iamsecure 0.0.0-stage → 0.1.0

package/src/code/context.js

@@ -0,0 +1,123 @@
+// Works out WHERE code runs (server, browser, build/test) and which packages each file imports.
+// This is what lets a ReDoS in a browser-only package rank far below the same bug on the server.
+
+import { builtinModules } from 'node:module';
+
+const BUILTINS = new Set(builtinModules.flatMap((m) => [m, `node:${m}`]));
+
+export const CONTEXT_LABEL = {
+  server: 'runs on server',
+  client: 'browser only',
+  universal: 'server + browser',
+  build: 'build/test only',
+  unused: 'installed, not imported',
+  unknown: 'usage unknown',
+};
+
+const TEST_RE = /(^|\/)(__tests__|__mocks__|tests?|e2e|cypress|playwright|stories|fixtures)\/|\.(test|spec|stories|cy|e2e)\.[cm]?[jt]sx?$/;
+const BUILD_RE = /(^|\/)[^/]+\.config\.[cm]?[jt]s$|(^|\/)(scripts|tools|\.storybook|\.github|\.husky)\/|(^|\/)(gulpfile|gruntfile|Jakefile)\.[cm]?[jt]s$/i;
+const SERVER_HINT_RE = /\bfrom\s+['"](?:node:)?(fs|child_process|net|crypto|server-only|@prisma\/client|pg|mysql2?|mongoose|redis|ioredis)['"]|require\(\s*['"](?:node:)?(fs|child_process|net)['"]\)|\bprocess\.env\.(?!NEXT_PUBLIC_|VITE_|REACT_APP_)\w+/;
+const CLIENT_HINT_RE = /\b(useState|useEffect|useLayoutEffect|useReducer)\s*\(|\bwindow\.|\bdocument\.|\blocalStorage\b|from\s+['"]client-only['"]/;
+
+/**
+ * @param {string} rel  path relative to project root, forward slashes
+ * @param {string} text file contents
+ * @param {string} framework from detectFramework()
+ * @returns {'server'|'client'|'universal'|'build'}
+ */
+export function classifyFile(rel, text, framework) {
+  if (TEST_RE.test(rel) || BUILD_RE.test(rel)) return 'build';
+  if (/\.(php|py)$/.test(rel)) return 'server';
+
+  const head = text.slice(0, 400).replace(/^(\s|\/\/[^\n]*\n|\/\*[\s\S]*?\*\/)*/, '');
+  if (/^['"]use client['"]/.test(head)) return 'client';
+  if (/^['"]use server['"]/.test(head)) return 'server';
+  if (/from\s+['"]server-only['"]/.test(text)) return 'server';
+  if (/from\s+['"]client-only['"]/.test(text)) return 'client';
+  if (/\.server\.[cm]?[jt]sx?$|(^|\/)\+(page|layout)\.server\.|(^|\/)\+server\.[jt]s$/.test(rel)) return 'server';
+  if (/\.client\.[cm]?[jt]sx?$/.test(rel)) return 'client';
+
+  const p = rel.replace(/^(apps|packages)\/[^/]+\//, '');
+  switch (framework) {
+    case 'next':
+      if (/^(src\/)?pages\/api\//.test(p)) return 'server';
+      if (/^(src\/)?(middleware|instrumentation)\.[jt]s$/.test(p) || /^server\.[cm]?[jt]s$/.test(p)) return 'server';
+      if (/^(src\/)?app\//.test(p)) return 'server'; // React Server Components unless "use client"
+      if (/^(src\/)?pages\//.test(p)) return 'universal';
+      break;
+    case 'nuxt':
+    case 'sveltekit':
+    case 'remix':
+    case 'astro':
+      if (/^(src\/)?(server|api)\//.test(p)) return 'server';
+      break;
+    case 'cra':
