getdoorman 1.0.0

package/src/rules/security/headers.js

@@ -0,0 +1,235 @@
+const JS_EXT = ['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs'];
+const isJS = (f) => JS_EXT.some(ext => f.endsWith(ext));
+
+const rules = [
+  // SEC-HDR-001
+  {
+    id: 'SEC-HDR-001', category: 'security', severity: 'high', confidence: 'likely',
+    title: 'Missing Content-Security-Policy header',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+      const hasCSP = [...files.values()].some(c =>
+        c.includes('Content-Security-Policy') || c.includes('contentSecurityPolicy')
+      );
+      const hasHelmet = 'helmet' in (stack.dependencies || {});
+      if (!hasCSP && !hasHelmet) {
+        findings.push({
+          ruleId: 'SEC-HDR-001', category: 'security', severity: 'high',
+          title: 'No Content-Security-Policy header — XSS attacks not mitigated',
+          description: 'CSP restricts which scripts can run on your page, preventing XSS.',
+          fix: null,
+        });
+      }
+      return findings;
+    },
+  },
+
+  // SEC-HDR-002
+  {
+    id: 'SEC-HDR-002', category: 'security', severity: 'medium', confidence: 'likely',
+    title: 'Missing X-Content-Type-Options header',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+      const has = [...files.values()].some(c => c.includes('X-Content-Type-Options') || c.includes('nosniff'));
+      const hasHelmet = 'helmet' in (stack.dependencies || {});
+      if (!has && !hasHelmet) {
+        findings.push({
+          ruleId: 'SEC-HDR-002', category: 'security', severity: 'medium',
+          title: 'Missing X-Content-Type-Options: nosniff header',
+          fix: null,
+        });
+      }
+      return findings;
+    },
+  },
+
+  // SEC-HDR-003
+  {
+    id: 'SEC-HDR-003', category: 'security', severity: 'medium', confidence: 'likely',
+    title: 'Missing X-Frame-Options header',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+      const has = [...files.values()].some(c => c.includes('X-Frame-Options') || c.includes('frameguard'));
+      const hasHelmet = 'helmet' in (stack.dependencies || {});
+      if (!has && !hasHelmet) {
+        findings.push({
+          ruleId: 'SEC-HDR-003', category: 'security', severity: 'medium',
+          title: 'Missing X-Frame-Options header — clickjacking possible',
+          fix: null,
+        });
+      }
+      return findings;
+    },
+  },
+
+  // SEC-HDR-004
+  {
+    id: 'SEC-HDR-004', category: 'security', severity: 'high', confidence: 'likely',
+    title: 'Missing Strict-Transport-Security header',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+      const has = [...files.values()].some(c => c.includes('Strict-Transport-Security') || c.includes('hsts'));
+      const hasHelmet = 'helmet' in (stack.dependencies || {});
+      if (!has && !hasHelmet) {
+        findings.push({
+          ruleId: 'SEC-HDR-004', category: 'security', severity: 'high',
+          title: 'Missing HSTS header — HTTPS downgrade attacks possible',
+          fix: null,
+        });
+      }
+      return findings;
+    },
+  },
+
+  // SEC-HDR-005
+  {
+    id: 'SEC-HDR-005', category: 'security', severity: 'low', confidence: 'suggestion',
+    title: 'Missing X-XSS-Protection header',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+      const has = [...files.values()].some(c => c.includes('X-XSS-Protection'));
+      const hasHelmet = 'helmet' in (stack.dependencies || {});
+      if (!has && !hasHelmet) {
+        findings.push({
+          ruleId: 'SEC-HDR-005', category: 'security', severity: 'low',
+          title: 'Missing X-XSS-Protection header (legacy browser protection)',
+          fix: null,
+        });
+      }
+      return findings;
+    },
+  },
+
+  // SEC-HDR-006
+  {
+    id: 'SEC-HDR-006', category: 'security', severity: 'medium', confidence: 'likely',
+    title: 'Missing Referrer-Policy header',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+      const has = [...files.values()].some(c => c.includes('Referrer-Policy') || c.includes('referrerPolicy'));
+      const hasHelmet = 'helmet' in (stack.dependencies || {});
+      if (!has && !hasHelmet) {
+        findings.push({
+          ruleId: 'SEC-HDR-006', category: 'security', severity: 'medium',
+          title: 'Missing Referrer-Policy — URLs leaked to third parties via referrer',
+          fix: null,
+        });
+      }
+      return findings;
+    },
+  },
+
+  // SEC-HDR-007
+  {
+    id: 'SEC-HDR-007', category: 'security', severity: 'medium', confidence: 'likely',
+    title: 'Missing Permissions-Policy header',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+      const has = [...files.values()].some(c =>
+        c.includes('Permissions-Policy') || c.includes('Feature-Policy') || c.includes('permissionsPolicy')
+      );
+      const hasHelmet = 'helmet' in (stack.dependencies || {});
+      if (!has && !hasHelmet) {
+        findings.push({
+          ruleId: 'SEC-HDR-007', category: 'security', severity: 'medium',
+          title: 'Missing Permissions-Policy — browser features (camera, mic, location) not restricted',
+          fix: null,
+        });
+      }
+      return findings;
+    },
+  },
+
+  // SEC-HDR-008
+  {
+    id: 'SEC-HDR-008', category: 'security', severity: 'low', confidence: 'suggestion',
+    title: 'Server header exposes version info',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, content] of files) {
+        if (!isJS(fp)) continue;
+        if (content.match(/(?:res|response)\.(?:setHeader|set)\s*\(\s*['"]Server['"]/i)) {
+          findings.push({
+            ruleId: 'SEC-HDR-008', category: 'security', severity: 'low',
+            title: 'Server header set — may expose server technology and version',
+            file: fp, fix: null,
+          });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // SEC-HDR-009
+  {
+    id: 'SEC-HDR-009', category: 'security', severity: 'low', confidence: 'suggestion',
+    title: 'X-Powered-By header exposed',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.framework !== 'express') return findings;
+      const hasHelmet = 'helmet' in (stack.dependencies || {});
+      const disablesPoweredBy = [...files.values()].some(c =>
+        c.includes('x-powered-by') || c.includes('X-Powered-By') || c.includes('hidePoweredBy') || c.includes("disable('x-powered-by')")
+      );
+      if (!hasHelmet && !disablesPoweredBy) {
+        findings.push({
+          ruleId: 'SEC-HDR-009', category: 'security', severity: 'low',
+          title: 'Express X-Powered-By header reveals technology stack',
+          description: 'Use app.disable("x-powered-by") or helmet to remove it.',
+          fix: null,
+        });
+      }
+      return findings;
+    },
+  },
+
+  // SEC-HDR-010
+  {
+    id: 'SEC-HDR-010', category: 'security', severity: 'medium', confidence: 'likely',
+    title: 'Insecure CSP with unsafe-inline/unsafe-eval',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, content] of files) {
+        if (!isJS(fp)) continue;
+        if (content.includes('Content-Security-Policy') || content.includes('contentSecurityPolicy')) {
+          if (content.includes("'unsafe-inline'") || content.includes("'unsafe-eval'")) {
+            findings.push({
+              ruleId: 'SEC-HDR-010', category: 'security', severity: 'medium',
+              title: 'CSP includes unsafe-inline or unsafe-eval — weakens XSS protection',
+              file: fp, fix: null,
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // SEC-HDR-011
+  {
+    id: 'SEC-HDR-011', category: 'security', severity: 'high', confidence: 'likely',
+    title: 'No helmet.js in Express app',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.framework !== 'express') return findings;
+      if (!('helmet' in (stack.dependencies || {}))) {
+        findings.push({
+          ruleId: 'SEC-HDR-011', category: 'security', severity: 'high',
+          title: 'Express app without helmet middleware — no security headers set',
+          description: 'Install and use helmet to automatically set security headers.',
+          fix: null,
+        });
+      }
+      return findings;
+    },
+  },
+];
+
+export default rules;

