devflow-kit 1.8.2 → 2.0.0

package/plugins/devflow-core-skills/skills/input-validation/references/detection.md

@@ -1,283 +0,0 @@
-# Validation Issue Detection
-
-Grep patterns and report templates for finding validation issues.
-
-## Quick Detection Commands
-
-### Find Unvalidated Request Body Usage
-
-```bash
-# Express/Node.js
-grep -rn "req\.body" --include="*.ts" --include="*.js" | grep -v "safeParse\|validate\|schema"
-
-# Look for direct property access without validation
-grep -rn "req\.body\.\w" --include="*.ts" --include="*.js"
-```
-
-### Find Unvalidated Parameters
-
-```bash
-# Path parameters
-grep -rn "req\.params\.\w" --include="*.ts" --include="*.js" | grep -v "safeParse\|validate"
-
-# Query parameters
-grep -rn "req\.query\.\w" --include="*.ts" --include="*.js" | grep -v "safeParse\|validate"
-```
-
-### Find SQL Injection Risks
-
-```bash
-# Template literals with SQL
-grep -rn '`.*SELECT.*\${' --include="*.ts" --include="*.js"
-grep -rn '`.*INSERT.*\${' --include="*.ts" --include="*.js"
-grep -rn '`.*UPDATE.*\${' --include="*.ts" --include="*.js"
-grep -rn '`.*DELETE.*\${' --include="*.ts" --include="*.js"
-
-# String concatenation in queries
-grep -rn "'\s*\+\s*.*\+\s*'" --include="*.ts" --include="*.js" | grep -i "select\|insert\|update\|delete"
-```
-
-### Find Unvalidated External Data
-
-```bash
-# JSON.parse without validation
-grep -rn "JSON\.parse" --include="*.ts" --include="*.js" | grep -v "safeParse\|try"
-
-# fetch responses used directly
-grep -rn "\.json()" --include="*.ts" --include="*.js" | grep -v "safeParse\|schema\|validate"
-```
-
-### Find Unvalidated Environment Variables
-
-```bash
-# Direct process.env usage
-grep -rn "process\.env\.\w" --include="*.ts" --include="*.js" | grep -v "safeParse\|validate\|ConfigSchema"
-```
-
-### Find Dangerous Functions
-
-```bash
-# eval and Function constructor
-grep -rn "eval\s*(" --include="*.ts" --include="*.js"
-grep -rn "new\s*Function\s*(" --include="*.ts" --include="*.js"
-
-# JWT decode without verify
-grep -rn "jwt\.decode" --include="*.ts" --include="*.js" | grep -v "jwt\.verify"
-```
-
----
-
-## Validation Report Format
-
-When validation issues detected:
-
-```markdown
-# INPUT VALIDATION ISSUES DETECTED
-
-## CRITICAL - Missing Boundary Validation
-**File**: src/api/routes/users.ts:45
-**Issue**: API endpoint accepts unvalidated user input
-**Security Risk**: HIGH - Injection attacks, data corruption possible
-
-**Current Code**:
-```typescript
-app.post('/api/users', async (req, res) => {
-  const user = await createUser(req.body); // NO VALIDATION
-  res.json(user);
-});
-```
-
-**Required Fix**:
-```typescript
-const UserRequestSchema = z.object({
-  body: z.object({
-    email: z.string().email().max(255),
-    name: z.string().min(1).max(100),
-    age: z.number().int().min(0).max(150)
-  })
-});
-
-app.post('/api/users', async (req, res) => {
-  const validation = UserRequestSchema.safeParse(req);
-
-  if (!validation.success) {
-    return res.status(400).json({ error: validation.error });
-  }
-
-  const result = await createUser(validation.data.body);
-  // ... handle result
-});
-```
-
-**Impact**: Prevents malicious input, ensures data integrity
-
-## CRITICAL - Manual Validation Instead of Schema
-**File**: src/services/validation.ts:23
-**Issue**: Manual type checking instead of schema validation
-**Problem**: Scattered validation logic, incomplete checks
-
-**Current Code**:
-```typescript
-if (!data.email || typeof data.email !== 'string') {
-  throw new Error('Invalid email');
-}
-if (!data.age || typeof data.age !== 'number') {
-  throw new Error('Invalid age');
-}
-// ... 15 more manual checks
-```
-
-**Required Fix**:
-```typescript
-const UserSchema = z.object({
-  email: z.string().email().max(255),
-  age: z.number().int().min(0).max(150),
-  name: z.string().min(1).max(100),
-  // All validation rules in one place
-});
-
-const validation = UserSchema.safeParse(data);
-if (!validation.success) {