+    case 'vite-spa':
+    case 'spa':
+      if (/^(server|api|backend|functions)\//.test(p)) return 'server';
+      return 'client';
+    case 'node-server':
+    case 'node':
+      return 'server';
+  }
+  const server = SERVER_HINT_RE.test(text);
+  const client = CLIENT_HINT_RE.test(text);
+  if (server && !client) return 'server';
+  if (client && !server) return 'client';
+  return 'universal';
+}
+
+const IMPORT_RE =
+  /(?:\bimport\s+(?:type\s+)?(?:[\w*{}\s,$]+?\s+from\s+)?|\bexport\s+(?:type\s+)?(?:[\w*{}\s,$]+?\s+)?from\s+|\brequire\s*\(\s*|\bimport\s*\(\s*)['"]([^'"\n]+)['"]/g;
+
+/** Package name for a bare import specifier, or null for relative/aliased/builtin imports. */
+export function packageOf(spec) {
+  if (/^[./~#]|^@\/|^[a-z]+:/i.test(spec) && !spec.startsWith('node:')) return null;
+  if (BUILTINS.has(spec) || BUILTINS.has(spec.split('/')[0])) return null;
+  const parts = spec.split('/');
+  return spec.startsWith('@') ? (parts.length > 1 ? `${parts[0]}/${parts[1]}` : null) : parts[0];
+}
+
+/** @returns {{pkg:string, line:number, binding:string|null}[]} */
+export function extractImports(text) {
+  const out = [];
+  for (const m of text.matchAll(IMPORT_RE)) {
+    const pkg = packageOf(m[1]);
+    if (!pkg) continue;
+    const line = text.slice(0, m.index).split('\n').length;
+    // Capture the local name: `import _ from 'lodash'`, `const jwt = require('jsonwebtoken')`, `import * as x`.
+    const before = text.slice(Math.max(0, m.index - 80), m.index + m[0].length);
+    const binding =
+      m[0].match(/^import\s+(?:type\s+)?(?:\*\s+as\s+)?([\w$]+)[\s,]/)?.[1] ??
+      before.match(/(?:const|let|var)\s+([\w$]+)\s*=\s*require\s*\(\s*['"][^'"]+['"]$/)?.[1] ??
+      null;
+    out.push({ pkg, line, binding });
+  }
+  return out;
+}
+
+/** Packages a framework loads for you even if no file imports them. */
+export function frameworkRuntime(framework) {
+  const ssr = ['server', 'client'];
+  const map = {
+    next: { next: ssr, react: ssr, 'react-dom': ssr },
+    nuxt: { nuxt: ssr, vue: ssr },
+    remix: { '@remix-run/node': ['server'], '@remix-run/react': ssr, react: ssr, 'react-dom': ssr },
+    sveltekit: { '@sveltejs/kit': ssr, svelte: ssr },
+    astro: { astro: ['server'] },
+    cra: { react: ['client'], 'react-dom': ['client'] },
+    'vite-spa': { react: ['client'], 'react-dom': ['client'], vue: ['client'], svelte: ['client'] },
+    spa: { react: ['client'], 'react-dom': ['client'], vue: ['client'] },
+  };
+  return map[framework] ?? {};
+}
+
+/** Merge a set of contexts into one exposure bucket. */
+export function mergeContexts(set) {
+  const s = new Set(set);
+  if (s.has('universal') || (s.has('server') && s.has('client'))) return 'universal';
+  if (s.has('server')) return 'server';
+  if (s.has('client')) return 'client';
+  if (s.has('build')) return 'build';
+  return null;
+}

