@zhuma4/cli 4.0.0-alpha.1

package/rules/android/mobile-cwe-939-deeplink-validation.yaml

@@ -0,0 +1,76 @@
+# CWE-939: Deeplink Without Input Validation (Android)
+# ZhuMa V4.0 - Android Rule Library
+# Source: V3 Audit Engine extension - deeplink injection patterns
+
+rules:
+  - id: zm-android-deeplink-no-validation
+    severity: HIGH
+    message: |
+      Detected Intent data retrieved via getIntent().getData() used directly without host/path validation.
+      Arbitrary deeplinks can trigger unintended actions, access internal screens, or inject malicious parameters.
+      Remediation: Validate the URI scheme, host, and path against a whitelist before processing deeplink data.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $DATA.getQueryParameter($PARAM)
+          - pattern: $DATA.getPath()
+          - pattern: $URI.getHost()
+    metadata:
+      cwe: "CWE-939: Improper Authorization in Handler for Custom URL Scheme"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-deeplink
+      precision: medium
+      confidence: medium
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/939.html
+        - https://developer.android.com/privacy-and-security/risks/deeplinks
+
+  - id: zm-android-webview-loadurl-from-intent
+    severity: HIGH
+    message: |
+      Detected WebView.loadUrl() receiving a URL derived from Intent data (getIntent().getData() or getStringExtra()).
+      Without URL whitelist validation, an attacker can send a malicious deeplink to load a phishing page or
+      execute javascript: URLs in the WebView context.
+      Remediation: Validate the URL against a strict whitelist of allowed domains and schemes before loading.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: $WV.loadUrl(getIntent().getData().toString())
+          - pattern: $WV.loadUrl(getIntent().getDataString())
+          - pattern: $WV.loadUrl(getIntent().getStringExtra($KEY))
+    metadata:
+      cwe: "CWE-939: Improper Authorization in Handler for Custom URL Scheme"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-deeplink
+      precision: high
+      confidence: high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/939.html
+
+  - id: zm-android-intent-data-no-scheme-check
+    severity: MEDIUM
+    message: |
+      Detected Intent.getData() used without scheme validation in an Activity or receiver.
+      Any app on the device can send an Intent with arbitrary data to this component.
+      Remediation: Add scheme validation (Uri.getScheme()) and verify against allowed schemes before processing.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: getIntent().getData()
+    metadata:
+      cwe: "CWE-939: Improper Authorization in Handler for Custom URL Scheme"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-deeplink
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/939.html