-  return { ok: false, error: validation.error };
-}
-```
-
-**Impact**: Centralized validation, type safety, better error messages
-
-## CRITICAL - SQL Injection Risk
-**File**: src/database/queries.ts:67
-**Issue**: String interpolation in SQL query
-**Security Risk**: CRITICAL - SQL injection possible
-
-**Current Code**:
-```typescript
-const query = `SELECT * FROM users WHERE email = '${email}'`;
-```
-
-**Required Fix**:
-```typescript
-// 1. Validate input
-const validation = EmailSchema.safeParse(email);
-if (!validation.success) {
-  return { ok: false, error: new Error('Invalid email') };
-}
-
-// 2. Use parameterized query
-const query = 'SELECT * FROM users WHERE email = $1';
-const result = await db.query(query, [validation.data]);
-```
-
-**Impact**: Prevents SQL injection attacks (critical security issue)
-
-## HIGH - External API Response Not Validated
-**File**: src/integrations/payment.ts:89
-**Issue**: Trusting external API response without validation
-**Risk**: Application crash if API changes structure
-
-**Current Code**:
-```typescript
-const data = await response.json();
-return data.amount; // No validation
-```
-
-**Required Fix**:
-```typescript
-const PaymentResponseSchema = z.object({
-  amount: z.number().positive(),
-  currency: z.string().length(3),
-  status: z.enum(['success', 'failed', 'pending'])
-});
-
-const validation = PaymentResponseSchema.safeParse(await response.json());
-if (!validation.success) {
-  return { ok: false, error: new Error('Invalid payment response') };
-}
-
-return { ok: true, value: validation.data.amount };
-```
-
-## Summary
-- **Critical**: X validation issues (Y missing, Z SQL injection risks)
-- **High**: X external data issues
-- **Security Risk**: CRITICAL/HIGH/MEDIUM
-- **Files affected**: X
-
-## SECURITY GATE FAILED
-
-These validation gaps create serious security vulnerabilities:
-1. SQL injection possible in X locations
-2. Unvalidated user input in Y API endpoints
-3. External data trusted without validation
-
-**DO NOT deploy until these are fixed.**
-
-## Required Actions
-
-1. **Immediate** (Security Critical):
-   - Fix SQL injection risks
-   - Add validation to all API endpoints
-
-2. **High Priority**:
-   - Validate all external API responses
-   - Validate environment variables on startup
-
-3. **Standard**:
-   - Replace manual validation with schemas
-   - Add validation tests
-
-## Implementation Guide
-
-**Step 1**: Install validation library
-```bash
-npm install zod  # or appropriate library
-```
-
-**Step 2**: Define schemas for all boundaries
-```typescript
-// src/validation/schemas.ts
-export const schemas = {
-  createUser: UserSchema,
-  updateUser: UpdateUserSchema,
-  searchQuery: SearchQuerySchema,
-  // ... all input shapes
-};
-```
-
-**Step 3**: Apply at boundaries
-```typescript
-// Validate at entry point
-const validation = schema.safeParse(input);
-// Check result and proceed
-```
-
-**Step 4**: Add tests
-```typescript
-// Verify validation catches invalid input
-```
-```
-
----
-
-## Risk Classification
-
-| Issue Type | Risk Level | Fix Priority |
-|------------|------------|--------------|
-| SQL injection | CRITICAL | Immediate |
-| Command injection | CRITICAL | Immediate |
-| Path traversal | CRITICAL | Immediate |
-| Missing auth validation | CRITICAL | Immediate |
-| Unvalidated API input | HIGH | Same day |
-| Unvalidated external data | HIGH | Same day |
-| Manual validation | MEDIUM | This sprint |
-| Missing env validation | MEDIUM | This sprint |
-| Incomplete schemas | LOW | Next sprint |
-
----
-
-## Integration Points
-
-This skill works with:
-
-- **core-patterns**: Ensures validation uses Result types, catches fake/incomplete validation
-- **test-patterns**: Validates boundary tests exist
-- **security-patterns**: Broader security review context

package/plugins/devflow-core-skills/skills/input-validation/references/patterns.md

@@ -1,361 +0,0 @@
-# Input Validation Correct Patterns
-
-Extended examples of proper validation patterns.
