`,
+              error.message
+            );
+          }
+        }
+      }
+
+      // Check for missing protection in route definitions
+      const callExpressions = sourceFile.getDescendantsOfKind
+        ? sourceFile.getDescendantsOfKind(
+            require("typescript").SyntaxKind.CallExpression
+          )
+        : [];
+
+      if (this.verbose) {
+        console.log(`🔍 [${this.ruleId}] Symbol: Found ${callExpressions.length} call expressions to analyze`);
+      }
+
+      let routeChecked = 0;
+      let routeErrors = 0;
+
+      for (const callNode of callExpressions) {
+        try {
+          const routeViolation = this.analyzeRouteProtection(callNode, sourceFile);
+          routeChecked++;
+          if (routeViolation) {
+            violations.push(routeViolation);
+            if (this.verbose) {
+              console.log(`⚠️  [${this.ruleId}] Symbol: Route protection violation found`);
+            }
+          }
+        } catch (error) {
+          routeErrors++;
+          if (this.verbose) {
+            console.log(
+              `🔍 [${this.ruleId}] Symbol: Error analyzing call expression:`,
+              error.message
+            );
+          }
+        }
+      }
+
+      const duration = Date.now() - startTime;
+      
+      if (this.verbose) {
+        console.log(
+          `✅ [${this.ruleId}] Symbol: Analysis completed in ${duration}ms. ` +
+          `Found ${violations.length} violations from ${allFunctions.length} functions and ${callExpressions.length} call expressions. ` +
+          `Stats: auth=${authChecked}, rateLimit=${rateLimitChecked}, lockout=${lockoutChecked}, routes=${routeChecked}, ` +
+          `errors=${funcErrors + routeErrors}`
+        );
+      }
+
+      return violations;
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error in source file analysis:`,
+          error.message
+        );
+      }
+      return [];
+    }
+  }
+
+  analyzeAuthenticationEndpoint(func, sourceFile) {
+    try {
+      const funcName = this.getFunctionName(func);
+      const funcText = func.getText();
+
+      // Check if this is an authentication endpoint
+      const isAuthEndpoint = this.authEndpoints.some(endpoint =>
+        funcName.toLowerCase().includes(endpoint) ||
+        funcText.toLowerCase().includes(`/${endpoint}`)
+      );
+
+      if (!isAuthEndpoint) {
+        return null;
+      }
+
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Authentication endpoint detected: ${funcName}`
+        );
+      }
+
+      // Check if protection mechanisms are present
+      const hasProtection = this.hasProtectionMechanisms(func, sourceFile);
+      if (!hasProtection) {
+        return this.createViolation(
+          sourceFile,
+          func,
+          `Authentication endpoint '${funcName}' lacks brute-force protection (rate limiting, account lockout, or CAPTCHA)`
+        );
+      }
+
+      return null;
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error analyzing auth endpoint:`,
+          error.message
+        );
+      }
+      return null;
+    }
+  }
+
+  analyzeRateLimiting(func, sourceFile) {
+    try {
+      const funcName = this.getFunctionName(func);
+      const funcText = func.getText();
+
+      // Check if this is a login/auth function
+      const isAuthFunction = this.authEndpoints.some(endpoint =>
+        funcName.toLowerCase().includes(endpoint)
+      );
+
+      if (!isAuthFunction) {
+        return null;
+      }
+
+      // Check for rate limiting decorators or middleware
+      const hasRateLimit = this.hasRateLimiting(func, sourceFile);
+      if (!hasRateLimit) {
+        return this.createViolation(
+          sourceFile,
+          func,
+          `Authentication function '${funcName}' missing rate limiting protection`
+        );
+      }
+
+      return null;
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error analyzing rate limiting:`,
+          error.message
+        );
+      }
+      return null;
+    }
+  }
+
+  analyzeAccountLockout(func, sourceFile) {
+    try {
+      const funcName = this.getFunctionName(func);
+      const funcText = func.getText();
+
+      // Check if this is a login/auth function
+      const isAuthFunction = this.authEndpoints.some(endpoint =>
+        funcName.toLowerCase().includes(endpoint)
+      );
+
+      if (!isAuthFunction) {
+        return null;
+      }
+
+      // Check for account lockout mechanisms
+      const hasLockout = this.hasAccountLockout(func, sourceFile);
+      if (!hasLockout) {
+        return this.createViolation(
+          sourceFile,
+          func,
+          `Authentication function '${funcName}' missing account lockout protection`
+        );
+      }
+
+      return null;
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error analyzing account lockout:`,
+          error.message
+        );
+      }
+      return null;
+    }
+  }
+
+  analyzeRouteProtection(callNode, sourceFile) {
+    try {
+      const expression = callNode.getExpression();
+      const methodName = this.getMethodName(expression);
+
+      // Check for route definitions (app.post, router.get, etc.)
