guardvibe 2.1.1 → 2.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,274 @@
|
|
|
1
|
+
// Advanced security rules that catch patterns AI assistants commonly generate
|
|
2
|
+
// These cover gaps in OWASP Top 10, CWE Top 25, and OWASP API Security Top 10
|
|
3
|
+
export const advancedSecurityRules = [
|
|
4
|
+
// ── HTTP Response Header Injection (CWE-113) ─────────────────────
|
|
5
|
+
{
|
|
6
|
+
id: "VG130",
|
|
7
|
+
name: "HTTP Response Header Injection",
|
|
8
|
+
severity: "high",
|
|
9
|
+
owasp: "A02:2025 Injection",
|
|
10
|
+
description: "User input is interpolated into HTTP response headers. Attackers can inject CRLF characters to add arbitrary headers (Set-Cookie, Location) or split the response.",
|
|
11
|
+
pattern: /(?:setHeader|set|append|headers\.set)\s*\(\s*["'][^"']+["']\s*,\s*(?:`[^`]*\$\{|[^"']*\+\s*(?:req\.|request\.|params\.|query\.|searchParams|input|body|user))/gi,
|
|
12
|
+
languages: ["javascript", "typescript"],
|
|
13
|
+
fix: "Never interpolate user input into response headers. Sanitize by removing \\r and \\n characters.",
|
|
14
|
+
fixCode: '// Sanitize header values\nconst safeValue = userInput.replace(/[\\r\\n]/g, "");\nres.setHeader("Content-Disposition", `attachment; filename="${safeValue}"`);',
|
|
15
|
+
compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
|
|
16
|
+
},
|
|
17
|
+
// ── CSRF via State-Changing GET (CWE-352) ─────────────────────────
|
|
18
|
+
{
|
|
19
|
+
id: "VG131",
|
|
20
|
+
name: "State-Changing GET Request",
|
|
21
|
+
severity: "high",
|
|
22
|
+
owasp: "A01:2025 Broken Access Control",
|
|
23
|
+
description: "GET handler performs database mutations (delete, update, create). GET requests should be idempotent and safe. State-changing operations in GET handlers are vulnerable to CSRF via img tags, link prefetching, and browser preloading.",
|
|
24
|
+
pattern: /export\s+(?:async\s+)?function\s+GET\s*\([^)]*\)\s*\{[\s\S]{0,1000}?(?:\.delete\s*\(|\.update\s*\(|\.create\s*\(|\.destroy\s*\(|\.remove\s*\(|\.insert\s*\(|DELETE\s+FROM|UPDATE\s+|INSERT\s+INTO)/gi,
|
|
25
|
+
languages: ["javascript", "typescript"],
|
|
26
|
+
fix: "Move state-changing operations to POST/PUT/DELETE handlers. GET should only read data.",
|
|
27
|
+
fixCode: '// BAD: mutation in GET\nexport async function GET(req: Request) {\n await db.post.delete({ where: { id } }); // CSRF risk!\n}\n\n// GOOD: use POST/DELETE\nexport async function DELETE(req: Request) {\n await db.post.delete({ where: { id } });\n}',
|
|
28
|
+
compliance: ["SOC2:CC6.6"],
|
|
29
|
+
},
|
|
30
|
+
// ── Missing Request Body Size Limit ───────────────────────────────
|
|
31
|
+
{
|
|
32
|
+
id: "VG132",
|
|
33
|
+
name: "Missing Request Body Size Limit",
|
|
34
|
+
severity: "medium",
|
|
35
|
+
owasp: "API4:2023 Unrestricted Resource Consumption",
|
|
36
|
+
description: "API endpoint reads request body without size limit. Attackers can send multi-gigabyte payloads to exhaust server memory and cause denial of service.",
|
|
37
|
+
