@weave_protocol/mund 0.1.0

package/src/analyzers/pii-detector.ts

@@ -0,0 +1,220 @@
+/**
+ * Mund - The Guardian Protocol
+ * PII Detector - Detects personally identifiable information
+ */
+
+import { 
+  type DetectionRule, 
+  type SecurityIssue, 
+  type IAnalyzer,
+  type IssueLocation 
+} from '../types.js';
+
+export class PIIDetector implements IAnalyzer {
+  name = 'PIIDetector';
+  type = 'pii';
+
+  async analyze(content: string, rules: DetectionRule[]): Promise<SecurityIssue[]> {
+    const issues: SecurityIssue[] = [];
+    const piiRules = rules.filter(r => r.type === 'pii' && r.enabled);
+
+    for (const rule of piiRules) {
+      if (!rule.pattern) continue;
+
+      try {
+        const regex = new RegExp(rule.pattern, 'g');
+        let match: RegExpExecArray | null;
+
+        while ((match = regex.exec(content)) !== null) {
+          const matchText = match[0];
+          
+          // Additional validation for specific types
+          if (!this.validateMatch(rule.id, matchText)) {
+            continue;
+          }
+
+          const location = this.getLocation(content, match.index, matchText.length);
+          
+          issues.push({
+            rule_id: rule.id,
+            rule_name: rule.name,
+            type: rule.type,
+            severity: rule.severity,
+            action: rule.action,
+            match: this.redactPII(rule.id, matchText),
+            location,
+            suggestion: this.getSuggestion(rule.id)
+          });
+        }
+      } catch (error) {
+        console.error(`Invalid regex pattern in rule ${rule.id}:`, error);
+      }
+    }
+
+    return issues;
+  }
+
+  /**
+   * Additional validation for matches to reduce false positives
+   */
+  private validateMatch(ruleId: string, match: string): boolean {
+    switch (ruleId) {
+      case 'ssn_us':
+        return this.validateSSN(match);
+      case 'credit_card':
+        return this.validateCreditCard(match);
+      case 'email_address':
+        return this.validateEmail(match);
+      case 'ip_address':
+        return this.validateIPAddress(match);
+      default:
+        return true;
+    }
+  }
+
+  /**
+   * Validate SSN format (basic validation, not checking if real)
+   */
+  private validateSSN(ssn: string): boolean {
+    const digits = ssn.replace(/\D/g, '');
+    if (digits.length !== 9) return false;
+    
+    // SSNs cannot start with 000, 666, or 900-999
+    const area = parseInt(digits.substring(0, 3));
+    if (area === 0 || area === 666 || area >= 900) return false;
+    
+    // Group number cannot be 00
+    const group = parseInt(digits.substring(3, 5));
+    if (group === 0) return false;
+    
+    // Serial number cannot be 0000
+    const serial = parseInt(digits.substring(5));
+    if (serial === 0) return false;
+    
+    return true;
+  }
+
+  /**
+   * Validate credit card using Luhn algorithm
+   */
+  private validateCreditCard(cc: string): boolean {
+    const digits = cc.replace(/\D/g, '');
+    if (digits.length < 13 || digits.length > 19) return false;
+
+    let sum = 0;
+    let isEven = false;
+
+    for (let i = digits.length - 1; i >= 0; i--) {
+      let digit = parseInt(digits[i]);
+
+      if (isEven) {
+        digit *= 2;
+        if (digit > 9) {
+          digit -= 9;
+        }
+      }
+
+      sum += digit;
+      isEven = !isEven;
+    }
+
+    return sum % 10 === 0;
+  }
+
+  /**
+   * Validate email address format
+   */
+  private validateEmail(email: string): boolean {
+    // Check for common false positives
+    const falsePaths = ['.js', '.ts', '.py', '.java', '.cpp', '.go', '.rs'];
+    if (falsePaths.some(ext => email.endsWith(ext))) return false;
+    
+    // Check for reasonable length
+    if (email.length > 254) return false;
+    
+    // Check for valid TLD (at least 2 chars)
+    const parts = email.split('.');
+    const tld = parts[parts.length - 1];
+    if (tld.length < 2) return false;
+    
+    return true;
+  }
+
+  /**