-
-## Schema Validation at Boundary
-
-```typescript
-import { z } from 'zod';
-
-const UserSchema = z.object({
-  email: z.string().email().max(255),
-  age: z.number().int().min(0).max(150),
-  name: z.string().min(1).max(100)
-});
-
-type User = z.infer<typeof UserSchema>;
-
-function createUser(data: unknown): Result<User, ValidationError> {
-  const validation = UserSchema.safeParse(data);
-
-  if (!validation.success) {
-    return {
-      ok: false,
-      error: new ValidationError('Invalid user data', validation.error)
-    };
-  }
-
-  // After this point, data is guaranteed valid User type
-  return { ok: true, value: validation.data };
-}
-```
-
----
-
-## API Endpoint Validation
-
-```typescript
-const CreateUserRequestSchema = z.object({
-  body: UserSchema
-});
-
-app.post('/api/users', async (req, res) => {
-  const validation = CreateUserRequestSchema.safeParse(req);
-
-  if (!validation.success) {
-    return res.status(400).json({
-      error: 'Validation failed',
-      details: validation.error.issues
-    });
-  }
-
-  // Now req.body is safely typed as User
-  const result = await createUser(validation.data.body);
-
-  if (!result.ok) {
-    return res.status(500).json({ error: result.error.message });
-  }
-
-  res.json(result.value);
-});
-```
-
----
-
-## External API Response Validation
-
-```typescript
-const ExternalUserSchema = z.object({
-  id: z.string().uuid(),
-  name: z.string(),
-  email: z.string().email(),
-  // Define exact structure we expect
-});
-
-async function fetchUserData(userId: string): Promise<Result<UserData, Error>> {
-  try {
-    const response = await fetch(`https://api.example.com/users/${userId}`);
-    const rawData = await response.json();
-
-    const validation = ExternalUserSchema.safeParse(rawData);
-
-    if (!validation.success) {
-      return {
-        ok: false,
-        error: new Error('External API returned invalid data')
-      };
-    }
-
-    return { ok: true, value: validation.data };
-  } catch (error) {
-    return { ok: false, error: error as Error };
-  }
-}
-```
-
----
-
-## Environment Variable Validation
-
-```typescript
-const ConfigSchema = z.object({
-  port: z.string().regex(/^\d+$/).transform(Number).pipe(z.number().min(1).max(65535)),
-  dbUrl: z.string().url().startsWith('postgresql://'),
-  apiKey: z.string().min(32).max(128)
-});
-
-function loadConfig(): Result<Config, Error> {
-  const validation = ConfigSchema.safeParse({
-    port: process.env.PORT,
-    dbUrl: process.env.DATABASE_URL,
-    apiKey: process.env.API_KEY
-  });
-
-  if (!validation.success) {
-    return {
-      ok: false,
-      error: new Error(`Invalid configuration: ${validation.error.message}`)
-    };
-  }
-
-  return { ok: true, value: validation.data };
-}
-
-// Application initialization
-const configResult = loadConfig();
-if (!configResult.ok) {
-  console.error('Failed to load configuration:', configResult.error);
-  process.exit(1);
-}
-
-const config = configResult.value; // Type-safe, validated config
-```
-
----
-
-## Database Query with Validation
-
-```typescript
-const EmailSchema = z.string().email().max(255);
-const SearchTermSchema = z.string().min(1).max(100).regex(/^[a-zA-Z0-9\s-]+$/);
-
-async function getUserByEmail(email: unknown): Promise<Result<User, Error>> {
-  const validation = EmailSchema.safeParse(email);
-
-  if (!validation.success) {
-    return { ok: false, error: new Error('Invalid email format') };
-  }
-
-  try {
-    // Parameterized query prevents SQL injection
-    const user = await db.query('SELECT * FROM users WHERE email = $1', [validation.data]);
-    return { ok: true, value: user };
-  } catch (error) {
-    return { ok: false, error: error as Error };
-  }
-}
-
-async function searchUsers(searchTerm: unknown): Promise<Result<User[], Error>> {
-  const validation = SearchTermSchema.safeParse(searchTerm);
-
-  if (!validation.success) {
-    return { ok: false, error: new Error('Invalid search term') };
-  }
-
-  try {
-    const users = await db.query(
-      'SELECT * FROM users WHERE name ILIKE $1',
-      [`%${validation.data}%`]
-    );
-    return { ok: true, value: users };
-  } catch (error) {
-    return { ok: false, error: error as Error };
-  }
-}
-```
-
----
-
-## File Upload Validation
-
-```typescript
-const FileUploadSchema = z.object({
-  name: z.string().max(255).regex(/^[a-zA-Z0-9._-]+$/),
-  size: z.number().max(10 * 1024 * 1024), // 10MB max
