ecdsa-scan 0.1.0

package/src/rules/key-file-outside-tests.js

@@ -0,0 +1,56 @@
+// Rule: key files living outside test/fixture/example directories.
+
+import path from "node:path";
+
+const PRIVATE_PEM = /-----BEGIN\s+(?:[A-Z0-9]+\s+)*PRIVATE KEY-----/;
+const OPENSSH_PRIVATE = /-----BEGIN OPENSSH PRIVATE KEY-----/;
+const BINARY_KEYSTORE = new Set([".p12", ".pfx", ".jks", ".p8", ".pk8"]);
+
+export default {
+  id: "key-file-outside-tests",
+  title: "Key file stored outside test/fixture directories",
+  severity: "high",
+  confidence: "suspected",
+  languages: ["keyfile"],
+  why:
+    "A `.pem`, `.key`, `id_ecdsa` or `.p12` file that sits next to application code is almost always a real key that was committed by accident — throwaway keys normally live under `test/`, `fixtures/` or `examples/`. " +
+    "Anyone with read access to the repository, including CI logs and forks, gets the key. " +
+    "If the file really is a disposable fixture, move it into a test directory so the intent is obvious to both humans and scanners.",
+  fix: [
+    "# keep keys out of the tree",
+    "git rm --cached path/to/private.key",
+    "echo '*.key' >> .gitignore",
+    "# then rotate the key — a committed key must be considered public",
+  ].join("\n"),
+  docs: "https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning",
+
+  match(ctx) {
+    if (ctx.isTestPath) return [];
+    const ext = path.extname(ctx.relPath).toLowerCase();
+    const base = path.basename(ctx.relPath);
+
+    if (BINARY_KEYSTORE.has(ext)) {
+      return [
+        {
+          line: 1,
+          column: 1,
+          confidence: "suspected",
+          snippet: base,
+          message: `\`${base}\` is a key store (${ext}) checked in outside any test directory. Confirm what it holds; if it contains a private key or a certificate chain with a key, rotate it and remove the file from git history.`,
+        },
+      ];
+    }
+
+    if (!PRIVATE_PEM.test(ctx.text)) return [];
+    const m = ctx.text.match(PRIVATE_PEM);
+    return [
+      {
+        index: m.index,
+        confidence: "suspected",
+        message: OPENSSH_PRIVATE.test(ctx.text)
+          ? `\`${base}\` is an OpenSSH private key stored outside any test directory. Rotate it and remove it from the repository.`
+          : `\`${base}\` contains a PEM private key and is stored outside any test/fixture directory. Rotate the key, then remove the file from git history.`,
+      },
+    ];
+  },
+};

