@topy-ai/maggie 0.7.54 → 0.7.56

package/bundled-skills/maggie-security/data/LICENSE-NOTICE.md

@@ -0,0 +1,24 @@
+# Data notices
+
+Data packaged with Maggie Security and where it comes from. Files listed
+here ship under `tools/clis/security_data/` (bundled with the CLI) or this
+folder.
+
+| File | Source | Licence | Notes |
+|---|---|---|---|
+| `tools/clis/security_data/eol-snapshot.json` | endoflife.date `products/*.md` front matter | MIT, © endoflife.date contributors | offline fallback for `eol-watch` |
+| `tools/clis/security_data/retire-extractors.json` | RetireJS/retire.js `repository/jsrepository-v4.json` (extractors only) | Apache-2.0 | detects JavaScript libraries copied into a site |
+| `tools/clis/security_data/gitleaks-rules.json` | gitleaks `config/gitleaks.toml` (222 rules, converted by `scripts/security/build_gitleaks_rules.py`) | MIT, © 2019 Zachary Rice | native secrets engine when the gitleaks binary is not installed |
+| `tools/clis/security_data/tools.lock.json` | Maggie | — | pinned scanner versions and checksums |
+| `tools/clis/security_data/public-suffix-icann.txt` | Public Suffix List (ICANN section, exact rules) via stamparm/maltrail's extract | MPL-2.0, Mozilla Foundation | finds the registrable domain an ownership record covers |
+| `tools/clis/security_data/maltrail-lists.json` | stamparm/maltrail `data/mass_scanner.txt`, `mass_scanner_cidr.txt`, `ua.txt` (commit ef1c67f) | MIT, © 2014-present Maltrail developers | scanner and suspicious user-agent lists for `logs-ioc`; `trails.csv.gz` is not used |
+| `tools/clis/security_data/sigma-web.json` | SigmaHQ/sigma web, proxy and emerging-threat webserver rules (commit 05d1031), built by `scripts/security/build_sigma_pack.py` | Detection Rule License 1.1; author and references kept per rule | `logs-sigma`; every finding carries the rule's title, author, id and licence |
+| `data/semgrep/` | Maggie | MIT | 22 rules written for Maggie, with tests |
+| `data/asvs-map.json` | Maggie | MIT | which commands positively check which ASVS 5.0 requirement; ASVS text itself is read from OWASP at run time (CC BY-SA 4.0) |
+| `data/fail2ban/filter.d/maggie-wordpress.conf` | Maggie | MIT | WordPress login/xmlrpc filter, checked against fail2ban-regex |
+| `registry/security-tools.registry.json` | Maggie | — | MCP/tool registry |
+
+Feeds read at run time (not packaged): OSV (per-source licences, mostly
+CC-BY-4.0 and Apache-2.0), CISA KEV (CC0-1.0), FIRST EPSS (free use with
+attribution), CVE List (CVE Terms of Use), Node.js security-wg (MIT),
+WPVulnerability (free API), endoflife.date API (MIT).

