jaku.sh 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +52 -0
- package/README.md +636 -0
- package/action.yml +264 -0
- package/bin/jaku +2 -0
- package/package.json +62 -0
- package/src/agents/ai-agent.js +175 -0
- package/src/agents/api-agent.js +95 -0
- package/src/agents/base-agent.js +158 -0
- package/src/agents/crawl-agent.js +175 -0
- package/src/agents/event-bus.js +59 -0
- package/src/agents/findings-ledger.js +410 -0
- package/src/agents/logic-agent.js +144 -0
- package/src/agents/orchestrator.js +323 -0
- package/src/agents/qa-agent.js +149 -0
- package/src/agents/security-agent.js +211 -0
- package/src/cli.js +423 -0
- package/src/core/accessibility-checker.js +171 -0
- package/src/core/ai/ai-endpoint-detector.js +227 -0
- package/src/core/ai/guardrail-prober.js +362 -0
- package/src/core/ai/indirect-injector.js +106 -0
- package/src/core/ai/jailbreak-tester.js +212 -0
- package/src/core/ai/model-dos-tester.js +174 -0
- package/src/core/ai/model-fingerprinter.js +246 -0
- package/src/core/ai/multi-turn-attacker.js +297 -0
- package/src/core/ai/output-analyzer.js +182 -0
- package/src/core/ai/prompt-injector.js +543 -0
- package/src/core/ai/system-prompt-extractor.js +244 -0
- package/src/core/api/api-key-auditor.js +266 -0
- package/src/core/api/auth-flow-tester.js +430 -0
- package/src/core/api/cors-ws-tester.js +263 -0
- package/src/core/api/graphql-tester.js +287 -0
- package/src/core/api/oauth-prober.js +343 -0
- package/src/core/auth-manager.js +902 -0
- package/src/core/broken-flow-detector.js +207 -0
- package/src/core/browser-manager.js +119 -0
- package/src/core/console-monitor.js +111 -0
- package/src/core/crawler.js +430 -0
- package/src/core/csr-waiter.js +410 -0
- package/src/core/form-validator.js +240 -0
- package/src/core/logic/abuse-pattern-scanner.js +291 -0
- package/src/core/logic/access-boundary-tester.js +448 -0
- package/src/core/logic/business-rule-inferrer.js +196 -0
- package/src/core/logic/graphql-auditor.js +298 -0
- package/src/core/logic/parameter-polluter.js +212 -0
- package/src/core/logic/pricing-exploiter.js +299 -0
- package/src/core/logic/race-condition-detector.js +222 -0
- package/src/core/logic/workflow-enforcer.js +284 -0
- package/src/core/performance-checker.js +204 -0
- package/src/core/responsive-checker.js +228 -0
- package/src/core/security/cors-prober.js +150 -0
- package/src/core/security/csrf-prober.js +217 -0
- package/src/core/security/dependency-auditor.js +182 -0
- package/src/core/security/file-upload-tester.js +340 -0
- package/src/core/security/header-analyzer.js +324 -0
- package/src/core/security/infra-scanner.js +391 -0
- package/src/core/security/path-traversal.js +112 -0
- package/src/core/security/prototype-pollution.js +147 -0
- package/src/core/security/secret-detector.js +517 -0
- package/src/core/security/sqli-prober.js +257 -0
- package/src/core/security/tls-checker.js +223 -0
- package/src/core/security/xss-scanner.js +225 -0
- package/src/core/test-generator.js +339 -0
- package/src/core/test-runner.js +398 -0
- package/src/reporting/diff-reporter.js +172 -0
- package/src/reporting/report-generator.js +408 -0
- package/src/reporting/sarif-generator.js +190 -0
- package/src/utils/config.js +57 -0
- package/src/utils/finding.js +67 -0
- package/src/utils/logger.js +50 -0
|
@@ -0,0 +1,67 @@
|
|
|
1
|
+
import { nanoid } from 'nanoid';
|
|
2
|
+
|
|
3
|
+
const SEVERITY_ORDER = ['critical', 'high', 'medium', 'low', 'info'];
|
|
4
|
+
|
|
5
|
+
/**
|
|
6
|
+
* Creates a JAKU Finding object matching the manifest schema.
