avorelo 0.1.0

package/scripts/lib/security-scan.js

@@ -0,0 +1,384 @@
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+const BIDI_CHARS = ["\u202A", "\u202B", "\u202D", "\u202E", "\u202C", "\u2066", "\u2067", "\u2068", "\u2069"];
+
+function detectRiskyBash(cmd) {
+  const c = String(cmd || "").toLowerCase();
+  if (/(curl|wget).*(\||&&|;)\s*(bash|sh)/i.test(c) || /(curl|wget)\s+\S+\s*\|\s*(bash|sh)/i.test(c)) {
+    return { code: "SEC_CURL_PIPE_SH", severity: "high", message: "Blocked: piping remote script into shell is high risk." };
+  }
+  if (/rm\s+-rf\s+\/(\s|$)/i.test(c) || /^rm\s+-rf\s+\/$/i.test(c)) {
+    return { code: "SEC_RM_RF_ROOT", severity: "high", message: "Blocked: destructive rm -rf / pattern." };
+  }
+  if (/chmod\s+777/i.test(c)) {
+    return { code: "SEC_CHMOD_777", severity: "medium", message: "Warning: chmod 777 is often unsafe. Consider least privilege." };
+  }
+  return null;
+}
+
+function sourceTypeForPath(pathHint) {
+  const p = String(pathHint || "").replace(/\\/g, "/");
+  if (p.startsWith("skills/")) return "skill";
+  if (p.startsWith("agents/")) return "agent";
+  if (p.startsWith("hooks/")) return "hook";
+  if (p.startsWith("scripts/")) return "script";
+  return "config";
+}
+
+function clamp(value, min, max) {
+  return Math.max(min, Math.min(max, value));
+}
+
+function isLikelyCommentLine(line) {
+  return /^\s*(#|\/\/|\/\*|\*|<!--)/.test(String(line || ""));
+}
+
+function hasPinnedGitRef(line) {
+  return /#[0-9a-f]{40}\b/i.test(String(line || ""));
+}
+
+function withVerificationRationale(message, verifyHint) {
+  return `${message}. Verify: ${verifyHint}`;
+}
+
+function mkFinding(id, severity, file, line, snippet, confidence, rationale) {
+  return {
+    id,
+    severity,
+    file,
+    line,
+    snippet,
+    confidence: clamp(Number.isFinite(Number(confidence)) ? Number(confidence) : 0.5, 0.05, 1),
+    rationale,
+    sourceType: sourceTypeForPath(file),
+    trustLevel: "unknown",
+    remediationState: "detected",
+    suppressed: false,
+    suppressedBy: null,
+  };
+}
+
+function pathMatches(pathHint, pattern) {
+  if (!pattern) return false;
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`, "i").test(pathHint.replace(/\\/g, "/"));
+}
+
+function applyAllowlist(findings, allowlist = { reasonCodes: [], pathPatterns: [] }) {
+  return findings.map((f) => {
+    const byCode = (allowlist.reasonCodes || []).find((c) => c === f.id);
+    if (byCode) {
+      return {
+        ...f,
+        suppressed: true,
+        suppressedBy: { type: "reasonCode", value: byCode },
+        rationale: `${f.rationale}; suppressed by allowlist reason code`,
+      };
+    }
+
+    const byPath = (allowlist.pathPatterns || []).find((p) => pathMatches(f.file || "", p));
+    if (byPath) {
+      return {
+        ...f,
+        suppressed: true,
+        suppressedBy: { type: "pathPattern", value: byPath },
+        rationale: `${f.rationale}; suppressed by allowlist path pattern`,
+      };
+    }
+
+    return f;
+  });
+}
+
+function toHighlights(findings) {
+  return findings.slice(0, 10).map((f) => ({
+    id: f.id,
+    severity: f.severity,
+    confidence: f.confidence,
+    path: f.file,
+    line: f.line,
+    snippet: f.snippet,
+    rationale: f.rationale,
+    sourceType: f.sourceType,
+    trustLevel: f.trustLevel,
+    remediationState: f.remediationState,
+    suppressed: f.suppressed,
+    suppressedBy: f.suppressedBy,
+  }));
+}
+
+function suppressionAuditFromFindings(findings) {
+  return findings
+    .filter((f) => f.suppressed)
+    .map((f) => ({
+      findingId: f.id,
+      file: f.file,
+      line: f.line,
+      source: f.suppressedBy,
+      rationale: f.rationale,
+    }));
+}
+
+function weightedRiskScore(activeFindings) {
+  if (!activeFindings.length) return 0;
+
+  const severityPoints = { high: 55, medium: 30, low: 15 };
+  let score = activeFindings.reduce((sum, f) => {