package/src/code/engine.js

@@ -0,0 +1,117 @@
+import { stripComments } from './strip.js';
+import { RULES, SOURCES, langOf } from './rules.js';
+import { levelFromScore } from '../deps/cvss.js';
+
+const ASSIGN = {
+  js: /(?:const|let|var)\s+(?:\{([^}]+)\}|\[([^\]]+)\]|([\w$]+))\s*=\s*([^;\n]+)/g,
+  php: /(\$\w+)\s*=\s*([^;\n]+)/g,
+  py: /^\s*([\w, ]+?)\s*=\s*([^\n]+)/gm,
+};
+
+const clip = (s, n) => (s.length > n ? s.slice(0, n - 1) + '…' : s);
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+/**
+ * Lightweight intra-file taint tracking: variables assigned (directly or transitively)
+ * from a user-input source. Good enough to tell `exec(userInput)` from `exec("ls")`.
+ */
+export function taintedNames(code, lang) {
+  const names = new Set();
+  const src = SOURCES[lang];
+  // `[^\w$.]` before the name: `import.meta.url` is not the tainted variable `url`.
+  const isTainted = (rhs) => src.test(rhs) || [...names].some((n) => new RegExp(`(^|[^\\w$.])${escapeRe(n)}([^\\w$]|$)`).test(rhs));
+  for (let pass = 0; pass < 3; pass++) {
+    const before = names.size;
+    for (const m of code.matchAll(ASSIGN[lang])) {
+      if (lang === 'js') {
+        const [, destructObj, destructArr, single, rhs] = m;
+        if (!isTainted(rhs)) continue;
+        if (single) names.add(single);
+        for (const part of (destructObj ?? destructArr ?? '').split(',')) {
+          const name = part.split(':').pop().split('=')[0].trim().replace(/^\.\.\./, '');
+          if (/^[\w$]+$/.test(name)) names.add(name);
+        }
+      } else if (lang === 'php') {
+        if (isTainted(m[2])) names.add(m[1]);
+      } else {
+        if (!isTainted(m[2])) continue;
+        for (const n of m[1].split(',')) if (/^\w+$/.test(n.trim())) names.add(n.trim());
+      }
+    }
+    if (names.size === before) break;
+  }
+  return names;
+}
+
+function argsAfter(window, idx) {
+  // Text from the sink onwards, roughly up to the end of the call/statement.
+  return window.slice(idx).split(/;\s*(\n|$)/)[0];
+}
+
+const DYNAMIC = /\$\{|['"`]\s*\+|\+\s*['"`\w$]|\(\s*[\w$.[\]]+\s*[,)]|\(\s*\w+\s*\(|=\s*[\w$.[\]()]+\s*;?\s*$|\$\w+|\bf['"]|%\s*\(|\.format\(/;
+
+/**
+ * Run all rules over one file.
+ * @returns {any[]} findings
+ */
+export function scanFile(rel, text, fileContext) {
+  const lang = langOf(rel);
+  if (!lang) return [];
+  const rules = RULES[lang];
+  const code = stripComments(text, lang);
+  const lines = code.split('\n');
+  // Same text with string contents blanked: most sinks must appear in code, not inside a string.
+  const bare = stripComments(text, lang, { blankStrings: true }).split('\n');
+  const raw = text.split('\n');
+  const tainted = taintedNames(code, lang);
+  const taintRe = tainted.size
+    ? new RegExp(`(^|[^\\w$.])(${[...tainted].map(escapeRe).join('|')})([^\\w$]|$)`)
+    : null;
+  const findings = [];
+
+  for (const rule of rules) {
+    if (rule.requires && !rule.requires.test(code)) continue;
+    if (rule.fileExclude && rule.fileExclude.test(code)) continue;
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const m = rule.sink.exec(rule.inStrings ? line : bare[i]);
+      if (!m) continue;
+      if (rule.lineHint && !rule.lineHint.test(line)) continue;
+      if (rule.exclude && rule.exclude.test(line)) continue;
+
+      const window = lines.slice(i, i + 3).join('\n');
+      // From the sink onwards (including the sink itself, which may already contain $_GET, req.body, …).
+      const args = argsAfter(window, m.index);
+      const isTainted = SOURCES[lang].test(args) || (taintRe?.test(args) ?? false);
+      const isDynamic = isTainted || DYNAMIC.test(args);
+      if (rule.when === 'tainted' && !isTainted) continue;
+      if (rule.when === 'dynamic' && !isDynamic) continue;
+
+      const score = isTainted ? (rule.taintedSev ?? rule.sev) : rule.sev;
+      findings.push({
+        id: `code:${rule.id}:${rel}:${i + 1}`,
+        kind: rule.category === 'secret' ? 'secret' : 'code',
+        title: rule.title,
+        ruleId: rule.id,
+        category: rule.category,
+        cwe: rule.cwe,
+        severityScore: score,
+        severity: levelFromScore(score),
+        confidence: isTainted ? 'high' : rule.when === 'always' ? 'medium' : 'low',
+        tainted: isTainted,
+        context: rule.context ?? fileContext,
+        location: { file: rel, line: i + 1, snippet: clip(raw[i].trim(), 240) },
+        fix: rule.fix,
+      });
+    }
+  }
+  return findings;
+}
+
+export function scanCode(src) {
+  const findings = [];
+  for (const [rel, context] of src.contexts) {
+    findings.push(...scanFile(rel, src.texts.get(rel), context));
+  }
+  return findings;
+}