-  mimetype: z.enum(['image/jpeg', 'image/png', 'application/pdf']),
-});
-
-async function handleUpload(file: unknown): Promise<Result<string, Error>> {
-  const validation = FileUploadSchema.safeParse(file);
-
-  if (!validation.success) {
-    return { ok: false, error: new Error('Invalid file') };
-  }
-
-  const { name, size, mimetype } = validation.data;
-
-  // Additional content validation
-  const buffer = await readFileBuffer(file);
-  const detectedType = await fileType.fromBuffer(buffer);
-
-  if (detectedType?.mime !== mimetype) {
-    return { ok: false, error: new Error('File type mismatch') };
-  }
-
-  // Safe filename generation
-  const safeFilename = `${uuid()}_${name}`;
-  const safePath = path.join(UPLOAD_DIR, safeFilename);
-
-  await fs.writeFile(safePath, buffer);
-  return { ok: true, value: safeFilename };
-}
-```
-
----
-
-## URL Parameter Validation
-
-```typescript
-const UserIdSchema = z.string().uuid();
-
-app.get('/users/:id', async (req, res) => {
-  const validation = UserIdSchema.safeParse(req.params.id);
-
-  if (!validation.success) {
-    return res.status(400).json({ error: 'Invalid user ID format' });
-  }
-
-  const result = await getUserById(validation.data);
-
-  if (!result.ok) {
-    return res.status(404).json({ error: 'User not found' });
-  }
-
-  res.json(result.value);
-});
-```
-
----
-
-## Query String Validation
-
-```typescript
-const SearchQuerySchema = z.object({
-  q: z.string().min(1).max(100),
-  page: z.coerce.number().int().min(1).default(1),
-  limit: z.coerce.number().int().min(1).max(100).default(20),
-  sort: z.enum(['name', 'date', 'relevance']).default('relevance'),
-});
-
-app.get('/search', async (req, res) => {
-  const validation = SearchQuerySchema.safeParse(req.query);
-
-  if (!validation.success) {
-    return res.status(400).json({
-      error: 'Invalid query parameters',
-      details: validation.error.issues
-    });
-  }
-
-  const { q, page, limit, sort } = validation.data;
-  const results = await searchService.search(q, { page, limit, sort });
-
-  res.json(results);
-});
-```
-
----
-
-## Webhook Signature Verification
-
-```typescript
-const WebhookPayloadSchema = z.object({
-  event: z.enum(['payment.completed', 'payment.failed', 'subscription.created']),
-  data: z.object({
-    id: z.string(),
-    amount: z.number().optional(),
-    status: z.string(),
-  }),
-  timestamp: z.number(),
-});
-
-app.post('/webhook', async (req, res) => {
-  // 1. Verify signature first
-  const signature = req.headers['x-webhook-signature'];
-  const expectedSignature = crypto
-    .createHmac('sha256', WEBHOOK_SECRET)
-    .update(JSON.stringify(req.body))
-    .digest('hex');
-
-  if (signature !== expectedSignature) {
-    return res.status(401).json({ error: 'Invalid signature' });
-  }
-
-  // 2. Then validate payload structure
-  const validation = WebhookPayloadSchema.safeParse(req.body);
-
-  if (!validation.success) {
-    return res.status(400).json({ error: 'Invalid payload' });
-  }
-
-  // 3. Process verified and validated event
-  await processWebhookEvent(validation.data);
-  res.sendStatus(200);
-});
-```
-
----
-
-## GraphQL Input Validation
-
-```typescript
-const UserFilterSchema = z.object({
-  name: z.string().max(100).optional(),
-  email: z.string().email().optional(),
-  status: z.enum(['active', 'inactive']).optional(),
-  limit: z.number().int().min(1).max(100).default(20),
-});
-
-const resolvers = {
-  Query: {
-    users: async (_, { filter }) => {
-      const validation = UserFilterSchema.safeParse(filter);
-
-      if (!validation.success) {
-        throw new GraphQLError('Invalid filter', {
-          extensions: { code: 'BAD_USER_INPUT' }
-        });
-      }
-
-      return userService.findUsers(validation.data);
-    },
-  },
-};
-```
-
----
-
-## Form Data Sanitization
-
-```typescript
-import DOMPurify from 'isomorphic-dompurify';
-
-const ProfileUpdateSchema = z.object({
-  bio: z.string().max(500).transform(s => DOMPurify.sanitize(s)),
-  website: z.string().url().optional(),
-  displayName: z.string().min(1).max(50),
-});
-
-app.post('/profile', async (req, res) => {
-  const validation = ProfileUpdateSchema.safeParse(req.body);
-
-  if (!validation.success) {
-    return res.status(400).json({ error: validation.error });
-  }
-
-  // bio is already sanitized by the schema transform
-  await db.users.update(req.userId, validation.data);
-
-  res.json({ success: true });
-});
-```