package/src/rules/non-constant-time-comparison.js

@@ -0,0 +1,99 @@
+// Rule: signatures/MACs compared with ordinary equality operators.
+
+import { CODE_LANGS, condense } from "./_shared.js";
+
+const COMPARISON =
+  /([A-Za-z_$][\w$]*(?:\s*\.\s*[A-Za-z_$][\w$]*|\s*\[\s*["'][^"']*["']\s*\])*)\s*(===|!==|==|!=)\s*([A-Za-z_$][\w$]*(?:\s*\.\s*[A-Za-z_$][\w$]*|\s*\[\s*["'][^"']*["']\s*\])*|["'][^"'\n]*["'])/g;
+
+const SENSITIVE = /(signature|\bsig\b|sig[A-Z_]|mac\b|hmac|digest|checksum|\btag\b|authtag|token|otp\b|secret|password|passwd|apikey|api_key|hash)/i;
+/** Suffixes that mean "this is metadata about the value, not the value". */
+const METADATA = /(name|alg|algorithm|type|kind|format|encoding|id|len|length|count|status|method|mode|version|header|prefix|scheme|size|index|url|path)$/i;
+/**
+ * Property names that are components or descriptions of a signature rather than
+ * the signature itself: `sig.r !== sig.s`, `found.hash !== baseline.hash`.
+ * Comparing those is ordinary logic, not a timing leak.
+ */
+const GENERIC_PROPERTY = /^(?:r|s|x|y|v|hash|curve|alg|type|kind|format|encoding|name|id|mode|method|version|status|scheme|label)$/i;
+const NON_VALUE = /^(?:null|undefined|true|false|None|nil|NaN|0|""|''|-1)$/;
+const SAFE_CALL = /timingSafeEqual|compare_digest|ConstantTimeCompare|hmac\.Equal|subtle\.ConstantTime|crypto_verify|sodium_memcmp/;
+
+const BUFFER_EQUALS = /\b([A-Za-z_$][\w$]*(?:signature|sig|mac|digest|tag|token|hmac)[\w$]*)\s*\.\s*equals\s*\(/i;
+const GO_BYTES_EQUAL = /\b(?:bytes\.Equal|reflect\.DeepEqual)\b/;
+
+function looksLikeBlobLiteral(side) {
+  if (!/^["']/.test(side)) return true; // not a literal at all
+  const value = side.slice(1, -1);
+  return value.length >= 16 && /^[A-Za-z0-9+/=_-]+$/.test(value);
+}
+
+export default {
+  id: "non-constant-time-comparison",
+  title: "Signature or MAC compared with a variable-time operator",
+  severity: "medium",
+  confidence: "suspected",
+  languages: CODE_LANGS,
+  why:
+    "`==`, `===` and `bytes.Equal` stop at the first differing byte, so the time they take reveals how many leading bytes of a guess were correct. " +
+    "Over many requests that timing signal lets an attacker reconstruct a valid MAC or signature byte by byte, without ever knowing the key. " +
+    "Compare secrets with a constant-time helper instead.",
+  fix: [
+    "// Node",
+    "crypto.timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(actual, 'hex'));",
+    "",
+    "# Python",
+    "hmac.compare_digest(expected, actual)",
+    "",
+    "// Go",
+    "hmac.Equal(expected, actual)  // or subtle.ConstantTimeCompare(a, b) == 1",
+  ].join("\n"),
+  docs: "https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html",
+
+  match(ctx) {
+    const out = [];
+
+    for (const m of ctx.matchAll(COMPARISON)) {
+      if (ctx.isMasked(m.index)) continue;
+      const line = ctx.lineOf(m.index);
+      if (SAFE_CALL.test(line)) continue;
+      const left = m[1].replace(/\s+/g, "");
+      const right = m[3].replace(/\s+/g, "");
+      if (NON_VALUE.test(left) || NON_VALUE.test(right)) continue;
+      if (/\.(length|size|byteLength)$/.test(left) || /\.(length|size|byteLength)$/.test(right)) continue;
+      if (/\btypeof\b/.test(line)) continue;
+
+      const leftName = left.split(/[.[\]"']+/).filter(Boolean).pop() ?? "";
+      const rightName = right.split(/[.[\]"']+/).filter(Boolean).pop() ?? "";
+      const leftSensitive = SENSITIVE.test(left) && !METADATA.test(leftName) && !GENERIC_PROPERTY.test(leftName);
+      const rightSensitive = SENSITIVE.test(right) && !METADATA.test(rightName) && !GENERIC_PROPERTY.test(rightName);
+      if (!leftSensitive && !rightSensitive) continue;
+      if (!looksLikeBlobLiteral(m[3]) || !looksLikeBlobLiteral(m[1])) continue;
+
+      out.push({
+        index: m.index,
+        confidence: "suspected",
+        message: `\`${condense(m[0], 70)}\` compares signature/MAC material with \`${m[2]}\`, which short-circuits on the first differing byte and leaks how much of a guess was right.`,
+      });
+    }
+
+    for (const m of ctx.matchAll(new RegExp(BUFFER_EQUALS.source, "gi"))) {
+      out.push({
+        index: m.index,
+        confidence: "suspected",
+        message: `\`${m[1]}.equals(...)\` is a plain byte comparison, not a constant-time one. Use \`crypto.timingSafeEqual\` for signature and MAC values.`,
+      });
+    }
+
+    if (ctx.lang === "go") {
+      for (const call of ctx.findCalls(new RegExp(GO_BYTES_EQUAL.source, "g"))) {
+        if (!SENSITIVE.test(call.args)) continue;
+        out.push({
+          index: call.index,
+          confidence: "suspected",
+          message: `\`${call.callee}(${condense(call.args, 50)})\` compares signature/MAC bytes in variable time. Use \`hmac.Equal\` or \`subtle.ConstantTimeCompare\`.`,
+        });
+      }
+    }
+
+    return out;
+  },
+};