package/src/rules/security/index.js

@@ -0,0 +1,65 @@
+import injectionRules from './injection.js';
+import xssRules from './xss.js';
+import csrfRules from './csrf.js';
+import headersRules from './headers.js';
+import corsRules from './cors.js';
+import rateLimitingRules from './rate-limiting.js';
+import fileUploadRules from './file-upload.js';
+import cryptoRules from './crypto.js';
+import secretsRules from './secrets.js';
+import misconfigRules from './misconfiguration.js';
+import authRules from './auth.js';
+import supplyChainRules from './supply-chain.js';
+import taintRules from './taint.js';
+import prototypePollutionRules from './prototype-pollution.js';
+import ssrfRules from './ssrf.js';
+import deserializationRules from './deserialization.js';
+import pathTraversalRules from './path-traversal.js';
+import oauthJwtRules from './oauth-jwt.js';
+import supplyChainAdvancedRules from './supply-chain-advanced.js';
+import goRules from './go.js';
+import rustRules from './rust.js';
+import csharpRules from './csharp.js';
+import swiftRules from './swift.js';
+import dartRules from './dart.js';
+import shellRules from './shell.js';
+import rubyRules from './ruby.js';
+import phpRules from './php.js';
+import scopeRules from '../scope-rules.js';
+import mcpServerRules from './mcp-server.js';
+import aiApiRules from './ai-api.js';
+
+const rules = [
+  ...injectionRules,
+  ...xssRules,
+  ...csrfRules,
+  ...headersRules,
+  ...corsRules,
+  ...rateLimitingRules,
+  ...fileUploadRules,
+  ...cryptoRules,
+  ...secretsRules,
+  ...misconfigRules,
+  ...authRules,
+  ...supplyChainRules,
+  ...taintRules,
+  ...prototypePollutionRules,
+  ...ssrfRules,
+  ...deserializationRules,
+  ...pathTraversalRules,
+  ...oauthJwtRules,
+  ...supplyChainAdvancedRules,
+  ...goRules,
+  ...rustRules,
+  ...csharpRules,
+  ...swiftRules,
+  ...dartRules,
+  ...shellRules,
+  ...rubyRules,
+  ...phpRules,
+  ...scopeRules,
+  ...mcpServerRules,
+  ...aiApiRules,
+];
+
+export default rules;