package/bundled-skills/maggie-security/data/asvs-map.json

@@ -0,0 +1,209 @@
+{
+ "schema": "maggie-security-asvs-map.v1",
+ "standard": "OWASP ASVS 5.0.0",
+ "licence": "MIT (Maggie's mapping; ASVS text is read from OWASP at run time)",
+ "note": "coverage = the requirements a command positively checks; silence from a command that does not check a requirement is never a pass (PRD 09 section 7.2).",
+ "coverage": {
+  "headers": [
+   "V3.4.1",
+   "V3.4.2",
+   "V3.4.3",
+   "V3.4.4",
+   "V3.4.5",
+   "V3.4.6",
+   "V3.3.1",
+   "V3.3.2",
+   "V3.3.4",
+   "V12.2.1",
+   "V13.4.6"
+  ],
+  "tls": [
+   "V3.4.1",
+   "V12.1.1",
+   "V12.1.2",
+   "V12.2.1",
+   "V12.2.2"
+  ],
+  "web-scan": [
+   "V3.4.2",
+   "V13.4.1",
+   "V13.4.2",
+   "V13.4.3",
+   "V13.4.4",
+   "V13.4.5",
+   "V13.4.7",
+   "V16.5.1"
+  ],
+  "host-nginx-config": [
+   "V13.4.1",
+   "V13.4.2",
+   "V13.4.3",
+   "V13.4.6",
+   "V12.1.1",
+   "V12.1.2",
+   "V12.2.1",
+   "V5.3.2"
+  ],
+  "secrets": [
+   "V13.3.1"
+  ],
+  "deps": [
+   "V15.2.1"
+  ],
+  "vuln-watch": [
+   "V15.2.1"
+  ],
+  "wp-check": [
+   "V15.2.1"
+  ],
+  "eol-watch": [
+   "V15.2.1"
+  ],
+  "node-check": [
+   "V15.2.1"
+  ],
+  "code-scan": [
+   "V1.2.1",
+   "V1.2.4",
+   "V1.2.5",
+   "V1.3.2",
+   "V1.3.6",
+   "V1.5.2",
+   "V3.2.2",
+   "V3.7.2",
+   "V5.3.2",
+   "V8.2.1",
+   "V9.1.1",
+   "V11.5.1",
+   "V13.3.1"
+  ],
+  "uptime-status": [
+   "V12.2.2"
+  ]
+ },
+ "profiles": {
+  "static": {
+   "chapters": [
+    "V3",
+    "V12",
+    "V13",
+    "V15"
+   ],
+   "exclude_sections": [
+    "V3.5",
+    "V3.7"
+   ]
+  },
+  "wordpress": {
+   "chapters": [
+    "V1",
+    "V2",
+    "V3",
+    "V5",
+    "V6",
+    "V7",
+    "V8",
+    "V12",
+    "V13",
+    "V15",
+    "V16"
+   ],
+   "exclude_sections": []
+  },
+  "node-app": {
+   "chapters": [
+    "V1",
+    "V2",
+    "V3",
+    "V4",
+    "V5",
+    "V6",
+    "V7",
+    "V8",
+    "V9",
+    "V11",
+    "V12",
+    "V13",
+    "V15",
+    "V16"
+   ],
+   "exclude_sections": []
+  },
+  "php-app": {
+   "chapters": [
+    "V1",
+    "V2",
+    "V3",
+    "V5",
+    "V6",
+    "V7",
+    "V8",
+    "V9",
+    "V11",
+    "V12",
+    "V13",
+    "V15",
+    "V16"
+   ],
+   "exclude_sections": []
+  },
+  "python-app": {
+   "chapters": [
+    "V1",
+    "V2",
+    "V3",
+    "V4",
+    "V5",
+    "V6",
+    "V7",
+    "V8",
+    "V9",
+    "V11",
+    "V12",
+    "V13",
+    "V15",
+    "V16"
+   ],
+   "exclude_sections": []
+  },
+  "java-app": {
+   "chapters": [
+    "V1",
+    "V2",
+    "V3",
+    "V4",
+    "V5",
+    "V6",
+    "V7",
+    "V8",
+    "V9",
+    "V11",
+    "V12",
+    "V13",
+    "V15",
+    "V16"
+   ],
+   "exclude_sections": []
+  },
+  "workers": {
+   "chapters": [
+    "V1",
+    "V3",
+    "V12",
+    "V13",
+    "V15"
+   ],
+   "exclude_sections": []
+  },
+  "astro": {
+   "chapters": [
+    "V1",
+    "V3",
+    "V12",
+    "V13",
+    "V15"
+   ],
+   "exclude_sections": []
+  }
+ }
+}

package/bundled-skills/maggie-security/data/fail2ban/filter.d/maggie-wordpress.conf

