@sun-asterisk/sunlint 1.3.7 → 1.3.8

package/rules/security/S037_cache_headers/regex-based-analyzer.js

@@ -0,0 +1,463 @@
+/**
+ * S037 Regex-Based Analyzer - Configure comprehensive cache headers
+ * Refactored for per-route evaluation with framework support.
+ */
+const fs = require("fs");
+
+class S037RegexBasedAnalyzer {
+  constructor() {
+    this.ruleId = "S037";
+
+    // Framework-specific route patterns
+    this.routePatterns = {
+      // Express.js
+      express:
+        /\b(app|router)\.(get|post|put|delete|patch|use)\s*\(\s*['"`][^'"`]+['"`]/,
+      // Next.js API routes
+      nextjs: /export\s+(default\s+)?async?\s+function\s+handler\s*\(/,
+      // Next.js 13+ App Router
+      nextjsApp:
+        /export\s+async?\s+function\s+(GET|POST|PUT|DELETE|PATCH)\s*\(/,
+      // NestJS controllers
+      nestjs: /@(Get|Post|Put|Delete|Patch)\s*\(\s*['"`][^'"`]*['"`]?\s*\)/,
+      // Nuxt.js server routes
+      nuxtjs:
+        /export\s+(default\s+|const\s+(GET|POST|PUT|DELETE|PATCH)\s*=\s*)?defineEventHandler\s*\(/,
+    };
+
+    // Header detection patterns
+    this.cacheControlPattern =
+      /res\.set(Header|)\s*\(\s*['"`]Cache-Control['"`]\s*,\s*['"`]([^'"`]+)['"`]/i;
+    this.pragmaPattern =
+      /res\.set(Header|)\s*\(\s*['"`]Pragma['"`]\s*,\s*['"`]no-cache['"`]/i;
+    this.expiresPattern =
+      /res\.set(Header|)\s*\(\s*['"`]Expires['"`]\s*,\s*['"`](0|Thu,? 01 Jan 1970[^'"`]*)['"`]/i;
+    this.bulkSetPattern = /res\.set\s*\(\s*\{([^}]+)\}/i;
+
+    // Next.js specific patterns
+    this.nextHeaderPattern =
+      /res\.setHeader\s*\(\s*['"`]([^'"`]+)['"`]\s*,\s*['"`]([^'"`]+)['"`]/i;
+    this.nextHeadersPattern =
+      /\w+\.headers\s*\.set\s*\(\s*['"`]([^'"`]+)['"`]\s*,\s*['"`]([^'"`]+)['"`]/i;
+
+    this.requiredDirectives = ["no-store", "no-cache", "must-revalidate"];
+    this.sensitiveIndicators =
+      /\b(session|auth(?:enticate|orization)?|token|jwt|csrf|login|logout|banking|crypto|salary|ssn|social[-_]?security|medical|prescription|biometric|audit|tax|legal|contract|personal[-_]?data|identity|finance|wallet|private[-_]?key|secret|sensitive[-_]?data|confidential|admin[-_]?panel|payment[-_]?process|credit[-_]?card|oauth|password|reset)\b/i;
+  }
+
+  async analyze(filePath) {
+    // Skip files that are unlikely to be route handlers
+    const skipPatterns = [
+      /\.dto\.ts$/,
+      /\.interface\.ts$/,
+      /\.module\.ts$/,
+      /\.service\.spec\.ts$/,
+      /\.controller\.spec\.ts$/,
+      /\.spec\.ts$/,
+      /\.test\.ts$/,
+      /\.d\.ts$/,
+      /\.types\.ts$/,
+      /\.constants?\.ts$/,
+      /\.config\.ts$/,
+    ];
+
+    const shouldSkip = skipPatterns.some((pattern) => pattern.test(filePath));
+    if (shouldSkip) {
+      return [];
+    }
+
+    const content = fs.readFileSync(filePath, "utf8");
+    const lines = content.split(/\r?\n/);
+    const violations = [];
+
+    let inRoute = false;
+    let braceDepth = 0;
+    let routeStartLine = 0;
+    let routeType = "";
+    let ccRaw = "";
+    let hasCC = false;
+    let hasPragma = false;
+    let hasExpires = false;
+    let sawSensitive = false;
+    let secureMiddlewareImplied = false;
+    let inBulkSet = false;
+    let bulkSetContent = "";
+
+    const reset = () => {
+      inRoute = false;
+      braceDepth = 0;
+      routeStartLine = 0;
+      routeType = "";
+      ccRaw = "";
+      hasCC =
+        hasPragma =
+        hasExpires =
+        sawSensitive =
+        secureMiddlewareImplied =
+        inBulkSet =
+          false;
+      bulkSetContent = "";
+    };
+
+    const evaluate = () => {
+      if (!routeStartLine) return;
+
+      // Only evaluate if route appears sensitive OR we actually saw headers being set
+      const touchedHeaders = hasCC || hasPragma || hasExpires;
+      if (!(sawSensitive || touchedHeaders || secureMiddlewareImplied)) return;
+
+      if (secureMiddlewareImplied) return; // assume middleware sets all headers
+
+      const missing = [];
+      if (!hasCC) missing.push("Cache-Control");
+      if (!hasPragma) missing.push("Pragma");
+      if (!hasExpires) missing.push("Expires");
+
+      if (missing.length) {
