cleartoship 0.4.0

package/dist/vendor/guardvibe/rules/firebase.js

@@ -0,0 +1,96 @@
+/*
+ * Vendored from GuardVibe — https://github.com/goklab/guardvibe
+ * Copyright 2026 GokLab. Licensed under the Apache License, Version 2.0.
+ * Full licence: LICENSES/guardvibe-Apache-2.0.txt
+ *
+ * Modifications by ClearToShip: import paths rewritten for this package
+ * layout. Rule content is unchanged; rules that duplicate ClearToShip's own
+ * AST checks are disabled at runtime in src/scanners/community.ts rather
+ * than deleted here, so this file stays a faithful copy of upstream.
+ */
+export const firebaseRules = [
+    {
+        id: "VG750",
+        name: "Insecure Firestore Rules",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Firestore security rules allow unrestricted read/write. Anyone can read or modify your entire database.",
+        pattern: /(?:allow\s+(?:read|write|get|list|create|update|delete)\s*:\s*if\s+true|match\s+\/\{document=\*\*\}\s*\{[\s\S]{0,100}?allow\s+read\s*,\s*write)/g,
+        languages: ["firestore"],
+        fix: "Always restrict Firestore rules. Require authentication and validate data.",
+        fixCode: 'rules_version = \'2\';\nservice cloud.firestore {\n  match /databases/{database}/documents {\n    match /users/{userId} {\n      allow read, write: if request.auth != null && request.auth.uid == userId;\n    }\n  }\n}',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG751",
+        name: "Firebase Admin SDK Client Exposure",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Firebase Admin SDK or service account credentials exposed in client-side code. Admin SDK has full unrestricted access to all Firebase services.",
+        pattern: /["']use client["'][\s\S]{0,500}?(?:firebase-admin|@google-cloud\/firestore|serviceAccountKey|FIREBASE_SERVICE_ACCOUNT|FIREBASE_ADMIN)/g,
+        languages: ["javascript", "typescript"],
+        fix: "Firebase Admin SDK must only be used server-side. Never import it in client components.",
+        fixCode: '// Server-side only (API route or Server Action)\nimport { initializeApp, cert } from "firebase-admin/app";\ninitializeApp({ credential: cert(JSON.parse(process.env.FIREBASE_SERVICE_ACCOUNT_KEY!)) });',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG752",
+        name: "Firebase Service Account Key Hardcoded",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Firebase service account key or credentials JSON hardcoded in source code.",
+        pattern: /(?:service_account|serviceAccount|credential|cert)\s*[\(=:]\s*\{[\s\S]{0,500}?(?:"type"\s*:\s*"service_account"|"private_key"\s*:\s*"-----BEGIN)/g,
+        languages: ["javascript", "typescript", "json"],
+        fix: "Store service account JSON in environment variable and parse at runtime.",
+        fixCode: '// Store as env var (base64 or JSON string)\nconst serviceAccount = JSON.parse(process.env.FIREBASE_SERVICE_ACCOUNT_KEY!);\ninitializeApp({ credential: cert(serviceAccount) });',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG753",
+        name: "Insecure Firebase Storage Rules",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Firebase Storage rules allow unrestricted public access. Anyone can read/write/delete files.",
+        pattern: /(?:allow\s+read\s*,\s*write\s*:\s*if\s+true|match\s+\/\{allPaths=\*\*\}\s*\{[\s\S]{0,100}?allow\s+read\s*,\s*write)/g,
+        languages: ["firestore"],
+        fix: "Restrict Firebase Storage rules. Require authentication and limit file types/sizes.",
+        fixCode: 'service firebase.storage {\n  match /b/{bucket}/o {\n    match /users/{userId}/{allPaths=**} {\n      allow read: if request.auth != null;\n      allow write: if request.auth != null \n        && request.auth.uid == userId\n        && request.resource.size < 5 * 1024 * 1024;\n    }\n  }\n}',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG754",
+        name: "Firebase Config Hardcoded",
+        severity: "medium",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Firebase config object hardcoded with all values inline. While Firebase API keys are designed to be public, hardcoding makes it hard to manage across environments.",
+        pattern: /(?:firebaseConfig|firebase\.initializeApp)\s*[\(=]\s*\{[\s\S]{0,500}?apiKey\s*:\s*["']AIza[A-Za-z0-9_-]{30,}["']/g,
+        languages: ["javascript", "typescript"],
+        fix: "Use environment variables for Firebase config to manage different environments.",
+        fixCode: 'const firebaseConfig = {\n  apiKey: process.env.NEXT_PUBLIC_FIREBASE_API_KEY,\n  authDomain: process.env.NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN,\n  projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,\n};',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG755",
+        name: "NEXT_PUBLIC Firebase Service Account",
+        severity: "critical",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "Firebase service account key or admin credentials exposed via NEXT_PUBLIC_ prefix.",
+        pattern: /NEXT_PUBLIC_\w*(?:FIREBASE_SERVICE_ACCOUNT|FIREBASE_ADMIN|FIREBASE_PRIVATE|FIREBASE_SECRET)\w*\s*=/gi,
+        languages: ["javascript", "typescript", "shell"],
+        fix: "Remove NEXT_PUBLIC_ prefix from Firebase admin/service account credentials. These must be server-side only.",
+        fixCode: "# .env.local — WRONG\n# NEXT_PUBLIC_FIREBASE_SERVICE_ACCOUNT=...\n\n# CORRECT — server-side only\nFIREBASE_SERVICE_ACCOUNT=...\n# Use in API routes: admin.initializeApp({ credential: cert(JSON.parse(process.env.FIREBASE_SERVICE_ACCOUNT!)) })",
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG756",
+        name: "signInWithCustomToken Without Validation",
+        severity: "high",
+        owasp: "A07:2025 Identification and Authentication Failures",
+        description: "signInWithCustomToken used with unvalidated token source. Custom tokens must be generated and verified server-side.",
+        pattern: /signInWithCustomToken\s*\(\s*\w*\s*,\s*(?:req\.body|request\.body|params\.|searchParams|query\.|formData|url\.)/gi,
+        languages: ["javascript", "typescript"],
+        fix: "Generate custom tokens server-side with Firebase Admin SDK. Never accept custom tokens from client input.",
+        fixCode: '// Server-side: generate custom token\nimport { getAuth } from "firebase-admin/auth";\nconst customToken = await getAuth().createCustomToken(uid);\n\n// Client-side: only use tokens from your own server\nconst res = await fetch("/api/auth/custom-token");\nconst { token } = await res.json();\nawait signInWithCustomToken(auth, token);',
+        compliance: ["SOC2:CC6.1"],
+    },
+];