+    const base = severityPoints[f.severity] || severityPoints.low;
+    const confidence = clamp(Number(f.confidence || 0.5), 0.1, 1);
+    return sum + base * confidence;
+  }, 0);
+
+  if (activeFindings.some((f) => f.severity === "high")) score += 15;
+
+  const uniqueReasons = new Set(activeFindings.map((f) => f.id)).size;
+  if (uniqueReasons >= 3) score += 8;
+
+  if (activeFindings.some((f) => ["SEC_PRIVATE_KEY", "SEC_CURL_PIPE_SH"].includes(f.id))) {
+    score = Math.max(score, 90);
+  }
+
+  return Math.min(98, Math.round(score));
+}
+
+function scanTextForSecurity({ text, pathHint, allowlist }) {
+  const lines = String(text || "").split("\n");
+  let findings = [];
+
+  lines.forEach((ln, idx) => {
+    const n = idx + 1;
+    const lower = String(ln || "").toLowerCase();
+    const snip = String(ln || "").trim().slice(0, 160);
+    const commentLine = isLikelyCommentLine(ln);
+
+    if (lower.includes("eval(") || lower.includes("new function(")) {
+      const confidence = commentLine ? 0.55 : 0.95;
+      const severity = commentLine ? "medium" : "high";
+      findings.push(
+        mkFinding(
+          "SEC_EVAL",
+          severity,
+          pathHint,
+          n,
+          snip,
+          confidence,
+          withVerificationRationale("Dynamic code execution pattern", "confirm whether untrusted input can reach this call")
+        )
+      );
+    }
+
+    if (/(curl|wget).*(\||&&|;)\s*(bash|sh)/i.test(ln)) {
+      findings.push(
+        mkFinding(
+          "SEC_CURL_PIPE_SH",
+          "high",
+          pathHint,
+          n,
+          snip,
+          commentLine ? 0.62 : 0.99,
+          withVerificationRationale("Remote script piped into shell", "replace with downloaded and checksum-verified local script")
+        )
+      );
+    }
+
+    const hasRemoteFetch =
+      /(fetch|axios(\.(get|post|request))?|invoke-webrequest|invoke-restmethod|curl|wget)\s*\(?\s*["']?https?:\/\//i.test(ln) ||
+      /(curl|wget)\s+https?:\/\//i.test(ln);
+    if (hasRemoteFetch) {
+      findings.push(
+        mkFinding(
+          "SEC_REMOTE_FETCH",
+          "medium",
+          pathHint,
+          n,
+          snip,
+          commentLine ? 0.45 : 0.78,
+          withVerificationRationale("Remote fetch pattern detected", "ensure source is trusted, pinned, and checksum-verified")
+        )
+      );
+    }
+
+    const hasRemoteInclude =
+      /(source|include|require|import)\s+.*https?:\/\//i.test(ln) || /(from\s+["']https?:\/\/)/i.test(ln);
+    if (hasRemoteInclude) {
+      findings.push(
+        mkFinding(
+          "SEC_REMOTE_INCLUDE",
+          commentLine ? "medium" : "high",
+          pathHint,
+          n,
+          snip,
+          commentLine ? 0.52 : 0.9,
+          withVerificationRationale("Remote include/import pattern", "vendor locally or pin immutable artifact reference")
+        )
+      );
+    }
+
+    const hasGitDep = /git\+https?:\/\//i.test(ln) || /github\.com\/.+\/(main|master)\.zip/i.test(ln);
+    const movingRef = /#(main|master|head|latest)\b/i.test(ln) || (!/#/.test(ln) && /git\+https?:\/\//i.test(ln));
+    if (hasGitDep && movingRef && !hasPinnedGitRef(ln)) {
+      findings.push(
+        mkFinding(
+          "SEC_UNPINNED_GIT_DEP",
+          "medium",
+          pathHint,
+          n,
+          snip,
+          commentLine ? 0.5 : 0.84,
+          withVerificationRationale("Unpinned git dependency pattern", "pin to immutable commit SHA")
+        )
+      );
+    }
+
+    if (/(permissions?|permission_budget)\s*:\s*(\*|all|full|write|network|shell)\b/i.test(ln)) {
+      findings.push(
+        mkFinding(
+          "SEC_OVERBROAD_PERMISSION",
+          "medium",
+          pathHint,
+          n,
+          snip,
+          commentLine ? 0.5 : 0.82,
+          withVerificationRationale("Overbroad permission budget pattern", "narrow to least privilege needed for this task")
+        )
+      );
+    }
+
+    if (ln.includes("BEGIN PRIVATE KEY")) {