package/rules/android/mobile-sdk-google-firebase-open.yaml

@@ -0,0 +1,117 @@
+# Firebase / Firestore Security Misconfiguration (Android)
+# ZhuMa V4.0 - Android Rule Library
+# Source: ZhuMa V4.1 Rule Expansion - third-party SDK security
+
+rules:
+  - id: zm-android-firebase-firestore-open-rules
+    severity: HIGH
+    message: |
+      Detected Firebase Firestore or Realtime Database usage without explicit authentication check.
+      Firebase databases with default security rules allow unauthenticated read/write access,
+      which can lead to mass data exfiltration or data tampering from the client side.
+      Remediation: Set Firebase security rules to require authentication. Never use 
+      allow read, write: if true; in production. Always enforce user-level access controls.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: FirebaseFirestore.getInstance()
+          - pattern: FirebaseDatabase.getInstance()
+          - pattern: $INSTANCE = FirebaseFirestore.getInstance()
+          - pattern: $INSTANCE = FirebaseDatabase.getInstance()
+          - pattern: com.google.firebase.firestore.FirebaseFirestore.getInstance()
+          - pattern: com.google.firebase.database.FirebaseDatabase.getInstance()
+    metadata:
+      cwe: "CWE-284: Improper Access Control"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-AUTH-1"
+      category: android-sdk-config
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/284.html
+        - https://firebase.google.com/docs/rules/basics
+
+  - id: zm-android-firebase-realtime-db-write
+    severity: MEDIUM
+    message: |
+      Detected Firebase Realtime Database getReference() with a write path.
+      Writing to Firebase Realtime Database from the client without server-side validation 
+      allows an attacker to inject arbitrary data by modifying the client.
+      Remediation: Validate all write operations against Firebase Security Rules 
+      with server-side validation (Firebase Functions or custom backend).
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $DB.getReference("$PATH").setValue($VAL)
+          - pattern: |
+              $DB.getReference("$PATH").updateChildren($MAP)
+          - pattern: |
+              $DB.getReference("$PATH").push().setValue($VAL)
+    metadata:
+      cwe: "CWE-284: Improper Access Control"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-AUTH-1"
+      category: android-sdk-config
+      precision: medium
+      confidence: medium
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/284.html
+
+  - id: zm-android-firestore-add-without-auth
+    severity: MEDIUM
+    message: |
+      Detected Firestore add/set/update without visible authentication guard.
+      Client-side Firestore writes without Firebase Auth or custom auth can be called 
+      by an unauthenticated attacker who extracts the Firebase config from the APK.
+      Remediation: Ensure Firebase Auth is enforced and all Firestore operations are 
+      authenticated. Use Firestore Security Rules with request.auth != null.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $DB.collection("$COL").add($DATA)
+          - pattern: |
+              $DB.collection("$COL").document("$DOC").set($DATA)
+          - pattern: |
+              $DB.collection("$COL").document("$DOC").update($DATA)
+    metadata:
+      cwe: "CWE-284: Improper Access Control"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-AUTH-1"
+      category: android-sdk-config
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/284.html
+
+  - id: zm-android-firebase-analytics-no-restriction
+    severity: INFO
+    message: |
+      Detected Firebase Analytics initialization. While Analytics is generally safe, 
+      ensure that PII (personally identifiable information) is not sent as event parameters 
+      or user properties per Google's policy restrictions.
+      Remediation: Review Firebase Analytics event params for PII. Use setUserProperty() 
+      only with non-PII values. Avoid logging emails, phone numbers, or full names.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: FirebaseAnalytics.getInstance($CTX)
+          - pattern: com.google.firebase.analytics.FirebaseAnalytics.getInstance($CTX)
+    metadata:
+      cwe: "CWE-359: Exposure of Private Personal Information to an Unauthorized Actor"
+      owasp-mobile: "M2: Insecure Data Storage"
+      masvs: "MASVS-STORAGE-4"
+      category: android-sdk-config
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/359.html