+      const routeMethods = ["post", "get", "put", "delete", "patch"];
+      if (!routeMethods.includes(methodName.toLowerCase())) {
+        return null;
+      }
+
+      const args = callNode.getArguments();
+      if (args.length === 0) {
+        return null;
+      }
+
+      const routePath = args[0].getText();
+      const isAuthRoute = this.authEndpoints.some(endpoint =>
+        routePath.toLowerCase().includes(`/${endpoint}`) ||
+        routePath.toLowerCase().includes(`"${endpoint}"`) ||
+        routePath.toLowerCase().includes(`'${endpoint}'`)
+      );
+
+      if (!isAuthRoute) {
+        return null;
+      }
+
+      // Check if route has protection middleware
+      const hasProtection = this.hasRouteProtection(callNode, sourceFile);
+      if (!hasProtection) {
+        return this.createViolation(
+          sourceFile,
+          callNode,
+          `Authentication route ${routePath} missing brute-force protection middleware`
+        );
+      }
+
+      return null;
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error analyzing route protection:`,
+          error.message
+        );
+      }
+      return null;
+    }
+  }
+
+  hasProtectionMechanisms(func, sourceFile) {
+    try {
+      const funcText = func.getText();
+      
+      // Check for decorators
+      const decorators = func.getDecorators ? func.getDecorators() : [];
+      const hasProtectionDecorator = decorators.some(decorator => {
+        const decoratorText = decorator.getText();
+        return this.protectionDecorators.some(pattern =>
+          decoratorText.includes(pattern)
+        );
+      });
+
+      if (hasProtectionDecorator) {
+        return true;
+      }
+
+      // Check for protection patterns in function body
+      const hasProtectionPattern = this.protectionPatterns.some(pattern => {
+        const regex = new RegExp(pattern, 'i');
+        return regex.test(funcText);
+      });
+
+      return hasProtectionPattern;
+    } catch (error) {
+      return false;
+    }
+  }
+
+  hasRateLimiting(func, sourceFile) {
+    try {
+      const funcText = func.getText();
+      
+      // Check for rate limiting decorators
+      const decorators = func.getDecorators ? func.getDecorators() : [];
+      const hasRateLimitDecorator = decorators.some(decorator => {
+        const decoratorText = decorator.getText();
+        return decoratorText.includes('Throttle') || 
+               decoratorText.includes('RateLimit') ||
+               decoratorText.includes('ThrottleGuard');
+      });
+
+      if (hasRateLimitDecorator) {
+        return true;
+      }
+
+      // Check for rate limiting patterns
+      const rateLimitPatterns = [
+        /rate.*limit/i,
+        /throttle/i,
+        /windowMs/i,
+        /max.*requests/i,
+        /express-rate-limit/i,
+        /@nestjs\/throttler/i
+      ];
+
+      return rateLimitPatterns.some(pattern => pattern.test(funcText));
+    } catch (error) {
+      return false;
+    }
+  }
+
+  hasAccountLockout(func, sourceFile) {
+    try {
+      const funcText = func.getText();
+      
+      // Check for lockout patterns
+      const lockoutPatterns = [
+        /lockout/i,
+        /max.*attempts/i,
+        /cooldown/i,
+        /account.*lock/i,
+        /brute.*force.*protection/i,
+        /express-brute/i,
+        /rate-limiter-flexible/i
+      ];
+
+      return lockoutPatterns.some(pattern => pattern.test(funcText));
+    } catch (error) {
+      return false;
+    }
+  }
+
+  hasRouteProtection(callNode, sourceFile) {
+    try {
+      // Check if there are middleware functions before the handler
+      const parent = callNode.getParent();
+      if (!parent) {
+        return false;
+      }
+
+      const parentText = parent.getText();
+      
+      // Look for middleware patterns
+      const middlewarePatterns = [
+        /rateLimit/i,
+        /throttle/i,
+        /lockout/i,
+        /brute.*force/i,
+        /express-rate-limit/i,
+        /express-slow-down/i
+      ];
+
+      return middlewarePatterns.some(pattern => pattern.test(parentText));
+    } catch (error) {
+      return false;
+    }
+  }
+
+  getFunctionName(func) {
+    try {
+      if (func.getName) {
+        return func.getName();
+      }
+      
+      // For arrow functions or anonymous functions
+      const parent = func.getParent();
+      if (parent && parent.getName) {
+        return parent.getName();
+      }
+
+      return "anonymous";
+    } catch (error) {
+      return "unknown";
+    }
+  }
+
+  getMethodName(expression) {
+    try {
+      const ts = require("typescript");
+
+      if (expression.getKind() === ts.SyntaxKind.PropertyAccessExpression) {
+        return expression.getNameNode().getText();
+      }
+
+      if (expression.getKind() === ts.SyntaxKind.Identifier) {
+        return expression.getText();
+      }
+
+      return "";
+    } catch (error) {
+      return "";
+    }
+  }
+
+  createViolation(sourceFile, node, message) {
+    try {
+      const start = node.getStart();
+      const lineAndChar = sourceFile.getLineAndColumnAtPos(start);
+
+      return {
+        rule: this.ruleId,
+        source: sourceFile.getFilePath(),
+        category: this.category,
+        line: lineAndChar.line,
+        column: lineAndChar.column,
+        message: message,
+        severity: "error",
+      };
+    } catch (error) {
+      if (this.verbose) {
+        console.log(
+          `🔍 [${this.ruleId}] Symbol: Error creating violation:`,
+          error.message
+        );
+      }
+      return null;
+    }
+  }
+}
+
+module.exports = S045SymbolBasedAnalyzer;