package/src/rules/secp256k1-low-s.js

@@ -0,0 +1,46 @@
+// Rule: secp256k1 signing/verification with no sign of low-S normalization.
+
+import { CODE_LANGS, K1_RE } from "./_shared.js";
+
+const SIGN_OP =
+  /\.(?:sign|signSync|signAsync|verify|verifySync|signRecoverable|recoverPublicKey)\s*\(|\bSign\s*\(|\bVerify\s*\(|\bsign_digest\w*\s*\(/;
+
+const NORMALIZED =
+  /lowS|low_s|lows\b|normalize|normalise|canonical|toCompactRawBytes|hasHighS|halfOrder|HALF_CURVE_ORDER|HALF_ORDER|malleab|isHigh|highS|N\s*-\s*s\b|n\s*-\s*s\b|CURVE\.n\s*-|order\s*-\s*s\b|signatureNormalize/i;
+
+export default {
+  id: "secp256k1-low-s",
+  title: "secp256k1 signatures without visible low-S normalization",
+  severity: "low",
+  confidence: "advisory",
+  languages: CODE_LANGS,
+  why:
+    "For every valid ECDSA signature (r, s) the pair (r, n − s) is equally valid, so the same message has two encodings — signature malleability. " +
+    "Bitcoin, Ethereum and most chain tooling reject the high-S form, and code that stores or compares signature bytes can be tricked by the duplicate. " +
+    "This rule is a reminder, not a verdict: many libraries (noble-secp256k1, libsecp256k1, ethers) normalize by default, in which case there is nothing to fix.",
+  fix: [
+    "// @noble/curves normalizes on signing; be explicit when verifying too",
+    "const sig = secp256k1.sign(msgHash, priv);       // low-S by default",
+    "secp256k1.verify(sig, msgHash, pub, { lowS: true });",
+    "",
+    "# python-ecdsa",
+    "sig = sk.sign_digest_deterministic(digest, sigencode=util.sigencode_der_canonize)",
+  ].join("\n"),
+  docs: "https://github.com/bitcoin/bips/blob/master/bip-0146.mediawiki",
+
+  match(ctx) {
+    // Identifiers only: "secp256k1" inside documentation or a code sample does
+    // not mean this module signs anything.
+    if (!K1_RE.test(ctx.structure)) return [];
+    if (NORMALIZED.test(ctx.code)) return [];
+    const m = ctx.structure.match(new RegExp(SIGN_OP.source));
+    if (!m) return [];
+    return [
+      {
+        index: m.index,
+        message:
+          "This module signs or verifies with secp256k1 but never mentions low-S normalization (`lowS`, `normalize`, `n - s`). If the library does not canonicalize for you, half of the signatures produced here will be rejected by chain tooling, and both forms of the same signature will be accepted on verification.",
+      },
+    ];
+  },
+};