package/rules/android/mobile-sdk-tencent-tpns-config-leak.yaml

@@ -0,0 +1,131 @@
+# Push Notification SDK Credential Exposure (Tencent TPNS, Huawei Push, Xiaomi Push)
+# ZhuMa V4.0 - Android Rule Library
+# Source: ZhuMa V4.1 Rule Expansion - third-party SDK credential management
+
+rules:
+  - id: zm-android-tpns-xg-push-credentials
+    severity: MEDIUM
+    message: |
+      Detected Tencent TPNS (Xinge Push) SDK initialization with hardcoded Access ID and Access Key.
+      These credentials grant push message sending capability. If extracted from the APK,
+      an attacker can send arbitrary push notifications to all app users.
+      Remediation: Store TPNS credentials on the server side and use server-side push APIs.
+      Never embed push service credentials in the client APK.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: XGPushConfig.setAccessId($CTX, $ID)
+          - pattern: XGPushConfig.setAccessKey($CTX, "$KEY")
+          - pattern: com.tencent.android.tpush.XGPushConfig.setAccessId($CTX, $ID)
+          - pattern: com.tencent.android.tpush.XGPushConfig.setAccessKey($CTX, "$KEY")
+    metadata:
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-AUTH-1"
+      category: android-sdk-config
+      precision: very-high
+      confidence: very-high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/798.html
+        - https://cloud.tencent.com/document/product/548
+
+  - id: zm-android-huawei-push-credentials
+    severity: MEDIUM
+    message: |
+      Detected Huawei Push SDK initialization with hardcoded App ID / App Secret.
+      Huawei Push credentials allow sending push messages to all devices with the app installed.
+      Extracting these from the APK enables mass phishing push notifications.
+      Remediation: Store Huawei Push App Secret on the server. Only embed the App ID client-side.
+      Use server-side token generation for push message sending.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: HmsMessageService.$METHOD("$APP_ID", "$SECRET")
+          - pattern: com.huawei.hms.push.$METHOD("$APP_ID")
+    metadata:
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-AUTH-1"
+      category: android-sdk-config
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/798.html
+
+  - id: zm-android-xiaomi-mipush-regid
+    severity: LOW
+    message: |
+      Detected Xiaomi MiPush SDK registration pattern. MiPush App Secret should not be embedded 
+      in the client APK but managed server-side. Client should only use App ID for registration.
+      Remediation: Verify the MiPush App Secret is not hardcoded in the APK. 
+      Use server-side push delivery to avoid client credential exposure.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: MiPushClient.registerPush($CTX, "$APP_ID", "$APP_KEY")
+          - pattern: com.xiaomi.mipush.sdk.MiPushClient.registerPush($CTX, "$APP_ID", "$APP_KEY")
+    metadata:
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-AUTH-1"
+      category: android-sdk-config
+      precision: high
+      confidence: high
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/798.html
+
+  - id: zm-android-jpush-credentials
+    severity: MEDIUM
+    message: |
+      Detected JPush (Aurora Push) SDK initialization. JPush AppKey is included in the client 
+      and can be extracted. Combined with Master Secret (which should never be client-side),
+      attackers can send arbitrary push messages.
+      Remediation: Ensure JPush Master Secret is stored only on the server side.
+      Verify push message delivery is authenticated server-to-server, not client-triggered.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: JPushInterface.setDebugMode(true)
+          - pattern: JPushInterface.init($CTX)
+          - pattern: cn.jpush.android.api.JPushInterface.init($CTX)
+    metadata:
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-AUTH-1"
+      category: android-sdk-config
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/798.html
+
+  - id: zm-android-umeng-push-credentials
+    severity: LOW
+    message: |
+      Detected Umeng Push SDK initialization. The Umeng AppKey and Message Secret should be 
+      carefully managed. If Umeng Message Secret is embedded client-side, it allows 
+      unauthorized push message sending via the Umeng API.
+      Remediation: Verify Umeng push message sending is authorized server-side only.
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: PushAgent.getInstance($CTX).register($PUSH_HANDLER)
+          - pattern: com.umeng.message.PushAgent.getInstance($CTX).register($PUSH_HANDLER)
+    metadata:
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp-mobile: "M8: Code Tampering"
+      masvs: "MASVS-AUTH-1"
+      category: android-sdk-config
+      precision: low
+      confidence: low
+      source: "ZhuMa V4.1 Rule Expansion"
+      references:
+        - https://cwe.mitre.org/data/definitions/798.html