@@ -0,0 +1,6 @@
+# Maggie WordPress login/xmlrpc brute-force filter (MIT, written for Maggie)
+[Definition]
+failregex = ^<HOST> -[^"]*"POST /(?:[^"/]*/)*wp-login\.php HTTP/[0-9.]+" (?:200|302|403)
+            ^<HOST> -[^"]*"POST /(?:[^"/]*/)*xmlrpc\.php HTTP/[0-9.]+" (?:200|403|405)
+ignoreregex =
+datepattern = {^LN-BEG}%%d/%%b/%%Y:%%H:%%M:%%S

package/bundled-skills/maggie-security/data/semgrep/LICENSE-NOTICE.md

@@ -0,0 +1,5 @@
+# Maggie semgrep rule pack
+
+Rules written for Maggie (MIT). None is copied from the semgrep registry or
+another rule set. Run only with `maggie security code-scan`, which passes
+`--metrics=off` and never fetches registry rules.

package/bundled-skills/maggie-security/data/semgrep/VERSION

@@ -0,0 +1 @@
+1.0.0

package/bundled-skills/maggie-security/data/semgrep/rules/dockerfile.yaml

@@ -0,0 +1,14 @@
+rules:
+  - id: maggie.docker.secret-in-build-arg
+    languages: [dockerfile]
+    severity: ERROR
+    message: A secret-looking build argument or environment variable has a default value baked into the image. Pass it at run time instead.
+    pattern-either:
+      - patterns:
+          - pattern: 'ARG $NAME=$VALUE'
+          - metavariable-regex:
+              metavariable: $NAME
+              regex: (?i).*(token|secret|password|passwd|api_?key|private_?key).*
+      - pattern-regex: (?im)^\s*ENV\s+\w*(token|secret|password|passwd|api_?key|private_?key)\w*(=|\s+)\S+
+    metadata: {maggie_id: docker-secret-in-build-arg, cwe: ["CWE-798"], asvs: ["V13.3.1"], confidence: high,
+               fix_doc: "https://docs.docker.com/build/building/secrets/"}

package/bundled-skills/maggie-security/data/semgrep/rules/generic.yaml

@@ -0,0 +1,26 @@
+rules:
+  - id: maggie.astro.set-html-untrusted
+    languages: [generic]
+    paths: {include: ["*.astro"]}
+    severity: ERROR
+    message: set:html renders HTML from a variable. Sanitize it (DOMPurify, sanitize-html, a markdown renderer that escapes HTML) or use text.
+    patterns:
+      - pattern-regex: 'set:html=\{(?!\s*(?:["''`][^"''`{}]*["''`]|DOMPurify\.sanitize\(|sanitizeHtml\(|renderMarkdown\())[^}]+\}'
+    metadata: {maggie_id: astro-set-html-untrusted, cwe: ["CWE-79"], asvs: ["V1.2.1", "V3.2.2"], confidence: high,
+               fix_doc: "https://docs.astro.build/en/reference/directives-reference/#sethtml"}
+  - id: maggie.nginx.autoindex-on
+    languages: [generic]
+    paths: {include: ["*.conf", "nginx.conf*", "*.nginx"]}
+    severity: WARNING
+    message: Directory listing is on (autoindex on); visitors can browse folders.
+    pattern-regex: '(?m)^\s*autoindex\s+on\s*;'
+    metadata: {maggie_id: nginx-autoindex-on, cwe: ["CWE-548"], asvs: ["V13.4.3"], confidence: high,
+               fix_doc: "https://nginx.org/en/docs/http/ngx_http_autoindex_module.html"}
+  - id: maggie.nginx.server-tokens-on
+    languages: [generic]
+    paths: {include: ["*.conf", "nginx.conf*", "*.nginx"]}
+    severity: INFO
+    message: nginx shows its version in error pages and headers (server_tokens on).
+    pattern-regex: '(?m)^\s*server_tokens\s+on\s*;'
+    metadata: {maggie_id: nginx-server-tokens-on, cwe: ["CWE-200"], asvs: ["V13.4.6"], confidence: high,
+               fix_doc: "https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens"}