package/src/rules/signature-encoding.js

@@ -0,0 +1,83 @@
+// Rule: hand-built r‖s signatures and ambiguous Node signature encodings.
+
+import { CODE_LANGS, JS_LANGS, condense } from "./_shared.js";
+
+const R_NAME = "(?:r|R|rBuf|rBytes|rBuffer|rHex|sigR|sig_r|r_bytes|r_hex)";
+const S_NAME = "(?:s|S|sBuf|sBytes|sBuffer|sHex|sigS|sig_s|s_bytes|s_hex)";
+
+const CONCAT_PATTERNS = [
+  new RegExp(`Buffer\\.concat\\(\\s*\\[\\s*${R_NAME}\\s*,\\s*${S_NAME}\\s*[,\\]]`),
+  new RegExp(`\\b${R_NAME}\\.toString\\(\\s*(?:["']hex["']|16)\\s*\\)\\s*\\+\\s*${S_NAME}\\.toString\\(`),
+  new RegExp(`\\b${R_NAME}Hex\\s*\\+\\s*${S_NAME}Hex\\b`),
+  new RegExp(`\\$\\{\\s*${R_NAME}\\.toString\\(\\s*16\\s*\\)\\s*\\}\\$\\{\\s*${S_NAME}\\.toString\\(\\s*16\\s*\\)\\s*\\}`),
+  new RegExp(`long_to_bytes\\(\\s*${R_NAME}\\s*\\)\\s*\\+\\s*long_to_bytes\\(`),
+  new RegExp(`\\bformat\\(\\s*${R_NAME}\\s*,\\s*["']x["']\\s*\\)\\s*\\+\\s*format\\(`),
+  new RegExp(`\\bhex\\(\\s*${R_NAME}\\s*\\)\\s*\\[\\s*2\\s*:\\s*\\]\\s*\\+`),
+  new RegExp(`append\\(\\s*${R_NAME}\\.Bytes\\(\\)\\s*,\\s*${S_NAME}\\.Bytes\\(\\)\\.\\.\\.`),
+  new RegExp(`\\b${R_NAME}\\.Bytes\\(\\)\\s*\\.\\.\\.`),
+];
+
+/** Anything that means "the halves are padded to the field size". */
+const PADDING_RE =
+  /padStart|padEnd|zeroPad|leftPad|hexZeroPad|toBeHex|numberToBytesBE|toArrayLike\s*\(\s*Buffer\s*,\s*["']be["']\s*,\s*\d+|setLength|to_bytes\s*\(\s*\d+|\.zfill\(|\.rjust\(|FillBytes|fillBytes|Uint8Array\(\s*(?:32|48|66)\s*\)/;
+
+const NODE_SIGN_VERIFY = /\bcrypto\s*\.\s*(?:sign|verify)\b/;
+const JWS_CONTEXT = /\b(jws|jwt|JWS|JWT|base64url|base64Url|webauthn|WebAuthn|COSE|P1363|p1363|ieee-?p1363)\b/;
+
+export default {
+  id: "signature-encoding",
+  title: "Hand-built r‖s signature or unspecified DER/raw encoding",
+  severity: "medium",
+  confidence: "suspected",
+  languages: CODE_LANGS,
+  why:
+    "An ECDSA signature is two integers, r and s, and the raw (P1363/JOSE) form requires each of them to be zero-padded to the exact field size — 32 bytes for P-256 and secp256k1. " +
+    "Concatenating `r.toString(16) + s.toString(16)` or `Buffer.concat([r, s])` drops leading zero bytes roughly once in every 256 signatures, which produces a 63-byte signature and an 'invalid signature' bug that only shows up in production. " +
+    "The mirror image of the problem is Node's `crypto.sign`/`crypto.verify`, which default to DER while JWS expects raw.",
+  fix: [
+    "// pad each half to the field size",
+    "const size = 32; // P-256 / secp256k1",
+    "const raw = Buffer.concat([",
+    "  Buffer.from(r.toString(16).padStart(size * 2, '0'), 'hex'),",
+    "  Buffer.from(s.toString(16).padStart(size * 2, '0'), 'hex'),",
+    "]);",
+    "",
+    "// or let Node do the conversion",
+    "crypto.verify(null, data, { key, dsaEncoding: 'ieee-p1363' }, signature);",
+  ].join("\n"),
+  docs: "https://www.rfc-editor.org/rfc/rfc7518#section-3.4",
+
+  match(ctx) {
+    const out = [];
+
+    for (const re of CONCAT_PATTERNS) {
+      for (const m of ctx.matchAll(new RegExp(re.source, "g"))) {
+        if (ctx.isMasked(m.index)) continue; // code sample inside a string
+        const around = ctx.window(m.index, 3, 2);
+        if (PADDING_RE.test(around)) continue;
+        out.push({
+          index: m.index,
+          confidence: "suspected",
+          message: `\`${condense(m[0], 60)}\` joins r and s without padding them to the field size. Signatures whose r or s starts with a zero byte come out too short and fail verification.`,
+        });
+      }
+    }
+
+    // Node's crypto.sign/verify default to DER; JOSE and WebAuthn want raw.
+    if (JS_LANGS.includes(ctx.lang) && JWS_CONTEXT.test(ctx.code)) {
+      for (const call of ctx.findCalls(new RegExp(NODE_SIGN_VERIFY.source, "g"))) {
+        if (ctx.isMasked(call.index)) continue;
+        if (call.args.trim() === "") continue; // `crypto.sign()` in prose, not a call
+        if (/dsaEncoding/.test(call.args)) continue;
+        out.push({
+          index: call.index,
+          confidence: "advisory",
+          message:
+            "`crypto.sign`/`crypto.verify` default to DER-encoded ECDSA signatures, but this file also deals with JWS/base64url data, which uses the raw r‖s form. Set `dsaEncoding: 'ieee-p1363'` (or convert explicitly) so the two never get mixed up.",
+        });
+      }
+    }
+
+    return out;
+  },
+};