pattern: /export\s+(?:async\s+)?function\s+(?:POST|PUT|PATCH)\s*\([^)]*\)\s*\{(?:(?!content-length|maxBodySize|limit|MAX_)[\s\S]){5,}?(?:req\.json|req\.text|req\.body|req\.formData|request\.json|request\.text)\s*\(\s*\)/g,
|
|
38
|
+
languages: ["javascript", "typescript"],
|
|
39
|
+
fix: "Check Content-Length header before parsing body, or use a body parser with size limit.",
|
|
40
|
+
fixCode: '// Check body size before parsing\nexport async function POST(req: Request) {\n const contentLength = parseInt(req.headers.get("content-length") || "0");\n if (contentLength > 1024 * 1024) { // 1MB limit\n return new Response("Payload too large", { status: 413 });\n }\n const body = await req.json();\n}',
|
|
41
|
+
compliance: ["SOC2:CC7.1"],
|
|
42
|
+
},
|
|
43
|
+
// ── Race Condition in Check-Then-Act ──────────────────────────────
|
|
44
|
+
{
|
|
45
|
+
id: "VG133",
|
|
46
|
+
name: "Race Condition: Check-Then-Act Without Transaction",
|
|
47
|
+
severity: "high",
|
|
48
|
+
owasp: "A04:2025 Insecure Design",
|
|
49
|
+
description: "Code reads a value, checks a condition, then updates based on the check — without a database transaction. Two concurrent requests can both pass the check before either writes, leading to double-spending, overselling, or duplicate operations.",
|
|
50
|
+
pattern: /(?:findUnique|findFirst|findOne|findById)\s*\([\s\S]{0,200}?\)\s*;?\s*\n[\s\S]{0,300}?if\s*\([\s\S]{0,200}?\)\s*\{[\s\S]{0,500}?(?:\.update\s*\(|\.delete\s*\(|\.decrement|\.increment)(?:(?!\$transaction|\.transaction|BEGIN|SERIALIZABLE|FOR UPDATE|NOWAIT)[\s\S]){0,300}?\}/g,
|
|
51
|
+
languages: ["javascript", "typescript"],
|
|
52
|
+
fix: "Wrap check-then-act sequences in a database transaction, or use atomic operations (e.g., UPDATE WHERE balance >= amount).",
|
|
53
|
+
fixCode: '// BAD: race condition\nconst account = await db.account.findUnique({ where: { id } });\nif (account.balance >= 100) {\n await db.account.update({ where: { id }, data: { balance: { decrement: 100 } } });\n}\n\n// GOOD: atomic transaction\nawait db.$transaction(async (tx) => {\n const account = await tx.account.findUnique({ where: { id } });\n if (account.balance < 100) throw new Error("Insufficient");\n await tx.account.update({ where: { id }, data: { balance: { decrement: 100 } } });\n});',
|
|
54
|
+
compliance: ["SOC2:CC7.1"],
|
|
55
|
+
},
|
|
56
|
+
// ── WebSocket Without Authentication ──────────────────────────────
|
|
57
|
+
{
|
|
58
|
+
id: "VG134",
|
|
59
|
+
name: "WebSocket Connection Without Authentication",
|
|
60
|
+
severity: "high",
|
|
61
|
+
owasp: "A01:2025 Broken Access Control",
|
|
62
|
+
description: "WebSocket server accepts connections without verifying authentication. Any client can connect and receive or send data.",
|
|
63
|
+
pattern: /(?:WebSocketServer|WebSocket\.Server|new\s+Server)\s*\([\s\S]{0,200}?\)[\s\S]{0,300}?\.on\s*\(\s*["']connection["'][\s\S]{0,500}?(?:(?!auth|token|verify|session|cookie|jwt|bearer)[\s\S]){10,}?\.on\s*\(\s*["']message["']/gi,
|
|
64
|
+
languages: ["javascript", "typescript"],
|
|
65
|
+
fix: "Verify authentication token in the WebSocket upgrade request or first message.",