|
|
7
|
+
*/
|
|
8
|
+
export function createFinding({
|
|
9
|
+
module = 'qa',
|
|
10
|
+
title,
|
|
11
|
+
severity = 'info',
|
|
12
|
+
affected_surface,
|
|
13
|
+
description,
|
|
14
|
+
reproduction = [],
|
|
15
|
+
evidence = null,
|
|
16
|
+
remediation = '',
|
|
17
|
+
references = [],
|
|
18
|
+
status = 'open',
|
|
19
|
+
}) {
|
|
20
|
+
const prefix = module.toUpperCase();
|
|
21
|
+
const shortId = nanoid(6);
|
|
22
|
+
|
|
23
|
+
return {
|
|
24
|
+
id: `JAKU-${prefix}-${shortId}`,
|
|
25
|
+
module,
|
|
26
|
+
title,
|
|
27
|
+
severity: severity.toLowerCase(),
|
|
28
|
+
affected_surface,
|
|
29
|
+
description,
|
|
30
|
+
reproduction: Array.isArray(reproduction) ? reproduction : [reproduction],
|
|
31
|
+
evidence,
|
|
32
|
+
remediation,
|
|
33
|
+
references,
|
|
34
|
+
status,
|
|
35
|
+
timestamp: new Date().toISOString(),
|
|
36
|
+
};
|
|
37
|
+
}
|
|
38
|
+
|
|
39
|
+
/**
|
|
40
|
+
* Sorts findings by severity (critical first).
|
|
41
|
+
*/
|
|
42
|
+
export function sortFindings(findings) {
|
|
43
|
+
return [...findings].sort((a, b) => {
|
|
44
|
+
return SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity);
|
|
45
|
+
});
|
|
46
|
+
}
|
|
47
|
+
|
|
48
|
+
/**
|
|
49
|
+
* Filters findings by minimum severity threshold.
|
|
50
|
+
*/
|
|
51
|
+
export function filterBySeverity(findings, threshold = 'low') {
|
|
52
|
+
const thresholdIndex = SEVERITY_ORDER.indexOf(threshold);
|
|
53
|
+
return findings.filter(f => SEVERITY_ORDER.indexOf(f.severity) <= thresholdIndex);
|
|
54
|
+
}
|
|
55
|
+
|
|
56
|
+
/**
|
|
57
|
+
* Generates a summary count by severity.
|
|
58
|
+
*/
|
|
59
|
+
export function severitySummary(findings) {
|
|
60
|
+
const summary = { critical: 0, high: 0, medium: 0, low: 0, info: 0, total: findings.length };
|
|
61
|
+
for (const f of findings) {
|
|
62
|
+
if (summary[f.severity] !== undefined) summary[f.severity]++;
|
|
63
|
+
}
|
|
64
|
+
return summary;
|
|
65
|
+
}
|
|
66
|
+
|
|
67
|
+
export default { createFinding, sortFindings, filterBySeverity, severitySummary };
|
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
import winston from 'winston';
|
|
2
|
+
import path from 'path';
|
|
3
|
+
import fs from 'fs';
|
|
4
|
+
|
|
5
|
+
const LOG_DIR = path.join(process.cwd(), 'jaku-reports', 'logs');
|
|
6
|
+
|
|
7
|
+
export function createLogger(options = {}) {
|
|
8
|
+
const { verbose = false, logDir = LOG_DIR } = options;
|
|
9
|
+
|
|
10
|
+
if (!fs.existsSync(logDir)) {
|
|
11
|
+
fs.mkdirSync(logDir, { recursive: true });
|
|
12
|
+
}
|
|
13
|
+
|
|
14
|
+
const logger = winston.createLogger({
|
|
15
|
+
level: verbose ? 'debug' : 'info',
|
|
16
|
+
format: winston.format.combine(
|
|
17
|
+
winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }),
|
|
18
|
+
winston.format.errors({ stack: true }),
|
|
19
|
+
winston.format.json()
|
|
20
|
+
),
|
|
21
|
+
defaultMeta: { agent: 'JAKU' },
|
|
22
|
+
transports: [
|
|
23
|
+
new winston.transports.File({
|
|
24
|
+
filename: path.join(logDir, 'jaku-error.log'),
|
|
25
|
+
level: 'error',
|
|
26
|
+
}),
|
|
27
|
+
new winston.transports.File({
|
|
28
|
+
filename: path.join(logDir, 'jaku-audit.log'),
|
|
29
|
+
}),
|
|
30
|
+
],
|
|
31
|
+
});
|
|
32
|
+
|
|
33
|
+
if (process.env.NODE_ENV !== 'production') {
|
|
34
|
+
logger.add(
|
|
35
|
+
new winston.transports.Console({
|
|
36
|
+
format: winston.format.combine(
|
|
37
|
+
winston.format.colorize(),
|
|
38
|
+
winston.format.printf(({ level, message, timestamp }) => {
|
|
39
|
+
return `${timestamp} [${level}]: ${message}`;
|
|
40
|
+
})
|
|
41
|
+
),
|
|
42
|
+
silent: !verbose,
|
|
43
|
+
})
|
|
44
|
+
);
|
|
45
|
+
}
|
|
46
|
+
|
|
47
|
+
return logger;
|
|
48
|
+
}
|
|
49
|
+
|
|
50
|
+
export default createLogger;
|