package/bundled-skills/maggie-security/data/semgrep/rules/js.yaml

@@ -0,0 +1,216 @@
+rules:
+  - id: maggie.react.dangerously-set-inner-html
+    languages: [javascript, typescript]
+    severity: ERROR
+    message: dangerouslySetInnerHTML renders HTML from a variable. Sanitize it first (DOMPurify.sanitize, sanitizeHtml) or render text.
+    patterns:
+      - pattern: '<$EL dangerouslySetInnerHTML={{__html: $X}} />'
+      - pattern-not: '<$EL dangerouslySetInnerHTML={{__html: "..."}} />'
+      - pattern-not: '<$EL dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(...)}} />'
+      - pattern-not: '<$EL dangerouslySetInnerHTML={{__html: sanitizeHtml(...)}} />'
+      - pattern-not: '<$EL dangerouslySetInnerHTML={{__html: renderMarkdown(...)}} />'
+    metadata: {maggie_id: react-dangerously-set-inner-html, cwe: ["CWE-79"], asvs: ["V1.2.1", "V3.2.2"], confidence: high,
+               fix_doc: "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"}
+  - id: maggie.js.eval
+    languages: [javascript, typescript]
+    severity: ERROR
+    message: Code is built from a string at run time (eval, new Function or a string timer). Use a function instead.
+    pattern-either:
+      - pattern: 'eval($X)'
+      - pattern: 'new Function(...)'
+      - patterns:
+          - pattern-either:
+              - pattern: 'setTimeout($S, ...)'
+              - pattern: 'setInterval($S, ...)'
+          - metavariable-pattern:
+              metavariable: $S
+              patterns:
+                - pattern-either:
+                    - pattern: '"..."'
+                    - pattern: '`...`'
+                    - pattern: '"..." + $Y'
+    metadata: {maggie_id: js-eval, cwe: ["CWE-95"], asvs: ["V1.3.2"], confidence: high,
+               fix_doc: "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_direct_eval!"}
+  - id: maggie.js.ssrf-fetch-user-url
+    languages: [javascript, typescript]
+    severity: ERROR
+    message: A server-side request goes to a URL taken from the request. Check it against an allowlist of hosts first.
+    mode: taint
+    pattern-sources:
+      - pattern-either:
+          - pattern: '$REQ.query'
+          - pattern: '$REQ.body'
+          - pattern: '$REQ.params'
+          - pattern: '$URL.searchParams.get(...)'
+          - pattern: 'await $REQ.json()'
+          - pattern: 'await $REQ.formData()'
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: 'fetch($SINK, ...)'
+              - pattern: 'axios.get($SINK, ...)'
+              - pattern: 'axios.post($SINK, ...)'
+              - pattern: 'axios($SINK, ...)'
+              - pattern: 'got($SINK, ...)'
+              - pattern: 'request($SINK, ...)'
+          - focus-metavariable: $SINK
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: '$ALLOW.includes(...)'
+          - pattern: '$ALLOW.has(...)'
+          - pattern: 'isAllowedUrl(...)'
+          - pattern: 'assertAllowedUrl(...)'
+    metadata: {maggie_id: js-ssrf-fetch-user-url, cwe: ["CWE-918"], asvs: ["V1.3.6"], confidence: medium,
+               fix_doc: "https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html"}
+  - id: maggie.js.open-redirect
+    languages: [javascript, typescript]
+    severity: WARNING
+    message: A redirect target comes from the request. Allow only same-site paths or a list of known URLs.
+    mode: taint
+    pattern-sources:
+      - pattern-either:
+          - pattern: '$REQ.query'
+          - pattern: '$REQ.body'
+          - pattern: '$URL.searchParams.get(...)'