+      findings.push(
+        mkFinding(
+          "SEC_PRIVATE_KEY",
+          "high",
+          pathHint,
+          n,
+          "BEGIN PRIVATE KEY",
+          0.99,
+          withVerificationRationale("Private key material detected", "remove key material and rotate affected credentials")
+        )
+      );
+    }
+
+    if (BIDI_CHARS.some((ch) => ln.includes(ch))) {
+      findings.push(
+        mkFinding(
+          "SEC_BIDI_UNICODE",
+          "medium",
+          pathHint,
+          n,
+          snip,
+          0.88,
+          withVerificationRationale("Bidirectional Unicode control character", "inspect hidden characters and normalize text")
+        )
+      );
+    }
+
+    if (/ghp_[A-Za-z0-9]{20,}/.test(ln)) {
+      findings.push(
+        mkFinding(
+          "SEC_GH_TOKEN",
+          "high",
+          pathHint,
+          n,
+          "Possible GitHub token pattern",
+          0.92,
+          withVerificationRationale("Likely GitHub token", "remove token and rotate immediately")
+        )
+      );
+    }
+  });
+
+  findings = applyAllowlist(findings, allowlist);
+  const activeFindings = findings.filter((f) => !f.suppressed);
+
+  const reasonCounts = {};
+  activeFindings.forEach((f) => {
+    reasonCounts[f.id] = (reasonCounts[f.id] || 0) + 1;
+  });
+
+  const topReasons = Object.keys(reasonCounts)
+    .sort((a, b) => {
+      if (reasonCounts[b] !== reasonCounts[a]) return reasonCounts[b] - reasonCounts[a];
+      return a.localeCompare(b);
+    })
+    .slice(0, 3);
+
+  const riskScore = weightedRiskScore(activeFindings);
+
+  return {
+    riskScore,
+    topReasons,
+    highlights: toHighlights(findings),
+    findingsCount: findings.length,
+    activeFindingsCount: activeFindings.length,
+    suppressionAudit: suppressionAuditFromFindings(findings),
+  };
+}
+
+function runBaselineSecurityScan({ cwd, allowlist }) {
+  const targets = [".claude-plugin/plugin.json", "hooks/hooks.json"];
+  const skillRoot = path.join(cwd, "skills");
+  if (fs.existsSync(skillRoot)) targets.push("skills");
+  const agentRoot = path.join(cwd, "agents");
+  if (fs.existsSync(agentRoot)) targets.push("agents");
+  const scriptsRoot = path.join(cwd, "scripts");
+  if (fs.existsSync(scriptsRoot)) targets.push("scripts");
+
+  let findings = [];
+
+  function scanFile(rel) {
+    const abs = path.join(cwd, rel);
+    try {
+      const txt = fs.readFileSync(abs, "utf8");
+      const rep = scanTextForSecurity({ text: txt, pathHint: rel.replace(/\\/g, "/"), allowlist });
+      rep.highlights.forEach((h) => findings.push({ ...h }));
+    } catch {
+      // fail-open
+    }
+  }
+
+  function walk(relDir) {
+    const absDir = path.join(cwd, relDir);
+    const entries = fs.readdirSync(absDir, { withFileTypes: true });
+    entries.forEach((e) => {
+      const rel = path.join(relDir, e.name);
+      if (e.isDirectory()) return walk(rel);
+      if (e.isFile() && (rel.endsWith(".md") || rel.endsWith(".json") || rel.endsWith(".js") || rel.endsWith(".ts"))) {
+        scanFile(rel);
+      }
+    });
+  }
+
+  targets.forEach((t) => {
+    const abs = path.join(cwd, t);
+    if (!fs.existsSync(abs)) return;
+    const st = fs.statSync(abs);
+    if (st.isDirectory()) walk(t);
+    else scanFile(t);
+  });
+
+  const active = findings.filter((f) => !f.suppressed);
+  const reasonCounts = {};
+  active.forEach((f) => {
+    reasonCounts[f.id] = (reasonCounts[f.id] || 0) + 1;
+  });
+
+  const topReasons = Object.keys(reasonCounts)
+    .sort((a, b) => {
+      if (reasonCounts[b] !== reasonCounts[a]) return reasonCounts[b] - reasonCounts[a];
+      return a.localeCompare(b);
+    })
+    .slice(0, 3);
+
+  const riskScore = weightedRiskScore(active);
+  return { riskScore, topReasons, highlights: findings.slice(0, 10) };
+}
+
+module.exports = {
+  detectRiskyBash,
+  scanTextForSecurity,
+  runBaselineSecurityScan,
+  weightedRiskScore,
+};