package/rules/android/mobile-secrets-storage.yaml

@@ -0,0 +1,136 @@
+rules:
+  - id: zm-android-hardcoded-apikey
+    severity: CRITICAL
+    message: Hardcoded API key or token. API keys embedded in source code are exposed to anyone who can decompile the APK (jadx/apktool make this trivial). Place all secrets in a server-side proxy or use Android Keystore.
+    metadata:
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp-mobile: "M8: Security Misconfiguration"
+      category: android-secrets
+      precision: medium
+    languages: [java]
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $TYPE $VAR = "$SECRET";
+              ...
+          - pattern: |
+              public static final String $KEY = "$VALUE";
+      - metavariable-regex:
+          metavariable: $VALUE
+          regex: '^(AKID|AKIA|LTAI|sk-[a-zA-Z0-9]{20,}|AIzaSy|ya29\.[a-zA-Z0-9_-]{50,}|pk\.[a-zA-Z0-9]{30,}|sk\.[a-zA-Z0-9]{30,}|ghp_[a-zA-Z0-9]{36}|gho_[a-zA-Z0-9]{36}|xox[bprs]-[a-zA-Z0-9-]{10,}|[a-zA-Z0-9+/]{40,})'
+    paths:
+      include:
+        - "*.java"
+
+  - id: zm-android-hardcoded-secret-keyword
+    severity: WARNING
+    message: Variable name suggests a secret is hardcoded. Keywords like 'password', 'secret', 'api_key', 'token' in string literals indicate credentials that should be in Android Keystore or server-side.
+    metadata:
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp-mobile: "M8: Security Misconfiguration"
+      category: android-secrets
+      precision: low
+    languages: [java]
+    patterns:
+      - pattern-either:
+          - pattern: |
+              private static final String $PASS = "$VALUE";
+          - pattern: |
+              public static final String $PASS = "$VALUE";
+          - pattern: |
+              static final String $PASS = "$VALUE";
+      - metavariable-regex:
+          metavariable: $PASS
+          regex: '(?i)(password|passwd|secret|api_key|api_secret|apikey|app_secret|token|auth_key|access_key|private_key)'
+
+  - id: zm-android-insecure-shared-prefs
+    severity: HIGH
+    message: SharedPreferences with MODE_WORLD_READABLE or MODE_WORLD_WRITEABLE. On API 17+ these are deprecated, but if used on older APIs or via reflection, they make stored data accessible to any app on the device.
+    metadata:
+      cwe: "CWE-276: Incorrect Default Permissions"
+      owasp-mobile: "M2: Insecure Data Storage"
+      masvs: "MASVS-STORAGE-1"
+      category: android-storage
+      precision: high
+      confidence: high
+    languages: [java]
+    patterns:
+      - pattern-either:
+          - pattern: $CTX.getSharedPreferences($NAME, Context.MODE_WORLD_READABLE)
+          - pattern: $CTX.getSharedPreferences($NAME, Context.MODE_WORLD_WRITEABLE)
+          - pattern: $CTX.getSharedPreferences($NAME, 1)
+          - pattern: $CTX.getSharedPreferences($NAME, 2)
+
+  - id: zm-android-insecure-file-permission
+    severity: HIGH
+    message: Files created with world-readable/writable permissions. Sensitive data written to globally accessible files can be read or modified by any app.
+    metadata:
+      cwe: "CWE-276: Incorrect Default Permissions"
+      owasp-mobile: "M2: Insecure Data Storage"
+      category: android-storage
+      precision: high
+      confidence: high
+    languages: [java]
+    patterns:
+      - pattern-either:
+          - pattern: openFileOutput($NAME, Context.MODE_WORLD_READABLE)
+          - pattern: openFileOutput($NAME, Context.MODE_WORLD_WRITEABLE)
+          - pattern: openFileOutput($NAME, 1)
+          - pattern: openFileOutput($NAME, 2)
+
+  - id: zm-android-external-storage-sensitive
+    severity: MEDIUM
+    message: Sensitive data written to external storage. Files on external storage (/sdcard, getExternalFilesDir) are readable by any app with READ_EXTERNAL_STORAGE permission and physically accessible via USB.
+    metadata:
+      cwe: "CWE-200: Exposure of Sensitive Information"
+      owasp-mobile: "M2: Insecure Data Storage"
+      masvs: "MASVS-STORAGE-1"
+      category: android-storage
+      precision: low
+    languages: [java]
+    patterns:
+      - pattern-either:
+          - pattern: Environment.getExternalStorageDirectory()
+          - pattern: $CTX.getExternalFilesDir($TYPE)
+
+  - id: zm-android-sqlite-raw-injection
+    severity: CRITICAL
+    message: Raw SQL query with string concatenation. Unsanitized user input in rawQuery or execSQL enables SQL injection, allowing attackers to read/write any row in the local SQLite database.
+    metadata:
+      cwe: "CWE-89: SQL Injection"
+      owasp-mobile: "M7: Client Code Quality"
+      category: android-data
+      precision: medium
+      confidence: medium
+    languages: [java]
+    patterns:
+      - pattern-either:
+          - pattern: $DB.rawQuery("..." + $INPUT, ...)
+          - pattern: $DB.rawQuery($QUERY + $INPUT, ...)
+          - pattern: $DB.execSQL("..." + $INPUT)
+          - pattern: $DB.execSQL($QUERY + $INPUT)
+
+  - id: zm-android-log-sensitive
+    severity: MEDIUM
+    message: Sensitive data logged to Logcat. On Android, any app with READ_LOGS permission can read Logcat output. Use a logging library with automatic release-build stripping instead.
+    metadata:
+      cwe: "CWE-532: Insertion of Sensitive Information into Log File"
+      owasp-mobile: "M2: Insecure Data Storage"
+      masvs: "MASVS-STORAGE-3"
+      category: android-data
+      precision: low
+    languages: [java]
+    patterns:
+      - pattern-either:
+          - pattern: |
+              Log.d($TAG, $MSG + $VAR)
+          - pattern: |
+              Log.e($TAG, $MSG + $VAR)
+          - pattern: |
+              Log.i($TAG, $MSG + $VAR)
+          - pattern: |
+              Log.v($TAG, $MSG + $VAR)
+          - pattern: |
+              Log.w($TAG, $MSG + $VAR)
+          - pattern: |
+              android.util.Log.d($TAG, $MSG + $VAR)