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: 'Astro.redirect($T, ...)'
+              - pattern: 'Response.redirect($T, ...)'
+              - pattern: 'NextResponse.redirect($T, ...)'
+              - pattern: '$RES.redirect($T, ...)'
+              - pattern: 'redirect($T, ...)'
+          - focus-metavariable: $T
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: 'safeRedirect(...)'
+          - pattern: '$ALLOW.includes(...)'
+          - pattern: '$X.startsWith("/")'
+    metadata: {maggie_id: js-open-redirect, cwe: ["CWE-601"], asvs: ["V3.7.2"], confidence: medium,
+               fix_doc: "https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html"}
+  - id: maggie.js.insecure-cookie
+    languages: [javascript, typescript]
+    severity: WARNING
+    message: A session or auth cookie is set without httpOnly, secure and sameSite.
+    patterns:
+      - pattern-either:
+          - pattern: '$C.set($NAME, $V, $OPTS)'
+          - pattern: '$RES.cookie($NAME, $V, $OPTS)'
+      - metavariable-regex:
+          metavariable: $NAME
+          regex: (?i).*(sess|auth|token|login|sid|jwt|remember).*
+      - metavariable-pattern:
+          metavariable: $OPTS
+          patterns:
+            - pattern: '{...}'
+            - pattern-not: '{..., httpOnly: true, ..., secure: true, ..., sameSite: $S, ...}'
+            - pattern-not: '{..., secure: true, ..., httpOnly: true, ..., sameSite: $S, ...}'
+            - pattern-not: '{..., sameSite: $S, ..., httpOnly: true, ..., secure: true, ...}'
+            - pattern-not: '{..., httpOnly: true, ..., sameSite: $S, ..., secure: true, ...}'
+            - pattern-not: '{..., secure: true, ..., sameSite: $S, ..., httpOnly: true, ...}'
+            - pattern-not: '{..., sameSite: $S, ..., secure: true, ..., httpOnly: true, ...}'
+    metadata: {maggie_id: js-insecure-cookie, cwe: ["CWE-614", "CWE-1004"], asvs: ["V3.3.1", "V3.3.2"], confidence: high,
+               fix_doc: "https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security"}
+  - id: maggie.js.jwt-none-or-unverified
+    languages: [javascript, typescript]
+    severity: ERROR
+    message: The token is decoded without checking its signature, or the 'none' algorithm is allowed. Use jwt.verify with an explicit algorithm list.
+    pattern-either:
+      - pattern: 'jwt.decode(...)'
+      - pattern: |
+          jwt.verify($T, $K, {..., algorithms: [..., "none", ...], ...})
+    metadata: {maggie_id: js-jwt-none-or-unverified, cwe: ["CWE-347"], asvs: ["V9.1.1"], confidence: medium,
+               fix_doc: "https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html"}
+  - id: maggie.js.child-process-user-input
+    languages: [javascript, typescript]
+    severity: ERROR
+    message: A shell command is built from request data. Pass arguments as an array without a shell, and validate them.
+    mode: taint
+    pattern-sources:
+      - pattern-either:
+          - pattern: '$REQ.query'
+          - pattern: '$REQ.body'
+          - pattern: '$REQ.params'
+          - pattern: '$URL.searchParams.get(...)'
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: 'exec($CMD, ...)'
+              - pattern: 'execSync($CMD, ...)'
+              - pattern: 'child_process.exec($CMD, ...)'
+              - pattern: 'child_process.execSync($CMD, ...)'
+              - pattern: 'spawn($CMD, $ARGS, {..., shell: true, ...})'
+          - focus-metavariable: $CMD
+    metadata: {maggie_id: js-child-process-user-input, cwe: ["CWE-78"], asvs: ["V1.2.5"], confidence: high,