|
|
66
|
+
fixCode: '// Verify auth on connection\nwss.on("connection", (ws, req) => {\n const token = new URL(req.url!, "http://localhost").searchParams.get("token");\n if (!verifyToken(token)) { ws.close(1008, "Unauthorized"); return; }\n ws.on("message", (msg) => { /* handle */ });\n});',
|
|
67
|
+
compliance: ["SOC2:CC6.6"],
|
|
68
|
+
},
|
|
69
|
+
// ── SSE/Streaming Without Authentication ──────────────────────────
|
|
70
|
+
{
|
|
71
|
+
id: "VG135",
|
|
72
|
+
name: "Server-Sent Events Without Authentication",
|
|
73
|
+
severity: "high",
|
|
74
|
+
owasp: "A01:2025 Broken Access Control",
|
|
75
|
+
description: "Server-Sent Events endpoint streams data without authentication check. Anyone can subscribe and receive real-time updates.",
|
|
76
|
+
pattern: /["']text\/event-stream["'][\s\S]{0,500}?(?:export\s+(?:async\s+)?function\s+GET|new\s+Response\s*\()(?:(?!auth\s*\(|getServerSession|currentUser|verifyToken|session|protect)[\s\S]){5,}/gi,
|
|
77
|
+
languages: ["javascript", "typescript"],
|
|
78
|
+
fix: "Add authentication check before establishing SSE connection.",
|
|
79
|
+
compliance: ["SOC2:CC6.6"],
|
|
80
|
+
},
|
|
81
|
+
// ── postMessage Without Origin Check ──────────────────────────────
|
|
82
|
+
{
|
|
83
|
+
id: "VG136",
|
|
84
|
+
name: "postMessage Handler Without Origin Validation",
|
|
85
|
+
severity: "high",
|
|
86
|
+
owasp: "A07:2025 Cross-Site Scripting",
|
|
87
|
+
description: "Window message event handler processes data without checking event.origin. Any page (including malicious iframes) can send messages to this handler.",
|
|
88
|
+
pattern: /addEventListener\s*\(\s*["']message["']\s*,\s*(?:async\s+)?(?:\([^)]*\)|(?:event|e|evt|msg))\s*(?:=>|{)(?:(?!\.origin|event\.source)[\s\S]){5,}?(?:JSON\.parse|\.data|innerHTML|setState|dispatch|update|execute)/gi,
|
|
89
|
+
languages: ["javascript", "typescript"],
|
|
90
|
+
fix: "Always check event.origin against trusted origins before processing message data.",
|
|
91
|
+
fixCode: '// Always validate origin\nwindow.addEventListener("message", (event) => {\n if (event.origin !== "https://trusted.example.com") return;\n const data = JSON.parse(event.data);\n processData(data);\n});',
|
|
92
|
+
compliance: ["SOC2:CC7.1"],
|
|
93
|
+
},
|
|
94
|
+
// ── Debug/Internal Endpoint Exposed ───────────────────────────────
|
|
95
|
+
{
|
|
96
|
+
id: "VG137",
|
|
97
|
+
name: "Debug Endpoint Exposes System Information",
|
|
98
|
+
severity: "critical",
|
|
99
|
+
owasp: "A05:2025 Security Misconfiguration",
|
|
100
|
+
description: "Route exposes system internals (process.env, process.memoryUsage, os.cpus, debug data) that help attackers map the infrastructure.",
|
|
101
|
+
pattern: /(?:\/debug|\/internal|\/_internal|\/test|\/dev)\b[\s\S]{0,300}?(?:process\.env|process\.memoryUsage|os\.cpus|os\.hostname|process\.uptime|process\.version)/gi,
|
|
102
|
+
languages: ["javascript", "typescript"],
|
|
103
|
+
fix: "Remove debug endpoints from production code, or protect them with authentication and restrict to internal networks.",