package/src/rules/tls-verification-disabled.js

@@ -0,0 +1,75 @@
+// Rule: certificate verification switched off.
+
+import { CODE_LANGS, condense } from "./_shared.js";
+
+const JS_PATTERNS = [
+  { re: /\brejectUnauthorized\s*:\s*false\b/, what: "`rejectUnauthorized: false`" },
+  { re: /NODE_TLS_REJECT_UNAUTHORIZED["'\]]*\s*=\s*["']?0/, what: "`NODE_TLS_REJECT_UNAUTHORIZED = 0`" },
+  { re: /\bstrictSSL\s*:\s*false\b/, what: "`strictSSL: false`" },
+  { re: /\bcheckServerIdentity\s*:\s*(?:\([^)]*\)|function\s*\([^)]*\))\s*(?:=>)?\s*(?:\{\s*\}|undefined|null|true)/, what: "a `checkServerIdentity` stub that accepts every host" },
+  { re: /\bsecureProtocol\s*:\s*["']SSLv[23]/, what: "an obsolete SSL protocol" },
+];
+
+const PY_PATTERNS = [
+  { re: /\bssl\._create_unverified_context\s*\(/, what: "`ssl._create_unverified_context()`" },
+  { re: /\bverify_mode\s*=\s*ssl\.CERT_NONE\b|\bssl\.CERT_NONE\b/, what: "`ssl.CERT_NONE`" },
+  { re: /\bcheck_hostname\s*=\s*False\b/, what: "`check_hostname = False`" },
+];
+
+const GO_PATTERNS = [{ re: /\bInsecureSkipVerify\s*:\s*true\b/, what: "`InsecureSkipVerify: true`" }];
+
+const PY_VERIFY_FALSE = /(?:^|[\s,(])verify\s*=\s*False\b/;
+/** HTTP clients: `verify=False` there is a TLS switch, not a JWT one. */
+const HTTP_CLIENT = /\b(?:requests|httpx|session|s|client)\s*\.\s*(?:get|post|put|patch|delete|head|options|request|send)\s*\(|\brequests\.\w+\(|\bhttpx\.\w+\(/;
+
+export default {
+  id: "tls-verification-disabled",
+  title: "Certificate verification disabled",
+  severity: "high",
+  confidence: "confirmed",
+  languages: CODE_LANGS,
+  why:
+    "Turning off certificate validation keeps the encryption but removes the identity check, so any machine on the path can present its own certificate and read or rewrite the traffic. " +
+    "The usual motive is a self-signed certificate in staging, and the setting then survives into production. " +
+    "Trust the specific CA or certificate instead of disabling the check.",
+  fix: [
+    "// Node: trust your own CA rather than nobody",
+    "const agent = new https.Agent({ ca: fs.readFileSync('internal-ca.pem') });",
+    "",
+    "# Python",
+    "requests.get(url, verify='/etc/ssl/internal-ca.pem')",
+    "",
+    "// Go",
+    "tls.Config{RootCAs: pool}  // never InsecureSkipVerify: true",
+  ].join("\n"),
+  docs: "https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html",
+
+  match(ctx) {
+    const out = [];
+    const groups = { js: JS_PATTERNS, ts: JS_PATTERNS, python: PY_PATTERNS, go: GO_PATTERNS };
+    for (const pattern of groups[ctx.lang] ?? []) {
+      for (const m of ctx.matchAll(new RegExp(pattern.re.source, "g"))) {
+        if (ctx.isMasked(m.index)) continue; // prose or a scanner pattern, not code
+        out.push({
+          index: m.index,
+          message: `${pattern.what} disables certificate validation — the connection is encrypted but the peer is no longer authenticated, which is exactly what a man-in-the-middle needs.`,
+        });
+      }
+    }
+
+    if (ctx.lang === "python") {
+      for (const m of ctx.matchAll(new RegExp(PY_VERIFY_FALSE.source, "gm"))) {
+        if (ctx.isMasked(m.index)) continue;
+        const before = ctx.code.slice(Math.max(0, m.index - 200), m.index);
+        if (!HTTP_CLIENT.test(before)) continue; // `verify=False` on jwt.decode is a different rule
+        if (/\bjwt\b/.test(before)) continue;
+        out.push({
+          index: m.index,
+          message: `\`${condense(m[0], 30)}\` on an HTTP request disables TLS certificate validation. Point \`verify\` at your CA bundle instead of switching the check off.`,
+        });
+      }
+    }
+
+    return out;
+  },
+};