+               fix_doc: "https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html"}
+  - id: maggie.js.path-traversal
+    languages: [javascript, typescript]
+    severity: ERROR
+    message: A file path comes from the request. Resolve it and check it stays inside the allowed folder.
+    mode: taint
+    pattern-sources:
+      - pattern-either:
+          - pattern: '$REQ.query'
+          - pattern: '$REQ.params'
+          - pattern: '$REQ.body'
+          - pattern: '$URL.searchParams.get(...)'
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: 'fs.readFile($P, ...)'
+              - pattern: 'fs.readFileSync($P, ...)'
+              - pattern: 'fs.createReadStream($P, ...)'
+              - pattern: 'readFile($P, ...)'
+              - pattern: 'fs.promises.readFile($P, ...)'
+          - focus-metavariable: $P
+    pattern-sanitizers:
+      - pattern: 'safeJoin(...)'
+      - pattern: 'path.basename(...)'
+    metadata: {maggie_id: js-path-traversal, cwe: ["CWE-22"], asvs: ["V5.3.2"], confidence: high,
+               fix_doc: "https://owasp.org/www-community/attacks/Path_Traversal"}
+  - id: maggie.js.cors-wildcard-credentials
+    languages: [javascript, typescript]
+    severity: WARNING
+    message: CORS allows any origin together with credentials, or echoes the Origin header without checking it.
+    pattern-either:
+      - patterns:
+          - pattern-inside: |
+              $H.set("Access-Control-Allow-Credentials", "true");
+              ...
+          - pattern: '$H.set("Access-Control-Allow-Origin", $REQ.headers.get("origin"))'
+      - pattern: |
+          {..., origin: true, ..., credentials: true, ...}
+      - pattern: |
+          {..., origin: "*", ..., credentials: true, ...}
+    metadata: {maggie_id: js-cors-wildcard-credentials, cwe: ["CWE-942"], asvs: ["V3.4.2"], confidence: medium,
+               fix_doc: "https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS"}
+  - id: maggie.js.secret-in-client-env
+    languages: [javascript, typescript]
+    severity: ERROR
+    message: A public build variable is named like a secret; anything with this prefix is sent to every visitor's browser.
+    patterns:
+      - pattern-either:
+          - pattern: 'import.meta.env.$NAME'
+          - pattern: 'process.env.$NAME'
+      - metavariable-regex:
+          metavariable: $NAME
+          regex: ^(PUBLIC|NEXT_PUBLIC|VITE|NUXT_PUBLIC|REACT_APP|EXPO_PUBLIC)_\w*(SECRET|PRIVATE|SERVICE_ROLE|TOKEN|PASSWORD|API_KEY)\w*$
+      - metavariable-regex:
+          metavariable: $NAME
+          regex: ^(?!.*(PUBLISHABLE|SITE_KEY|ANON_KEY)).*$
+    metadata: {maggie_id: js-secret-in-client-env, cwe: ["CWE-200"], asvs: ["V13.3.1"], confidence: high,
+               fix_doc: "https://docs.astro.build/en/guides/environment-variables/"}
+  - id: maggie.js.math-random-token
+    languages: [javascript, typescript]
+    severity: WARNING
+    message: Math.random() is not secure for tokens. Use crypto.randomUUID() or crypto.getRandomValues().
+    patterns:
+      - pattern-either:
+          - pattern: 'const $V = <... Math.random() ...>;'
+          - pattern: 'let $V = <... Math.random() ...>;'
+          - pattern: '$OBJ.$V = <... Math.random() ...>;'
+      - metavariable-regex:
+          metavariable: $V
+          regex: (?i).*(token|secret|otp|nonce|password|session|key|code).*
+    metadata: {maggie_id: js-math-random-token, cwe: ["CWE-338"], asvs: ["V11.5.1"], confidence: high,
+               fix_doc: "https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues"}