package/rules/android/mobile-webview-security.yaml

@@ -0,0 +1,88 @@
+rules:
+  - id: zm-android-webview-js-enabled
+    severity: WARNING
+    message: WebView JavaScript enabled without protection. Enabling JavaScript without disabling file access and implementing SSL error handling exposes the app to XSS, token theft, and MitM attacks.
+    metadata:
+      cwe: "CWE-749: Exposed Dangerous Method or Function"
+      owasp-mobile: "M1: Improper Platform Usage"
+      masvs: "MASVS-PLATFORM-2"
+      category: android-webview
+      precision: medium
+      confidence: medium
+      likelihood: high
+      impact: high
+    languages: [java]
+    patterns:
+      - pattern-either:
+          - pattern: $WV.getSettings().setJavaScriptEnabled(true)
+          - pattern: $WV.getSettings().setJavaScriptEnabled($X)
+      - pattern-not-inside: |
+          ...
+          $WV.getSettings().setAllowFileAccess(false);
+          ...
+          $WV.getSettings().setJavaScriptEnabled(...);
+          ...
+
+  - id: zm-android-webview-file-access
+    severity: WARNING
+    message: WebView file access enabled. Combined with JavaScript, this allows an attacker to read local files via file:// URLs.
+    metadata:
+      cwe: "CWE-200: Exposure of Sensitive Information"
+      owasp-mobile: "M1: Improper Platform Usage"
+      category: android-webview
+      precision: low
+    languages: [java]
+    pattern: $WV.getSettings().setAllowFileAccess(true)
+
+  - id: zm-android-webview-ssl-bypass
+    severity: CRITICAL
+    message: WebView SSL error handler accepts all certificates. This silently enables man-in-the-middle attacks on all HTTPS traffic loaded in this WebView.
+    metadata:
+      cwe: "CWE-295: Improper Certificate Validation"
+      owasp-mobile: "M3: Insecure Communication"
+      masvs: "MASVS-NETWORK-1"
+      category: android-webview
+      precision: high
+      confidence: high
+    languages: [java]
+    patterns:
+      - pattern-either:
+          - pattern: |
+              new WebViewClient() {
+                ...
+                public void onReceivedSslError(WebView $W, SslErrorHandler $H, SslError $E) {
+                  $H.proceed();
+                }
+                ...
+              }
+          - pattern: |
+              $WV.setWebViewClient(new WebViewClient() {
+                ...
+                public void onReceivedSslError(..., SslErrorHandler $H, ...) {
+                  $H.proceed();
+                }
+                ...
+              })
+
+  - id: zm-android-webview-allow-content-access
+    severity: HIGH
+    message: WebView content URL access enabled. Allows the WebView to access content:// URIs from other apps, enabling cross-app data leakage.
+    metadata:
+      cwe: "CWE-200: Exposure of Sensitive Information"
+      owasp-mobile: "M1: Improper Platform Usage"
+      category: android-webview
+      precision: medium
+    languages: [java]
+    pattern: $WV.getSettings().setAllowContentAccess(true)
+
+  - id: zm-android-webview-allow-universal-access-from-file
+    severity: CRITICAL
+    message: Universal access from file URLs enabled. Allows JavaScript loaded from file:// URLs to access any origin via XMLHttpRequest, bypassing all same-origin protections.
+    metadata:
+      cwe: "CWE-200: Exposure of Sensitive Information"
+      owasp-mobile: "M1: Improper Platform Usage"
+      category: android-webview
+      precision: high
+      confidence: high
+    languages: [java]
+    pattern: $WV.getSettings().setAllowUniversalAccessFromFileURLs(true)