package/src/rules/unchecked-verification-result.js

@@ -0,0 +1,60 @@
+// Rule: the boolean returned by a verification call is thrown away.
+
+import { JS_LANGS, condense } from "./_shared.js";
+
+// Only APIs that RETURN a boolean are listed. Libraries that throw on failure
+// (jsonwebtoken, jose, python-cryptography) are correct to call as a statement,
+// so they are deliberately excluded — this rule must not punish good code.
+const JS_BOOLEAN_VERIFY =
+  /\b(?:crypto|secp256k1|k256|p256|p384|p521|ed25519|ecdsa|nacl\.sign\.detached|curve|verifier|publicKey|pubKey|key)\s*\.\s*verify\b|\b(?:verifySignature|isValidSignature|checkSignature|verifyDigest)\b/;
+const GO_BOOLEAN_VERIFY = /\b(?:ecdsa\.Verify(?:ASN1)?|ed25519\.Verify|secp256k1\.Verify|btcec\.Verify)\b/;
+
+const THROWING_LIBS = /\b(?:jwt|jose|jsonwebtoken)\s*\.\s*verify\b|\bjwtVerify\b|\bcompactVerify\b/;
+
+/** The call must stand alone as a statement — not assigned, returned or tested. */
+function isBareStatement(code, call) {
+  let start = call.index - 1;
+  while (start >= 0 && !";{}\n".includes(code[start])) start--;
+  const prefix = code.slice(start + 1, call.index).trim();
+  if (!/^(?:await\s+|void\s+)?$/.test(prefix)) return false;
+  const after = code.slice(call.end + 1, call.end + 40);
+  return /^\s*;?\s*(?:\r?\n|$)/.test(after);
+}
+
+export default {
+  id: "unchecked-verification-result",
+  title: "Verification result is never checked",
+  severity: "high",
+  confidence: "suspected",
+  languages: [...JS_LANGS, "go"],
+  why:
+    "`crypto.verify`, `secp256k1.verify` and `ecdsa.Verify` report failure by returning `false`, not by throwing. " +
+    "Calling one as a bare statement means an invalid signature is indistinguishable from a valid one and execution simply continues — the check exists in the code but does nothing. " +
+    "The result must control a branch: an `if`, an early return, or a thrown error.",
+  fix: [
+    "// bad",
+    "crypto.verify(null, data, publicKey, signature);",
+    "",
+    "// good",
+    "if (!crypto.verify(null, data, publicKey, signature)) {",
+    "  throw new Error('invalid signature');",
+    "}",
+  ].join("\n"),
+  docs: "https://nodejs.org/api/crypto.html#cryptoverifyalgorithm-data-key-signature-callback",
+
+  match(ctx) {
+    const out = [];
+    const calleeRe = ctx.lang === "go" ? GO_BOOLEAN_VERIFY : JS_BOOLEAN_VERIFY;
+    for (const call of ctx.findCalls(new RegExp(calleeRe.source, "g"))) {
+      if (ctx.isMasked(call.index)) continue; // a code sample, not a call
+      if (call.args.trim() === "") continue;
+      if (THROWING_LIBS.test(call.callee)) continue;
+      if (!isBareStatement(ctx.code, call)) continue;
+      out.push({
+        index: call.index,
+        message: `\`${condense(call.callee, 40)}(...)\` returns a boolean that is discarded here, so a failed signature check changes nothing. Wrap it in a condition and reject on \`false\`.`,
+      });
+    }
+    return out;
+  },
+};