package/bundled-skills/maggie-security/data/semgrep/rules/php-debug-ok.yaml

@@ -0,0 +1,17 @@
+rules:
+  - id: maggie.php.debug-on
+    languages: [php]
+    severity: WARNING
+    message: WordPress debug output is on in committed config; errors will be shown to visitors.
+    patterns:
+      - pattern: 'define(''WP_DEBUG'', true);'
+      - pattern-not-inside: |
+          define('WP_DEBUG', true);
+          ...
+          define('WP_DEBUG_DISPLAY', false);
+      - pattern-not-inside: |
+          define('WP_DEBUG_DISPLAY', false);
+          ...
+          define('WP_DEBUG', true);
+    metadata: {maggie_id: php-debug-on, cwe: ["CWE-489"], asvs: ["V13.4.2"], confidence: high,
+               fix_doc: "https://developer.wordpress.org/advanced-administration/debug/debug-wordpress/"}

package/bundled-skills/maggie-security/data/semgrep/rules/php-debug.yaml

@@ -0,0 +1,17 @@
+rules:
+  - id: maggie.php.debug-on
+    languages: [php]
+    severity: WARNING
+    message: WordPress debug output is on in committed config; errors will be shown to visitors.
+    patterns:
+      - pattern: 'define(''WP_DEBUG'', true);'
+      - pattern-not-inside: |
+          define('WP_DEBUG', true);
+          ...
+          define('WP_DEBUG_DISPLAY', false);
+      - pattern-not-inside: |
+          define('WP_DEBUG_DISPLAY', false);
+          ...
+          define('WP_DEBUG', true);
+    metadata: {maggie_id: php-debug-on, cwe: ["CWE-489"], asvs: ["V13.4.2"], confidence: high,
+               fix_doc: "https://developer.wordpress.org/advanced-administration/debug/debug-wordpress/"}

package/bundled-skills/maggie-security/data/semgrep/rules/php.yaml

@@ -0,0 +1,101 @@
+rules:
+  - id: maggie.php.sql-concat
+    languages: [php]
+    severity: ERROR
+    message: SQL is built by joining strings with a variable. Use $wpdb->prepare() or a prepared statement.
+    patterns:
+      - pattern-either:
+          - pattern: '$DB->query($Q)'
+          - pattern: '$DB->get_results($Q, ...)'
+          - pattern: '$DB->get_row($Q, ...)'
+          - pattern: '$DB->get_var($Q, ...)'
+          - pattern: '$DB->get_col($Q, ...)'
+          - pattern: 'mysqli_query($C, $Q, ...)'
+      - metavariable-pattern:
+          metavariable: $Q
+          patterns:
+            - pattern-either:
+                - pattern: '"..." . $X'
+                - pattern: '$X . "..."'
+                - pattern: '"...$X..."'
+            - pattern-not: '$DB->prepare(...)'
+    metadata: {maggie_id: php-sql-concat, cwe: ["CWE-89"], asvs: ["V1.2.4"], confidence: high,
+               fix_doc: "https://developer.wordpress.org/reference/classes/wpdb/prepare/"}
+  - id: maggie.php.unescaped-output
+    languages: [php]
+    severity: ERROR
+    message: Request data is printed without escaping. Wrap it in esc_html(), esc_attr(), esc_url() or wp_kses().
+    patterns:
+      - pattern-either:
+          - pattern: 'echo <... $_GET[...] ...>;'
+          - pattern: 'echo <... $_POST[...] ...>;'
+          - pattern: 'echo <... $_REQUEST[...] ...>;'
+          - pattern: 'echo <... $_COOKIE[...] ...>;'
+          - pattern: 'echo <... get_query_var(...) ...>;'
+          - pattern: 'print <... $_GET[...] ...>;'
+      - pattern-not: 'echo <... esc_html(...) ...>;'
+      - pattern-not: 'echo <... esc_attr(...) ...>;'
+      - pattern-not: 'echo <... esc_url(...) ...>;'
+      - pattern-not: 'echo <... wp_kses(...) ...>;'
+      - pattern-not: 'echo <... htmlspecialchars(...) ...>;'
+      - pattern-not: 'echo <... intval(...) ...>;'
+      - pattern-not: 'echo <... absint(...) ...>;'
+    metadata: {maggie_id: php-unescaped-output, cwe: ["CWE-79"], asvs: ["V1.2.1", "V3.2.2"], confidence: high,
+               fix_doc: "https://developer.wordpress.org/apis/security/escaping/"}
+  - id: maggie.php.missing-nonce
+    languages: [php]
+    severity: WARNING