package/dist/vendor/guardvibe/rules/go.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityRule } from "./types.js";
+export declare const goRules: SecurityRule[];

package/dist/vendor/guardvibe/rules/go.js

@@ -0,0 +1,85 @@
+/*
+ * Vendored from GuardVibe — https://github.com/goklab/guardvibe
+ * Copyright 2026 GokLab. Licensed under the Apache License, Version 2.0.
+ * Full licence: LICENSES/guardvibe-Apache-2.0.txt
+ *
+ * Modifications by ClearToShip: import paths rewritten for this package
+ * layout. Rule content is unchanged; rules that duplicate ClearToShip's own
+ * AST checks are disabled at runtime in src/scanners/community.ts rather
+ * than deleted here, so this file stays a faithful copy of upstream.
+ */
+// === Go-specific rules ===
+export const goRules = [
+    {
+        id: "VG110",
+        name: "Go SQL injection via fmt.Sprintf",
+        severity: "critical",
+        owasp: "A02:2025 Injection",
+        description: "Using fmt.Sprintf to build SQL queries allows SQL injection attacks.",
+        pattern: /(?:db\.(?:Query|Exec|QueryRow)|\.Query|\.Exec)\s*\(\s*fmt\.Sprintf/gi,
+        languages: ["go"],
+        fix: "Use parameterized queries: db.Query('SELECT * FROM users WHERE id = $1', id). Never use fmt.Sprintf for SQL.",
+        fixCode: "// Use parameterized queries\nrows, err := db.Query(\"SELECT * FROM users WHERE id = $1\", id)",
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG111",
+        name: "Go command injection via os/exec",
+        severity: "critical",
+        owasp: "A02:2025 Injection",
+        description: "User input passed to os/exec command functions allows arbitrary command execution.",
+        pattern: /exec\.Command\s*\(\s*(?:fmt\.Sprintf|[^")\s]+\s*\+|[^")]*\+)/gi,
+        languages: ["go"],
+        fix: "Validate and sanitize all input before passing to exec.Command. Use an allowlist of permitted commands.",
+        fixCode: "// Validate input, use allowlist\ncmd := exec.Command(\"ls\", \"-la\", safeDir)",
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG112",
+        name: "Go unescaped HTML template",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "Using template.HTML() bypasses Go's automatic HTML escaping, enabling XSS.",
+        pattern: /template\.HTML\s*\(/gi,
+        languages: ["go"],
+        fix: "Avoid template.HTML() with user input. Use html/template which auto-escapes by default.",
+        fixCode: "// Use html/template which auto-escapes\n// Avoid template.HTML() with user input\ntmpl.Execute(w, data) // auto-escaped",
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.7"],
+    },
+    {
+        id: "VG113",
+        name: "Go HTTP handler without auth",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "HTTP handler registered without authentication middleware.",
+        pattern: /(?:http\.HandleFunc|mux\.HandleFunc|\.HandleFunc)\s*\(\s*['"]\/(?:api|admin|users|account|dashboard)/gi,
+        languages: ["go"],
+        fix: "Wrap handlers with authentication middleware: http.Handle('/api/', authMiddleware(handler)).",
+        fixCode: "// Wrap with auth middleware\nhttp.Handle(\"/api/\", authMiddleware(apiHandler))",
+        compliance: ["SOC2:CC6.1", "SOC2:CC6.6"],
+    },
+    {
+        id: "VG114",
+        name: "Go weak hashing",
+        severity: "critical",
+        owasp: "A07:2025 Auth Failures",
+        description: "Using md5 or sha1 for hashing. These are cryptographically broken for security purposes.",
+        pattern: /(?:md5\.New|sha1\.New|md5\.Sum|sha1\.Sum)\s*\(/gi,
+        languages: ["go"],
+        fix: "Use crypto/sha256 or golang.org/x/crypto/bcrypt for password hashing.",
+        fixCode: "// Use bcrypt for passwords\nimport \"golang.org/x/crypto/bcrypt\"\nhash, _ := bcrypt.GenerateFromPassword([]byte(password), 12)",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req4.1"],
+    },
+    {
+        id: "VG115",
+        name: "Go CORS wildcard",
+        severity: "high",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "CORS configured with wildcard origin allows any website to access your API.",
+        pattern: /(?:Access-Control-Allow-Origin|AllowOrigins|allowOrigins)['"]?\]?\s*[:=,]\s*['"]?\s*\*/gi,
+        languages: ["go"],
+        fix: "Set specific allowed origins instead of wildcard '*'.",
+        fixCode: "// Specify allowed origins\nw.Header().Set(\"Access-Control-Allow-Origin\", \"https://myapp.com\")",
+        compliance: ["SOC2:CC6.1"],
+    },
+];

package/dist/vendor/guardvibe/rules/modern-stack.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityRule } from "./types.js";
+export declare const modernStackRules: SecurityRule[];