+   * Validate IP address (exclude obvious non-IPs)
+   */
+  private validateIPAddress(ip: string): boolean {
+    // Exclude version numbers (e.g., 1.2.3.4 in software versions)
+    const parts = ip.split('.');
+    
+    // All parts should be valid octets
+    for (const part of parts) {
+      const num = parseInt(part);
+      if (num < 0 || num > 255) return false;
+    }
+    
+    // Exclude common version patterns
+    if (parts[0] === '0' || parts[0] === '1') {
+      if (parseInt(parts[1]) <= 20 && parseInt(parts[2]) <= 20) {
+        return false; // Likely a version number
+      }
+    }
+    
+    // Exclude localhost and broadcast
+    if (ip === '127.0.0.1' || ip === '0.0.0.0' || ip === '255.255.255.255') {
+      return false;
+    }
+    
+    return true;
+  }
+
+  /**
+   * Calculate location within content
+   */
+  private getLocation(content: string, start: number, length: number): IssueLocation {
+    const end = start + length;
+    const lines = content.substring(0, start).split('\n');
+    const line = lines.length;
+    const column = lines[lines.length - 1].length + 1;
+    return { start, end, line, column };
+  }
+
+  /**
+   * Redact PII for safe display
+   */
+  private redactPII(ruleId: string, value: string): string {
+    switch (ruleId) {
+      case 'ssn_us':
+        return `***-**-${value.slice(-4)}`;
+      case 'credit_card':
+        return `****-****-****-${value.slice(-4)}`;
+      case 'email_address':
+        const [local, domain] = value.split('@');
+        return `${local.charAt(0)}***@${domain}`;
+      case 'phone_number_us':
+        return `***-***-${value.slice(-4)}`;
+      case 'ip_address':
+        const parts = value.split('.');
+        return `${parts[0]}.***.***.*${parts[3].slice(-1)}`;
+      default:
+        return value.substring(0, 3) + '***' + value.slice(-2);
+    }
+  }
+
+  /**
+   * Get remediation suggestion
+   */
+  private getSuggestion(ruleId: string): string {
+    const suggestions: Record<string, string> = {
+      ssn_us: 'Social Security Numbers should never be stored in plain text. Use encryption or tokenization.',
+      credit_card: 'Credit card numbers must be handled according to PCI DSS standards. Use tokenization.',
+      email_address: 'Consider whether email addresses need to be logged. Hash or encrypt if stored.',
+      phone_number_us: 'Phone numbers are PII. Consider whether they need to be included.',
+      ip_address: 'IP addresses can be PII under GDPR. Consider hashing or anonymizing.'
+    };
+
+    return suggestions[ruleId] || 'Review whether this PII needs to be included and handle according to privacy policies.';
+  }
+}
+
+export default PIIDetector;

package/src/analyzers/secret-scanner.ts

@@ -0,0 +1,142 @@
+/**
+ * Mund - The Guardian Protocol
+ * Secret Scanner - Detects secrets, API keys, and credentials
+ */
+
+import { 
+  type DetectionRule, 
+  type SecurityIssue, 
+  type IAnalyzer,
+  type IssueLocation 
+} from '../types.js';
+
+export class SecretScanner implements IAnalyzer {
+  name = 'SecretScanner';
+  type = 'secret';
+
+  async analyze(content: string, rules: DetectionRule[]): Promise<SecurityIssue[]> {
+    const issues: SecurityIssue[] = [];
+    const secretRules = rules.filter(r => r.type === 'secret' && r.enabled);
+
+    for (const rule of secretRules) {
+      if (!rule.pattern) continue;
+
+      try {
+        const regex = new RegExp(rule.pattern, 'g');
+        let match: RegExpExecArray | null;
+
+        while ((match = regex.exec(content)) !== null) {
+          const matchText = match[0];
+          const location = this.getLocation(content, match.index, matchText.length);
+          
+          issues.push({
+            rule_id: rule.id,
+            rule_name: rule.name,
+            type: rule.type,
+            severity: rule.severity,
+            action: rule.action,
+            match: this.redactSecret(matchText),
+            location,
+            suggestion: this.getSuggestion(rule.id)
+          });