+    message: An AJAX/admin-post handler reads $_POST without checking a nonce (check_ajax_referer or wp_verify_nonce).
+    patterns:
+      - pattern-inside: |
+          function $F(...) { ... }
+      - pattern: '$_POST[...]'
+      - pattern-not-inside: |
+          function $F(...) { ... check_ajax_referer(...); ... }
+      - pattern-not-inside: |
+          function $F(...) { ... wp_verify_nonce(...); ... }
+      - pattern-not-inside: |
+          function $F(...) { ... check_admin_referer(...); ... }
+      - pattern-not-inside: |
+          function $F(...) { ... if (<... wp_verify_nonce(...) ...>) { ... } ... }
+    metadata: {maggie_id: php-missing-nonce, cwe: ["CWE-352"], asvs: ["V3.5.1"], confidence: medium,
+               fix_doc: "https://developer.wordpress.org/apis/security/nonces/"}
+  - id: maggie.php.missing-capability
+    languages: [php]
+    severity: ERROR
+    message: A REST route that changes data lets anyone call it (permission_callback __return_true).
+    pattern-either:
+      - pattern: |
+          register_rest_route($NS, $R, [..., 'methods' => $M, ..., 'permission_callback' => '__return_true', ...]);
+      - pattern: |
+          register_rest_route($NS, $R, array(..., 'methods' => $M, ..., 'permission_callback' => '__return_true', ...));
+    metadata: {maggie_id: php-missing-capability, cwe: ["CWE-862"], asvs: ["V8.2.1"], confidence: medium,
+               fix_doc: "https://developer.wordpress.org/rest-api/extending-the-rest-api/adding-custom-endpoints/#permissions-callback"}
+  - id: maggie.php.file-include-user
+    languages: [php]
+    severity: ERROR
+    message: A file is included from a path that comes from the request.
+    pattern-either:
+      - pattern: 'include <... $_GET[...] ...>;'
+      - pattern: 'include <... $_POST[...] ...>;'
+      - pattern: 'include <... $_REQUEST[...] ...>;'
+      - pattern: 'include_once <... $_GET[...] ...>;'
+      - pattern: 'require <... $_GET[...] ...>;'
+      - pattern: 'require_once <... $_GET[...] ...>;'
+      - pattern: 'require_once <... $_REQUEST[...] ...>;'
+    metadata: {maggie_id: php-file-include-user, cwe: ["CWE-98"], asvs: ["V5.3.2"], confidence: high,
+               fix_doc: "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion"}
+  - id: maggie.php.unserialize-user
+    languages: [php]
+    severity: ERROR
+    message: Request data is unserialized. Use json_decode() instead.
+    pattern-either:
+      - pattern: 'unserialize(<... $_GET[...] ...>, ...)'
+      - pattern: 'unserialize(<... $_POST[...] ...>, ...)'
+      - pattern: 'unserialize(<... $_COOKIE[...] ...>, ...)'
+      - pattern: 'unserialize(<... $_REQUEST[...] ...>, ...)'
+      - pattern: 'maybe_unserialize(<... $_POST[...] ...>)'
+      - pattern: 'maybe_unserialize(<... $_GET[...] ...>)'
+      - pattern: 'maybe_unserialize(<... $_COOKIE[...] ...>)'
+    metadata: {maggie_id: php-unserialize-user, cwe: ["CWE-502"], asvs: ["V1.5.2"], confidence: high,
+               fix_doc: "https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html"}

package/bundled-skills/maggie-security/data/semgrep/tests/dockerfile.dockerfile

@@ -0,0 +1,10 @@
+FROM node:20-alpine
+# ruleid: maggie.docker.secret-in-build-arg
+ARG NPM_TOKEN=abc123
+# ok: maggie.docker.secret-in-build-arg
+ARG NODE_ENV=production
+# ruleid: maggie.docker.secret-in-build-arg
+ENV DB_PASSWORD=hunter2hunter2
+# ok: maggie.docker.secret-in-build-arg
+ARG SENTRY_TOKEN
+USER node

package/bundled-skills/maggie-security/data/semgrep/tests/generic.astro

@@ -0,0 +1,11 @@
+---
+const { post } = Astro.props;
+---
+<!-- ruleid: maggie.astro.set-html-untrusted -->
+<article set:html={post.body} />
+<!-- ok: maggie.astro.set-html-untrusted -->
+<p set:html={"<b>static</b>"} />
+<!-- ok: maggie.astro.set-html-untrusted -->
+<div set:html={DOMPurify.sanitize(post.body)} />
+<!-- ruleid: maggie.astro.set-html-untrusted -->
+<div set:html={post.excerpt + "..."} />