+        violations.push({
+          ruleId: this.ruleId,
+          message: `Handler missing anti-cache headers: ${missing.join(
+            ", "
+          )} (${routeType})`,
+          severity: "warning",
+          line: routeStartLine,
+          column: 1,
+        });
+      } else if (hasCC) {
+        const lower = ccRaw.toLowerCase();
+        const missingDir = this.requiredDirectives.filter(
+          (d) => !lower.includes(d)
+        );
+        if (missingDir.length) {
+          violations.push({
+            ruleId: this.ruleId,
+            message: `Cache-Control missing directives: ${missingDir.join(
+              ", "
+            )} (${routeType})`,
+            severity: "warning",
+            line: routeStartLine,
+            column: 1,
+          });
+        }
+      }
+    };
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+
+      // Detect route start for different frameworks
+      if (!inRoute) {
+        for (const [framework, pattern] of Object.entries(this.routePatterns)) {
+          if (pattern.test(line)) {
+            if (process.env.SUNLINT_DEBUG)
+              console.log(
+                `🔧 [S037-Regex] Found ${framework} route at line ${
+                  i + 1
+                }: ${line.trim()}`
+              );
+            inRoute = true;
+            routeStartLine = i + 1;
+            routeType = framework;
+            braceDepth =
+              (line.match(/\{/g) || []).length -
+              (line.match(/\}/g) || []).length;
+            secureMiddlewareImplied = /secureNoCache|noCache|antiCache/.test(
+              line
+            );
+            if (secureMiddlewareImplied && process.env.SUNLINT_DEBUG) {
+              console.log(
+                `🔧 [S037-Regex] Secure middleware detected, skipping evaluation`
+              );
+            }
+
+            // If no opening brace on this line, look ahead for it
+            if (braceDepth === 0) {
+              for (let j = i + 1; j < Math.min(i + 3, lines.length); j++) {
+                const nextLine = lines[j];
+                if (nextLine.includes("{")) {
+                  braceDepth =
+                    (nextLine.match(/\{/g) || []).length -
+                    (nextLine.match(/\}/g) || []).length;
+                  break;
+                }
+              }
+            }
+            break;
+          }
+        }
+        continue;
+      }
+
+      // Track braces for route scope
+      for (const ch of line) {
+        if (ch === "{") braceDepth++;
+        else if (ch === "}") braceDepth--;
+      }
+
+      // Check for sensitive indicators
+      if (this.sensitiveIndicators.test(line)) sawSensitive = true;
+
+      // Detect headers based on framework type
+      if (routeType === "express") {
+        // Check for start of bulk set
+        if (/res\.set\s*\(\s*\{/.test(line)) {
+          inBulkSet = true;
+          bulkSetContent = line;
+          if (process.env.SUNLINT_DEBUG)
+            console.log(`🔧 [S037-Regex] Starting bulk set detection`);
+        } else if (inBulkSet) {
+          bulkSetContent += line;
+          if (line.includes("}")) {
+            inBulkSet = false;
+            // Parse accumulated bulk set content
+            const cc =
+              /['"`]Cache-Control['"`]\s*:\s*['"`]([^'"`]+)['"`]/i.exec(
+                bulkSetContent
+              );
+            if (cc) {
+              hasCC = true;
+              ccRaw = cc[1];
+              if (process.env.SUNLINT_DEBUG)
+                console.log(
+                  `🔧 [S037-Regex] Found bulk Cache-Control: ${ccRaw}`
+                );
+            }
+            if (
+              /(['"`]?Pragma['"`]?)\s*:\s*['"`]no-cache['"`]/i.test(
+                bulkSetContent
+              )
+            ) {
+              hasPragma = true;
+              if (process.env.SUNLINT_DEBUG)
+                console.log(`🔧 [S037-Regex] Found bulk Pragma`);
+            }
+            if (
+              /(['"`]?Expires['"`]?)\s*:\s*['"`](0|Thu, 01 Jan 1970)/i.test(
+                bulkSetContent
+              )
+            ) {