package/src/rules/unvalidated-public-key-point.js

@@ -0,0 +1,72 @@
+// Rule: public keys built from raw coordinates without an on-curve check, and
+// hand-rolled curve arithmetic.
+
+import { CODE_LANGS, condense } from "./_shared.js";
+
+const VALIDATED = /\.validate\s*\(|assertValidity|isOnCurve|IsOnCurve|is_on_curve|validatePoint|checkPoint|verifyPoint/;
+
+const RAW_POINT_BUILDERS = [
+  { re: /\bkeyFromPublic\s*\(/, what: "elliptic `keyFromPublic`" },
+  { re: /\b(?:ProjectivePoint|Point|ExtendedPoint)\s*\.\s*fromAffine\s*\(/, what: "`Point.fromAffine`" },
+  { re: /\bnew\s+ecdsa\.PublicKey\b|\becdsa\.PublicKey\s*\{/, what: "a literal `ecdsa.PublicKey{X, Y}`" },
+  { re: /\bEllipticCurvePublicNumbers\s*\(/, what: "`EllipticCurvePublicNumbers`" },
+  { re: /\bVerifyingKey\.from_public_point\s*\(/, what: "`VerifyingKey.from_public_point`" },
+];
+
+/** Signs that the file implements curve arithmetic by hand. */
+const HANDROLLED = /\b(?:pointAdd|point_add|pointDouble|point_double|pointMultiply|pointMul|scalarMult|scalar_mult|modInverse|mod_inverse|modPow|mod_pow|invert)\s*\(/;
+
+export default {
+  id: "unvalidated-public-key-point",
+  title: "Public key built from raw coordinates without an on-curve check",
+  severity: "medium",
+  confidence: "advisory",
+  languages: CODE_LANGS,
+  why:
+    "When a public key arrives as raw x/y coordinates (a JWK, a database column, an API parameter), the receiver must check that the point actually lies on the expected curve and is not the point at infinity. " +
+    "A point from a different, weaker curve turns the subsequent scalar multiplication into an invalid-curve attack that can leak bits of the private key. " +
+    "High-level libraries usually validate for you — this rule flags the places worth confirming, not proven defects.",
+  fix: [
+    "// elliptic: validate what you import",
+    "const key = ec.keyFromPublic({ x, y }, 'hex');",
+    "if (!key.validate().result) throw new Error('point is not on the curve');",
+    "",
+    "// noble: assertValidity after building a point from coordinates",
+    "const point = secp256k1.Point.fromAffine({ x, y });",
+    "point.assertValidity();",
+    "",
+    "// Go",
+    "if !curve.IsOnCurve(x, y) { return errors.New(\"point not on curve\") }",
+  ].join("\n"),
+  docs: "https://csrc.nist.gov/pubs/sp/800/56/a/r3/final",
+
+  match(ctx) {
+    const out = [];
+    const fileValidates = VALIDATED.test(ctx.code);
+
+    if (!fileValidates) {
+      for (const builder of RAW_POINT_BUILDERS) {
+        for (const m of ctx.matchAll(new RegExp(builder.re.source, "g"))) {
+          if (ctx.isMasked(m.index)) continue;
+          out.push({
+            index: m.index,
+            confidence: "advisory",
+            message: `A public key is built from raw coordinates via ${builder.what} and nothing in this file checks that the point is on the curve. If those coordinates can come from a request, a database row or a JWK, add an explicit validity check.`,
+          });
+          break; // one reminder per builder is enough
+        }
+      }
+    }
+
+    const handrolled = ctx.structure.match(new RegExp(HANDROLLED.source));
+    if (handrolled && /\b(?:curve|ecdsa|secp|p256|generator|\bGx\b|\bGy\b)/i.test(ctx.structure)) {
+      out.push({
+        index: handrolled.index,
+        confidence: "advisory",
+        message: `This file implements curve arithmetic by hand (\`${condense(handrolled[0], 30)}\`). Hand-written field and point operations are where invalid-curve handling, non-constant-time branches and edge cases (point at infinity, s = 0) usually go wrong — prefer a reviewed library unless this is deliberately an educational implementation.`,
+      });
+    }
+
+    return out;
+  },
+};