|
|
104
|
+
compliance: ["SOC2:CC6.1"],
|
|
105
|
+
},
|
|
106
|
+
// ── Plaintext Password Comparison ─────────────────────────────────
|
|
107
|
+
{
|
|
108
|
+
id: "VG138",
|
|
109
|
+
name: "Plaintext Password Comparison",
|
|
110
|
+
severity: "critical",
|
|
111
|
+
owasp: "A02:2025 Cryptographic Failures",
|
|
112
|
+
description: "Password is compared using direct string equality (=== or ==) instead of a hashing function. This means passwords are stored or transmitted in plaintext.",
|
|
113
|
+
pattern: /(?:password|passwd|pwd)\s*(?:===|!==|==|!=)\s*(?:(?:req|request|body|input|data|form|user)[\.\[]|["'])/gi,
|
|
114
|
+
languages: ["javascript", "typescript", "python"],
|
|
115
|
+
fix: "Never compare passwords directly. Use bcrypt.compare() or argon2.verify() to compare against hashed passwords.",
|
|
116
|
+
fixCode: '// BAD: plaintext comparison\nif (user.password === inputPassword) { ... }\n\n// GOOD: hash comparison\nimport bcrypt from "bcrypt";\nconst valid = await bcrypt.compare(inputPassword, user.passwordHash);\nif (!valid) return new Response("Invalid", { status: 401 });',
|
|
117
|
+
compliance: ["SOC2:CC6.1", "PCI-DSS:Req8"],
|
|
118
|
+
},
|
|
119
|
+
// ── TLS Certificate Verification Disabled ─────────────────────────
|
|
120
|
+
{
|
|
121
|
+
id: "VG139",
|
|
122
|
+
name: "TLS Certificate Verification Disabled",
|
|
123
|
+
severity: "critical",
|
|
124
|
+
owasp: "A02:2025 Cryptographic Failures",
|
|
125
|
+
description: "TLS certificate verification is disabled, allowing man-in-the-middle attacks. All HTTPS connections become insecure.",
|
|
126
|
+
pattern: /(?:NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*["']0["']|rejectUnauthorized\s*:\s*false|verify\s*=\s*False|InsecureSkipVerify\s*:\s*true)/gi,
|
|
127
|
+
languages: ["javascript", "typescript", "python", "go"],
|
|
128
|
+
fix: "Never disable TLS verification in production. Fix certificate issues instead.",
|
|
129
|
+
fixCode: '// BAD: disables all TLS verification\n// process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";\n// const agent = new https.Agent({ rejectUnauthorized: false });\n\n// GOOD: fix the certificate issue\n// - Use valid certificates (Let\'s Encrypt)\n// - Add CA certificate to Node: --use-openssl-ca\n// - For self-signed dev certs: only disable in NODE_ENV=development',
|
|
130
|
+
compliance: ["SOC2:CC6.1", "PCI-DSS:Req4.1"],
|
|
131
|
+
},
|
|
132
|
+
// ── XXE (XML External Entity) ─────────────────────────────────────
|
|
133
|
+
{
|
|
134
|
+
id: "VG140",
|
|
135
|
+
name: "XML Parsing Without Disabling External Entities",
|
|
136
|
+
severity: "high",
|
|
137
|
+
owasp: "A02:2025 Injection",
|
|
138
|
+
description: "XML is parsed without disabling external entity resolution. Attackers can use XXE to read local files, perform SSRF, or cause denial of service.",
|
|
139
|
+
pattern: /(?:parseStringPromise|parseString|DOMParser|xml2js|xmldom|libxmljs|(?:fast-xml-parser|XMLParser))\s*[\.(](?:(?!processExternalEntities\s*:\s*false|noent\s*:\s*false|resolveExternals\s*:\s*false|entityMode|FORBID_DTD)[\s\S]){5,}?(?:req\.|request\.|body|input|data|text)/gi,