+              hasExpires = true;
+              if (process.env.SUNLINT_DEBUG)
+                console.log(`🔧 [S037-Regex] Found bulk Expires`);
+            }
+            bulkSetContent = "";
+          }
+        }
+
+        // Express.js patterns
+        const bulk = this.bulkSetPattern.exec(line);
+        if (bulk) {
+          const body = bulk[1];
+          const cc = /['"`]Cache-Control['"`]\s*:\s*['"`]([^'"`]+)['"`]/i.exec(
+            body
+          );
+          if (cc) {
+            hasCC = true;
+            ccRaw = cc[1];
+          }
+          if (/['"`]Pragma['"`]\s*:\s*['"`]no-cache['"`]/i.test(body))
+            hasPragma = true;
+          if (/['"`]Expires['"`]\s*:\s*['"`](0|Thu, 01 Jan 1970)/i.test(body))
+            hasExpires = true;
+        }
+
+        const ccM = this.cacheControlPattern.exec(line);
+        if (ccM) {
+          hasCC = true;
+          ccRaw = ccM[2];
+          if (process.env.SUNLINT_DEBUG)
+            console.log(`🔧 [S037-Regex] Found Cache-Control: ${ccRaw}`);
+        }
+        if (this.pragmaPattern.test(line)) {
+          hasPragma = true;
+          if (process.env.SUNLINT_DEBUG)
+            console.log(`🔧 [S037-Regex] Found Pragma`);
+        }
+        if (this.expiresPattern.test(line)) {
+          hasExpires = true;
+          if (process.env.SUNLINT_DEBUG)
+            console.log(`🔧 [S037-Regex] Found Expires`);
+        }
+      } else if (routeType === "nestjs") {
+        // NestJS patterns - res.header()
+        const nestHeaderPattern =
+          /res\.header\s*\(\s*['"`]([^'"`]+)['"`]\s*,\s*['"`]([^'"`]+)['"`]/i;
+        const headerM = nestHeaderPattern.exec(line);
+        if (headerM) {
+          const [, headerName, headerValue] = headerM;
+          if (headerName.toLowerCase() === "cache-control") {
+            hasCC = true;
+            ccRaw = headerValue;
+            if (process.env.SUNLINT_DEBUG)
+              console.log(
+                `🔧 [S037-Regex] Found NestJS Cache-Control: ${ccRaw}`
+              );
+          } else if (
+            headerName.toLowerCase() === "pragma" &&
+            headerValue.toLowerCase() === "no-cache"
+          ) {
+            hasPragma = true;
+            if (process.env.SUNLINT_DEBUG)
+              console.log(`🔧 [S037-Regex] Found NestJS Pragma`);
+          } else if (
+            headerName.toLowerCase() === "expires" &&
+            (headerValue === "0" || headerValue.includes("1970"))
+          ) {
+            hasExpires = true;
+            if (process.env.SUNLINT_DEBUG)
+              console.log(`🔧 [S037-Regex] Found NestJS Expires`);
+          }
+        }
+      } else if (routeType === "nextjs" || routeType === "nextjsApp") {
+        // Next.js patterns - support both res.setHeader and response.headers.set
+        const headerM = this.nextHeaderPattern.exec(line);
+        if (headerM) {
+          const [, headerName, headerValue] = headerM;
+          if (headerName.toLowerCase() === "cache-control") {
+            hasCC = true;
+            ccRaw = headerValue;
+          } else if (
+            headerName.toLowerCase() === "pragma" &&
+            headerValue.toLowerCase() === "no-cache"
+          ) {
+            hasPragma = true;
+          } else if (
+            headerName.toLowerCase() === "expires" &&
+            (headerValue === "0" || headerValue.includes("1970"))
+          ) {
+            hasExpires = true;
+          }
+        }
+
+        const headersM = this.nextHeadersPattern.exec(line);
+        if (headersM) {
+          const [, headerName, headerValue] = headersM;
+          if (headerName.toLowerCase() === "cache-control") {
+            hasCC = true;
+            ccRaw = headerValue;
+            if (process.env.SUNLINT_DEBUG)
+              console.log(
+                `🔧 [S037-Regex] Found Next.js headers.set Cache-Control: ${ccRaw}`
+              );
+          } else if (
+            headerName.toLowerCase() === "pragma" &&
+            headerValue.toLowerCase() === "no-cache"
+          ) {
+            hasPragma = true;
+            if (process.env.SUNLINT_DEBUG)