package/src/rules/weak-signature-hash.js

@@ -0,0 +1,83 @@
+// Rule: SHA-1 or MD5 used as the digest of a signature.
+
+import { CODE_LANGS, condense } from "./_shared.js";
+
+const CONFIRMED_PATTERNS = [
+  /\bcreate(?:Sign|Verify)\s*\(\s*["'](?:sha-?1|md5|RSA-SHA1|RSA-MD5|ecdsa-with-SHA1)["']/i,
+  /["'](?:sha1WithRSA(?:Encryption)?|md5WithRSA(?:Encryption)?|ecdsa-with-SHA1|sha1WithRSASignature)["']/i,
+  /\bx509\.(?:SHA1WithRSA|ECDSAWithSHA1|MD5WithRSA|MD2WithRSA)\b/,
+  /\bSign\w*\([^)]{0,160}?\bcrypto\.(?:SHA1|MD5)\b/,
+  /\b(?:sign|verify)\s*\([^)]{0,200}?\bhashes\.(?:SHA1|MD5)\s*\(/s,
+  /\bsignature_algorithm\s*=\s*["']?(?:SHA1|MD5)/i,
+];
+
+const ADVISORY_PATTERNS = [
+  /\bcreateHash\s*\(\s*["'](?:sha-?1|md5)["']\s*\)/i,
+  /\bhashlib\.(?:sha1|md5)\s*\(/,
+  /\bsha1\.(?:New|Sum)\s*\(|\bmd5\.(?:New|Sum)\s*\(/,
+  /\bhashes\.(?:SHA1|MD5)\s*\(/,
+];
+
+const SIGNING_CONTEXT = /\b(sign|signature|signing|verify|certificate|csr|x509|jws|jwt)\b/i;
+
+// Lookup tables that merely *name* legacy algorithms — OID maps in certificate
+// parsers, label dictionaries, UI drop-downs — are documentation, not usage.
+const LOOKUP_TABLE_LINE = /\b\d+\.\d+\.\d+(?:\.\d+)+\b|\b(?:label|name|title|display|description|text|oid)\s*:/i;
+
+export default {
+  id: "weak-signature-hash",
+  title: "SHA-1 or MD5 used for a signature",
+  severity: "high",
+  confidence: "confirmed",
+  languages: CODE_LANGS,
+  why:
+    "A signature is only as strong as the hash it covers, and both MD5 and SHA-1 have practical chosen-prefix collisions (SHA-1 since SHAttered/2017, for a few tens of thousands of dollars of compute). " +
+    "With a collision an attacker gets one signature that is valid for two different documents, which breaks certificates, software updates and any signed message. " +
+    "NIST disallowed SHA-1 for digital signatures in 2013 and retired it entirely at the end of 2030.",
+  fix: [
+    "// Node",
+    "const signer = crypto.createSign('sha256');",
+    "",
+    "# Python (cryptography)",
+    "key.sign(data, ec.ECDSA(hashes.SHA256()))",
+    "",
+    "// Go",
+    "sum := sha256.Sum256(data)",
+    "sig, err := ecdsa.SignASN1(rand.Reader, key, sum[:])",
+  ].join("\n"),
+  docs: "https://csrc.nist.gov/news/2022/nist-transitioning-away-from-sha-1-for-all-apps",
+
+  match(ctx) {
+    const out = [];
+    const reported = new Set();
+
+    for (const re of CONFIRMED_PATTERNS) {
+      for (const m of ctx.matchAll(new RegExp(re.source, `${re.flags.replace("g", "")}g`))) {
+        if (ctx.isMasked(m.index)) continue;
+        if (LOOKUP_TABLE_LINE.test(ctx.lineOf(m.index))) continue;
+        reported.add(m.index);
+        out.push({
+          index: m.index,
+          confidence: "confirmed",
+          message: `\`${condense(m[0], 70)}\` signs or verifies with a broken digest. Collisions in SHA-1/MD5 let one signature cover two different messages.`,
+        });
+      }
+    }
+
+    if (!SIGNING_CONTEXT.test(ctx.code)) return out;
+    for (const re of ADVISORY_PATTERNS) {
+      for (const m of ctx.matchAll(new RegExp(re.source, "gi"))) {
+        if (ctx.isMasked(m.index)) continue;
+        if (LOOKUP_TABLE_LINE.test(ctx.lineOf(m.index))) continue;
+        if ([...reported].some((i) => Math.abs(i - m.index) < 80)) continue;
+        out.push({
+          index: m.index,
+          confidence: "advisory",
+          message: `\`${condense(m[0], 50)}\` computes a SHA-1/MD5 digest in a file that also signs or verifies data. If this digest ever feeds a signature, it must be replaced with SHA-256; for non-security uses (ETags, cache keys, legacy interop) it is fine.`,
+        });
+      }
+    }
+
+    return out;
+  },
+};