+        }
+      } catch (error) {
+        // Invalid regex pattern - skip this rule
+        console.error(`Invalid regex pattern in rule ${rule.id}:`, error);
+      }
+    }
+
+    return issues;
+  }
+
+  /**
+   * Calculate the location of a match within the content
+   */
+  private getLocation(content: string, start: number, length: number): IssueLocation {
+    const end = start + length;
+    
+    // Calculate line and column
+    const lines = content.substring(0, start).split('\n');
+    const line = lines.length;
+    const column = lines[lines.length - 1].length + 1;
+
+    return { start, end, line, column };
+  }
+
+  /**
+   * Redact the middle portion of a secret for safe display
+   */
+  private redactSecret(secret: string): string {
+    if (secret.length <= 8) {
+      return '****';
+    }
+
+    const visibleStart = Math.min(4, Math.floor(secret.length * 0.2));
+    const visibleEnd = Math.min(4, Math.floor(secret.length * 0.2));
+    const redactedLength = secret.length - visibleStart - visibleEnd;
+
+    return `${secret.substring(0, visibleStart)}${'*'.repeat(Math.min(redactedLength, 20))}${secret.substring(secret.length - visibleEnd)}`;
+  }
+
+  /**
+   * Get remediation suggestion for a specific rule
+   */
+  private getSuggestion(ruleId: string): string {
+    const suggestions: Record<string, string> = {
+      aws_access_key_id: 'Use AWS IAM roles or environment variables instead of hardcoding credentials.',
+      aws_secret_access_key: 'Never commit AWS secret keys. Use AWS Secrets Manager or environment variables.',
+      github_token: 'Use GitHub Actions secrets or environment variables for tokens.',
+      github_fine_grained_token: 'Store GitHub tokens in a secrets manager, not in code.',
+      openai_api_key: 'Use environment variables (OPENAI_API_KEY) instead of hardcoding.',
+      anthropic_api_key: 'Use environment variables (ANTHROPIC_API_KEY) instead of hardcoding.',
+      google_api_key: 'Restrict API key usage in Google Cloud Console and use environment variables.',
+      slack_token: 'Store Slack tokens in environment variables or a secrets manager.',
+      slack_webhook: 'Webhook URLs should be stored in environment variables.',
+      stripe_api_key: 'Use environment variables. Never expose live keys in client-side code.',
+      private_key_block: 'Private keys should never be in code. Use a key management service.',
+      jwt_token: 'JWTs should be transmitted securely and never logged or stored in code.',
+      database_url: 'Database credentials should be in environment variables or a secrets manager.',
+      generic_api_key: 'API keys should be stored in environment variables or a secrets manager.',
+      generic_password: 'Passwords should never be hardcoded. Use a secrets manager.',
+    };
+
+    return suggestions[ruleId] || 'Remove this secret from code and use a secrets manager or environment variables.';
+  }
+
+  /**
+   * Calculate Shannon entropy of a string (higher = more random = more likely a secret)
+   */
+  static calculateEntropy(str: string): number {
+    const len = str.length;
+    if (len === 0) return 0;
+
+    const frequencies: Record<string, number> = {};
+    for (const char of str) {
+      frequencies[char] = (frequencies[char] || 0) + 1;
+    }
+
+    let entropy = 0;
+    for (const count of Object.values(frequencies)) {
+      const p = count / len;
+      entropy -= p * Math.log2(p);
+    }
+
+    return entropy;
+  }
+
+  /**
+   * Check if a string is likely a high-entropy secret
+   */
+  static isHighEntropy(str: string, threshold = 4.5): boolean {
+    // Skip strings that are too short or too long
+    if (str.length < 16 || str.length > 200) return false;
+    
+    // Skip if it looks like a common word or path
+    if (/^[a-z]+$/i.test(str)) return false;
+    if (str.includes('/') && !str.includes('://')) return false;
+    
+    return SecretScanner.calculateEntropy(str) > threshold;
+  }
+}
+
+export default SecretScanner;