+              console.log(`🔧 [S037-Regex] Found Next.js headers.set Pragma`);
+          } else if (
+            headerName.toLowerCase() === "expires" &&
+            (headerValue === "0" || headerValue.includes("1970"))
+          ) {
+            hasExpires = true;
+            if (process.env.SUNLINT_DEBUG)
+              console.log(`🔧 [S037-Regex] Found Next.js headers.set Expires`);
+          }
+        }
+      } else if (routeType === "nuxtjs") {
+        // Nuxt.js patterns - setHeader(event, name, value)
+        const nuxtHeaderPattern =
+          /setHeader\s*\(\s*event\s*,\s*['"`]([^'"`]+)['"`]\s*,\s*['"`]([^'"`]+)['"`]/i;
+        const nuxtHeaderM = nuxtHeaderPattern.exec(line);
+        if (nuxtHeaderM) {
+          const [, headerName, headerValue] = nuxtHeaderM;
+          if (headerName.toLowerCase() === "cache-control") {
+            hasCC = true;
+            ccRaw = headerValue;
+            if (process.env.SUNLINT_DEBUG)
+              console.log(
+                `🔧 [S037-Regex] Found Nuxt.js setHeader Cache-Control: ${ccRaw}`
+              );
+          } else if (
+            headerName.toLowerCase() === "pragma" &&
+            headerValue.toLowerCase() === "no-cache"
+          ) {
+            hasPragma = true;
+            if (process.env.SUNLINT_DEBUG)
+              console.log(`🔧 [S037-Regex] Found Nuxt.js setHeader Pragma`);
+          } else if (
+            headerName.toLowerCase() === "expires" &&
+            (headerValue === "0" || headerValue.includes("1970"))
+          ) {
+            hasExpires = true;
+            if (process.env.SUNLINT_DEBUG)
+              console.log(`🔧 [S037-Regex] Found Nuxt.js setHeader Expires`);
+          }
+        }
+
+        // Next.js response constructor with headers object
+        if (/headers:\s*\{/.test(line)) {
+          let j = i;
+          while (j < Math.min(i + 10, lines.length)) {
+            const headerLine = lines[j];
+            if (
+              /(['"`]?Cache-Control['"`]?)\s*:\s*['"`]([^'"`]+)['"`]/.test(
+                headerLine
+              )
+            ) {
+              hasCC = true;
+              ccRaw = RegExp.$2;
+              if (process.env.SUNLINT_DEBUG)
+                console.log(
+                  `🔧 [S037-Regex] Found Next.js constructor Cache-Control: ${ccRaw}`
+                );
+            }
+            if (
+              /(['"`]?Pragma['"`]?)\s*:\s*['"`]no-cache['"`]/.test(headerLine)
+            ) {
+              hasPragma = true;
+              if (process.env.SUNLINT_DEBUG)
+                console.log(`🔧 [S037-Regex] Found Next.js constructor Pragma`);
+            }
+            if (
+              /(['"`]?Expires['"`]?)\s*:\s*['"`](0|Thu.*1970)['"`]/.test(
+                headerLine
+              )
+            ) {
+              hasExpires = true;
+              if (process.env.SUNLINT_DEBUG)
+                console.log(
+                  `🔧 [S037-Regex] Found Next.js constructor Expires`
+                );
+            }
+            if (headerLine.includes("}")) break;
+            j++;
+          }
+        }
+      } else if (routeType === "nestjs") {
+        // NestJS patterns (similar to Express but with decorators)
+        if (/res\.header\s*\(\s*['"`]Cache-Control['"`]/.test(line))
+          hasCC = true;
+        if (/res\.header\s*\(\s*['"`]Pragma['"`]/.test(line)) hasPragma = true;
+        if (/res\.header\s*\(\s*['"`]Expires['"`]/.test(line))
+          hasExpires = true;
+      }
+
+      // End of route detection
+      if (
+        braceDepth <= 0 &&
+        (/\)\s*;?\s*$/.test(line) ||
+          /^\s*\}\s*$/.test(line) ||
+          /^export/.test(line))
+      ) {
+        if (process.env.SUNLINT_DEBUG) {
+          console.log(
+            `🔧 [S037-Regex] Route ended, evaluating: CC=${hasCC}, Pragma=${hasPragma}, Expires=${hasExpires}, Sensitive=${sawSensitive}`
+          );
+        }
+        evaluate();
+        reset();
+      }
+    }
+
+    // Safety evaluate if unbalanced at file end
+    if (inRoute) evaluate();
+
+    return violations;
+  }
+
+  cleanup() {}
+}
+
+module.exports = S037RegexBasedAnalyzer;