package/src/code/files.js

@@ -0,0 +1,85 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+const SKIP_DIRS = new Set([
+  'node_modules', '.git', '.hg', '.svn', '.next', '.nuxt', '.output', '.svelte-kit', '.vercel', '.netlify', '.turbo',
+  '.cache', '.parcel-cache', '.idea', '.vscode', 'dist', 'build', 'out', 'coverage', 'storybook-static', 'vendor',
+  '__pycache__', '.venv', 'venv', '.tox', '.mypy_cache', '.pytest_cache', 'bower_components', '.yarn', '.pnpm-store',
+  '.iamsecure',
+]);
+
+export const CODE_EXT = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.vue', '.svelte', '.astro', '.php', '.py']);
+const CONFIG_EXT = new Set(['.json', '.yml', '.yaml', '.toml', '.ini', '.properties', '.sh', '.tf', '.xml', '.conf', '.cfg']);
+const MAX_SIZE = 1024 * 1024;
+const MAX_FILES = 25000;
+
+/** Very small .gitignore support: plain names, dir/ names, and simple * globs. */
+function loadIgnore(root) {
+  let lines = [];
+  try {
+    lines = fs.readFileSync(path.join(root, '.gitignore'), 'utf8').split(/\r?\n/);
+  } catch {}
+  const rules = lines
+    .map((l) => l.trim())
+    .filter((l) => l && !l.startsWith('#') && !l.startsWith('!'))
+    .map((l) => {
+      const anchored = l.startsWith('/');
+      const p = l.replace(/^\//, '').replace(/\/$/, '');
+      const re = new RegExp('^' + p.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*\*/g, '.*').replace(/(?<!\.)\*/g, '[^/]*') + '$');
+      return { re, anchored, hasSlash: p.includes('/') };
+    });
+  return (rel) => {
+    const base = path.basename(rel);
+    return rules.some((r) => (r.anchored || r.hasSlash ? r.re.test(rel) : r.re.test(base)));
+  };
+}
+
+/**
+ * Walk the project and return files worth scanning.
+ * .env files are always returned (even if gitignored) so secrets in them can be reported.
+ * @returns {{rel:string, abs:string, ext:string, kind:'code'|'config'|'env'}[]}
+ */
+export function walkFiles(root) {
+  const ignored = loadIgnore(root);
+  const out = [];
+  const stack = [''];
+  while (stack.length && out.length < MAX_FILES) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = fs.readdirSync(path.join(root, dir), { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of entries) {
+      const rel = dir ? `${dir}/${e.name}` : e.name;
+      if (e.isDirectory()) {
+        if (!SKIP_DIRS.has(e.name) && !ignored(rel)) stack.push(rel);
+        continue;
+      }
+      if (!e.isFile()) continue;
+      const isEnv = /^\.env(\..+)?$/.test(e.name) && !/\.(example|sample|template|dist)$/.test(e.name);
+      const ext = path.extname(e.name).toLowerCase();
+      if (!isEnv && ignored(rel)) continue;
+      if (!isEnv && !CODE_EXT.has(ext) && !CONFIG_EXT.has(ext)) continue;
+      if (/\.min\.[cm]?js$|\.bundle\.js$|-lock\.json$|\.lock$|\.map$/.test(e.name) || e.name === 'package-lock.json') continue;
+      out.push({ rel, abs: path.join(root, rel), ext, kind: isEnv ? 'env' : CODE_EXT.has(ext) ? 'code' : 'config' });
+    }
+  }
+  return out;
+}
+
+/** Read a text file, or null if it's too big / binary / generated. */
+export function readText(abs) {
+  try {
+    if (fs.statSync(abs).size > MAX_SIZE) return null;
+    const text = fs.readFileSync(abs, 'utf8');
+    if (text.includes('\u0000')) return null;
+    // Bundled/minified output: a handful of extremely long lines.
+    const lines = text.split('\n');
+    if (lines.length < 5 && text.length > 5000) return null;
+    return text;
+  } catch {
+    return null;
+  }
+}

package/src/code/index.js

@@ -0,0 +1,30 @@
+import { walkFiles, readText } from './files.js';
+import { classifyFile, extractImports } from './context.js';
+
+/**
+ * Read the project's source once: classify every code file and index which packages it imports.
+ * @returns {{files: {rel:string, kind:string, ext:string, context:string|null}[], texts: Map<string,string>,
+ *   contexts: Map<string,string>, usage: Map<string, {file:string,line:number,context:string,binding:string|null}[]>}}
+ */
+export function analyzeSource(project) {
+  const files = walkFiles(project.root);
+  const texts = new Map();
+  const contexts = new Map();
+  const usage = new Map();
+
+  for (const f of files) {
+    const text = readText(f.abs);
+    if (text === null) continue;
+    texts.set(f.rel, text);
+    if (f.kind !== 'code') continue;
+    f.context = classifyFile(f.rel, text, project.framework);
+    contexts.set(f.rel, f.context);
+    if (!/\.(php|py)$/.test(f.rel)) {
+      for (const imp of extractImports(text)) {
+        if (!usage.has(imp.pkg)) usage.set(imp.pkg, []);
+        usage.get(imp.pkg).push({ file: f.rel, line: imp.line, context: f.context, binding: imp.binding });
+      }
+    }
+  }
+  return { files, texts, contexts, usage };
+}