package/rules/common/cwe-200-sensitive-data-exposure.yaml

@@ -0,0 +1,61 @@
+# CWE-200: 敏感数据暴露检测规则
+# 逐码 ZhuMa V4.0 Alpha — 通用规则库
+
+rules:
+
+# ZM-JAVA-SDE-001: 日志输出密码/Token 变量
+- id: zm-java-sde-001
+  severity: HIGH
+  message: |
+    检测到日志中可能输出敏感变量 (password / token / secret / apiKey)。
+    敏感数据不应出现在日志中，可能导致信息泄露。
+    应在日志中脱敏或移除敏感字段。
+  languages:
+    - java
+  pattern-either:
+    - pattern: |
+        $LOGGER.info($PWD);
+    - pattern: |
+        $LOGGER.debug($PWD);
+    - pattern: |
+        $LOGGER.error($PWD);
+    - pattern: |
+        $LOGGER.warn($PWD);
+    - pattern: |
+        System.out.println($PWD);
+  metadata:
+    cwe: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+    owasp: "A04:2021 - Insecure Design"
+    precision: very-low
+
+# ZM-JAVA-SDE-002: toString 暴露敏感字段
+- id: zm-java-sde-002
+  severity: MEDIUM
+  message: |
+    toString() 方法中包含 password/token 等敏感字段输出。
+    应在 toString 中排除或脱敏敏感字段。
+  languages:
+    - java
+  pattern-either:
+    - pattern: |
+        return "..." + $PWD + "...";
+  metadata:
+    cwe: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+    owasp: "A04:2021 - Insecure Design"
+    precision: very-low
+
+# ZM-JAVA-SDE-003: printStackTrace 泄漏堆栈
+- id: zm-java-sde-003
+  severity: LOW
+  message: |
+    检测到异常堆栈直接输出到标准输出/错误流。
+    生产环境应将异常记录到日志框架，避免向用户暴露内部实现细节。
+  languages:
+    - java
+  pattern-either:
+    - pattern: |
+        $E.printStackTrace();
+  metadata:
+    cwe: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+    owasp: "A04:2021 - Insecure Design"
+    precision: very-high

package/rules/common/cwe-22-path-traversal.yaml

@@ -0,0 +1,47 @@
+# CWE-22: 路径遍历检测规则
+# 逐码 ZhuMa V4.0 Alpha — 通用规则库
+
+rules:
+
+# ZM-JAVA-PT-001: File 构造含用户输入 + 无 validateFilename
+- id: zm-java-pt-001
+  severity: HIGH
+  message: |
+    检测到使用用户输入构造文件路径，但未校验路径 (未调用 getCanonicalPath 或 contains("..") 检查)。
+    攻击者可注入 ../ 进行路径遍历访问任意文件。
+    应使用 Path.normalize() + 检查路径前缀是否在允许目录内。
+  languages:
+    - java
+  pattern-either:
+    - pattern: |
+        new FileInputStream($BASE + $PARAM);
+    - pattern: |
+        new FileReader($BASE + $PARAM);
+    - pattern: |
+        new File($BASE + $PARAM);
+    - pattern: |
+        Files.readAllBytes(Paths.get($BASE + $PARAM));
+    - pattern: |
+        Files.newInputStream(Paths.get($BASE + $PARAM));
+  metadata:
+    cwe: "CWE-22: Path Traversal"
+    owasp: "A01:2021 - Broken Access Control"
+    precision: medium
+
+# ZM-JAVA-PT-002: 直接使用用户输入作为文件路径
+- id: zm-java-pt-002
+  severity: MEDIUM
+  message: |
+    直接使用用户输入作为文件路径参数，存在路径遍历风险。
+    应对输入进行白名单校验或规范化路径后验证前缀。
+  languages:
+    - java
+  pattern-either:
+    - pattern: |
+        new FileInputStream($REQ.getParameter(...));
+    - pattern: |
+        new FileReader($REQ.getParameter(...));
+  metadata:
+    cwe: "CWE-22: Path Traversal"
+    owasp: "A01:2021 - Broken Access Control"
+    precision: high