|
|
140
|
+
languages: ["javascript", "typescript"],
|
|
141
|
+
fix: "Disable external entity processing in your XML parser configuration.",
|
|
142
|
+
fixCode: '// xml2js: external entities disabled by default (safe)\nimport { parseStringPromise } from "xml2js";\nconst result = await parseStringPromise(xmlInput);\n\n// fast-xml-parser: safe by default\nimport { XMLParser } from "fast-xml-parser";\nconst parser = new XMLParser({ processEntities: false });\nconst result = parser.parse(xmlInput);',
|
|
143
|
+
compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
|
|
144
|
+
},
|
|
145
|
+
// ── YAML Unsafe Load ──────────────────────────────────────────────
|
|
146
|
+
{
|
|
147
|
+
id: "VG141",
|
|
148
|
+
name: "YAML Parsed with Unsafe Loader",
|
|
149
|
+
severity: "high",
|
|
150
|
+
owasp: "A08:2025 Software and Data Integrity Failures",
|
|
151
|
+
description: "YAML is parsed using an unsafe loader that can execute arbitrary code via !!js/function, !!python/object, or other language-specific tags.",
|
|
152
|
+
pattern: /yaml\.(?:load|unsafeLoad)\s*\(\s*(?![\s\S]{0,30}?(?:JSON_SCHEMA|FAILSAFE_SCHEMA|CORE_SCHEMA|safeLoad))/gi,
|
|
153
|
+
languages: ["javascript", "typescript", "python"],
|
|
154
|
+
fix: "Use yaml.safeLoad() or yaml.load(input, { schema: yaml.JSON_SCHEMA }).",
|
|
155
|
+
fixCode: '// BAD: allows code execution\n// yaml.load(userInput)\n\n// GOOD: safe schema\nimport yaml from "js-yaml";\nconst config = yaml.load(userInput, { schema: yaml.JSON_SCHEMA });',
|
|
156
|
+
compliance: ["SOC2:CC7.1"],
|
|
157
|
+
},
|
|
158
|
+
// ── Missing Subresource Integrity ─────────────────────────────────
|
|
159
|
+
{
|
|
160
|
+
id: "VG142",
|
|
161
|
+
name: "External Script Without Subresource Integrity",
|
|
162
|
+
severity: "medium",
|
|
163
|
+
owasp: "A08:2025 Software and Data Integrity Failures",
|
|
164
|
+
description: "External script loaded from CDN without integrity attribute. If the CDN is compromised, malicious code executes in your users' browsers.",
|
|
165
|
+
pattern: /<script\s+[^>]*src\s*=\s*["']https?:\/\/(?:(?!integrity)[\s\S])*?>/gi,
|
|
166
|
+
languages: ["html", "javascript", "typescript"],
|
|
167
|
+
fix: "Add integrity and crossorigin attributes to external script tags.",
|
|
168
|
+
fixCode: '<!-- Add SRI hash -->\n<script\n src="https://cdn.example.com/lib.js"\n integrity="sha384-HASH_HERE"\n crossorigin="anonymous"\n></script>\n\n<!-- Generate hash: openssl dgst -sha384 -binary lib.js | base64 -->',
|
|
169
|
+
compliance: ["SOC2:CC7.1"],
|
|
170
|
+
},
|
|
171
|
+
// ── CSP Missing frame-ancestors ───────────────────────────────────
|
|
172
|
+
{
|
|
173
|
+
id: "VG143",
|
|
174
|
+
name: "CSP Missing frame-ancestors Directive",
|
|
175
|
+
severity: "medium",
|
|
176
|
+
owasp: "A05:2025 Security Misconfiguration",
|
|
177
|
+
description: "Content-Security-Policy is set but lacks frame-ancestors directive. Without it, the page can be embedded in malicious iframes for clickjacking attacks. frame-ancestors supersedes X-Frame-Options.",
|
|
178
|
+
pattern: /Content-Security-Policy["']\s*[,:]\s*["'][^"']*(?:default-src|script-src)(?:(?!frame-ancestors)[^"'])*["']/gi,
|
|
179
|
+
languages: ["javascript", "typescript"],
|
|
180
|
+
fix: "Add frame-ancestors 'self' to your Content-Security-Policy header.",
|
|
181
|
+
fixCode: '// Add frame-ancestors to CSP\nheaders: [\n {\n key: "Content-Security-Policy",\n value: "default-src \'self\'; frame-ancestors \'self\'; script-src \'self\'"\n }\n]',
|
|
182
|
+
compliance: ["SOC2:CC6.1"],
|
|
183
|
+
},
|
|
184
|
+
// ── Missing Referrer-Policy ───────────────────────────────────────
|
|
185
|
+
{
|
|
186
|
+
id: "VG144",
|
|
187
|
+
name: "Missing Referrer-Policy Header",
|
|
188
|
+
severity: "medium",
|
|
189
|
+
owasp: "A05:2025 Security Misconfiguration",
|
|
190
|
+
description: "Security headers are configured but Referrer-Policy is missing. Without it, the full URL (including query parameters with tokens/IDs) is sent to external sites in the Referer header.",
|
|
191
|
+
pattern: /(?:async\s+)?headers\s*\(\s*\)\s*\{[\s\S]{10,}?(?:X-Frame-Options|Strict-Transport-Security|Content-Security-Policy)(?:(?!Referrer-Policy)[\s\S]){10,}?\}/g,
|
|
192
|
+
languages: ["javascript", "typescript"],
|
|
193
|
+
fix: "Add Referrer-Policy: strict-origin-when-cross-origin to your security headers.",
|
|
194
|
+
fixCode: '{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" }',
|
|
195
|
+
compliance: ["SOC2:CC6.1"],
|
|
196
|
+
},
|
|
197
|
+
// ── Missing Permissions-Policy ────────────────────────────────────
|
|
198
|
+
{
|
|
199
|
+
id: "VG145",
|
|
200
|
+
name: "Missing Permissions-Policy Header",
|
|
201
|
+
severity: "medium",
|
|
202
|
+
owasp: "A05:2025 Security Misconfiguration",
|
|
203
|
+
description: "Security headers are configured but Permissions-Policy is missing. Without it, embedded iframes and scripts can access camera, microphone, geolocation, and other sensitive browser APIs.",
|
|
204
|
+
pattern: /(?:async\s+)?headers\s*\(\s*\)\s*\{[\s\S]{10,}?(?:X-Frame-Options|Strict-Transport-Security|Content-Security-Policy)(?:(?!Permissions-Policy)[\s\S]){10,}?\}/g,
|
|
205
|
+
languages: ["javascript", "typescript"],
|
|
206
|
+
fix: "Add Permissions-Policy header to restrict browser API access.",
|
|
207
|
+
fixCode: '{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" }',
|
|
208
|
+
compliance: ["SOC2:CC6.1"],
|
|
209
|
+
},
|
|
210
|
+
// ── Unquoted .env Value ───────────────────────────────────────────
|
|
211
|
+
{
|
|
212
|
+
id: "VG146",
|
|
213
|
+
name: "Unquoted .env Value with Special Characters",
|
|
214
|
+
severity: "medium",
|
|
215
|
+
owasp: "A05:2025 Security Misconfiguration",
|
|
216
|
+
description: "Environment variable value contains special characters but is not quoted. This can cause parsing errors or shell injection when the .env file is sourced.",
|
|
217
|
+
pattern: /^[A-Z_]+=(?:[^"'\s]*[@#$&|;`\\(){}[\]!<>^~*?])/gm,
|
|
218
|
+
languages: ["shell"],
|
|
219
|
+
fix: "Quote .env values that contain special characters.",
|
|
220
|
+
fixCode: '# BAD: unquoted special characters\nDATABASE_URL=postgres://user:p@ss@host/db\n\n# GOOD: quoted\nDATABASE_URL="postgres://user:p@ss@host/db"',
|
|
221
|
+
compliance: ["SOC2:CC6.1"],
|
|
222
|
+
},
|
|
223
|
+
// ── Audit Logging Missing for Critical Operations ─────────────────
|
|
224
|
+
{
|
|
225
|
+
id: "VG147",
|
|
226
|
+
name: "Critical Operation Without Audit Logging",
|
|
227
|
+
severity: "medium",
|
|
228
|
+
owasp: "A09:2025 Security Logging and Monitoring Failures",
|
|
229
|
+
description: "Destructive database operation (delete user, change role, update payment) has no audit logging. Without audit trails, security incidents cannot be investigated.",
|
|
230
|
+
pattern: /(?:deleteUser|deleteAccount|updateRole|changeRole|cancelSubscription|refund|transferFunds|resetPassword|changePassword|deleteOrg|removeUser|banUser|suspendUser|updatePermission)\s*(?:=\s*async|\([\s\S]*?\)\s*(?:=>|{))[\s\S]{0,500}?(?:\.delete\s*\(|\.update\s*\(|\.destroy\s*\()(?:(?!console\.log|logger\.|audit\.|log\.|createAuditLog|logAction|trackEvent|analytics)[\s\S]){0,300}?(?:return|Response)/gi,
|
|
231
|
+
languages: ["javascript", "typescript"],
|
|
232
|
+
fix: "Add audit logging for all critical operations: who did what, when, and to whom.",
|
|
233
|
+
fixCode: 'async function deleteUser(targetId: string) {\n const { userId } = await auth();\n await db.user.delete({ where: { id: targetId } });\n // Audit log\n await db.auditLog.create({\n data: { action: "DELETE_USER", actorId: userId, targetId, timestamp: new Date() }\n });\n}',
|
|
234
|
+
compliance: ["SOC2:CC7.2", "HIPAA:§164.312(b)", "GDPR:Art30"],
|
|
235
|
+
},
|
|
236
|
+
// ── Login Without Brute Force Protection ──────────────────────────
|
|
237
|
+
{
|
|
238
|
+
id: "VG148",
|
|
239
|
+
name: "Login Endpoint Without Brute Force Protection",
|
|
240
|
+
severity: "high",
|
|
241
|
+
owasp: "A07:2025 Identification and Authentication Failures",
|
|
242
|
+
description: "Login/authentication endpoint compares passwords without rate limiting or account lockout. Attackers can try unlimited password combinations.",
|
|
243
|
+
pattern: /(?:signIn|login|authenticate|logIn)\b[\s\S]{0,500}?(?:bcrypt\.compare|argon2\.verify|compare|verify)[\s\S]{0,300}?(?:(?!rateLimit|limiter|throttle|lockout|maxAttempts|failedAttempts|loginAttempts|Ratelimit)[\s\S]){5,}?(?:return|Response|res\.)/gi,
|
|
244
|
+
languages: ["javascript", "typescript"],
|
|
245
|
+
fix: "Add rate limiting and account lockout to login endpoints.",
|
|
246
|
+
fixCode: '// Add rate limiting to login\nimport { Ratelimit } from "@upstash/ratelimit";\nconst loginLimiter = new Ratelimit({\n redis: Redis.fromEnv(),\n limiter: Ratelimit.slidingWindow(5, "15 m"), // 5 attempts per 15 min\n});\n\nconst { success } = await loginLimiter.limit(email);\nif (!success) return new Response("Too many attempts", { status: 429 });',
|
|
247
|
+
compliance: ["SOC2:CC6.6", "PCI-DSS:Req8"],
|
|
248
|
+
},
|
|
249
|
+
// ── Multi-Tenant Data Leak ────────────────────────────────────────
|
|
250
|
+
{
|
|
251
|
+
id: "VG149",
|
|
252
|
+
name: "Multi-Tenant Query Without Tenant Scoping",
|
|
253
|
+
severity: "high",
|
|
254
|
+
owasp: "A01:2025 Broken Access Control",
|
|
255
|
+
description: "Endpoint authenticates a user/org but queries the database without filtering by tenant ID. Returns data from ALL tenants instead of only the authenticated tenant's data.",
|
|
256
|
+
pattern: /(?:orgId|tenantId|organizationId|org_id|tenant_id)\s*[\s\S]{0,200}?(?:findMany|findAll|getAll|fetchAll)\s*\(\s*(?:\{(?:(?!orgId|tenantId|organizationId|org_id|tenant_id)[\s\S]){5,}?\}|\s*\))/gi,
|
|
257
|
+
languages: ["javascript", "typescript"],
|
|
258
|
+
fix: "Always include the tenant/org ID in the WHERE clause of every query.",
|
|
259
|
+
fixCode: '// BAD: returns all tenants\' data\nconst { orgId } = await auth();\nconst items = await db.item.findMany(); // missing orgId filter!\n\n// GOOD: scoped to tenant\nconst items = await db.item.findMany({ where: { orgId } });',
|
|
260
|
+
compliance: ["SOC2:CC6.1", "HIPAA:§164.312(a)"],
|
|
261
|
+
},
|
|
262
|
+
// ── Lockfile in .gitignore ────────────────────────────────────────
|
|
263
|
+
{
|
|
264
|
+
id: "VG150",
|
|
265
|
+
name: "Package Lockfile Excluded from Git",
|
|
266
|
+
severity: "high",
|
|
267
|
+
owasp: "A08:2025 Software and Data Integrity Failures",
|
|
268
|
+
description: "package-lock.json, yarn.lock, or pnpm-lock.yaml is in .gitignore. Without a committed lockfile, builds are non-reproducible and vulnerable to dependency confusion and supply chain attacks.",
|
|
269
|
+
pattern: /^(?:package-lock\.json|yarn\.lock|pnpm-lock\.yaml)\s*$/gm,
|
|
270
|
+
languages: ["shell"],
|
|
271
|
+
fix: "Remove the lockfile from .gitignore and commit it to the repository.",
|
|
272
|
+
compliance: ["SOC2:CC7.1"],
|
|
273
|
+
},
|
|
274
|
+
];
|
|
@@ -20,6 +20,7 @@ import { supplyChainRules } from "./supply-chain.js";
|
|
|
20
20
|
import { cveVersionRules } from "./cve-versions.js";
|
|
21
21
|
import { apiSecurityRules } from "./api-security.js";
|
|
22
22
|
import { modernStackRules } from "./modern-stack.js";
|
|
23
|
+
import { advancedSecurityRules } from "./advanced-security.js";
|
|
23
24
|
import { enrichRulesWithCompliance } from "../compliance-metadata.js";
|
|
24
25
|
export const owaspRules = enrichRulesWithCompliance([
|
|
25
26
|
...coreRules,
|
|
@@ -44,6 +45,7 @@ export const owaspRules = enrichRulesWithCompliance([
|
|
|
44
45
|
...cveVersionRules,
|
|
45
46
|
...apiSecurityRules,
|
|
46
47
|
...modernStackRules,
|
|
48
|
+
...advancedSecurityRules,
|
|
47
49
|
]);
|
|
48
50
|
// Alias for clarity — these are the built-in rules without plugins
|
|
49
51
|
export const builtinRules = owaspRules;
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "guardvibe",
|
|
3
|
-
"version": "2.
|
|
4
|
-
"description": "Security MCP for vibe coding.
|
|
3
|
+
"version": "2.2.0",
|
|
4
|
+
"description": "Security MCP for vibe coding. 307 rules, 24 tools for Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
7
7
|
"guardvibe": "build/cli.js",
|