kodingo-cli 1.1.1 → 1.1.2

package/dist/commands/security-scan.js

@@ -115,7 +115,22 @@ async function securityScanCommand(options = {}) {
                 }
                 catch { }
             }
-            const candidates = (0, security_code_analyzer_1.analyzeForSecurityCandidates)(repoRoot, graph, symbols);
+            // Fetch dynamically generated rules from OSV-driven rule generation
+            let dynamicRules = [];
+            try {
+                const rulesRes = await fetch(`${apiUrl}/security/rules`, {
+                    headers: { "X-Kodingo-Token": token },
+                });
+                if (rulesRes.ok) {
+                    const rulesData = await rulesRes.json();
+                    dynamicRules = rulesData.rules ?? [];
+                    if (!options.silent && dynamicRules.length > 0) {
+                        console.log(`  Loaded ${dynamicRules.length} dynamically generated detection rule${dynamicRules.length === 1 ? "" : "s"} from OSV intelligence\n`);
+                    }
+                }
+            }
+            catch { }
+            const candidates = (0, security_code_analyzer_1.analyzeForSecurityCandidates)(repoRoot, graph, symbols, dynamicRules);
             if (candidates.length === 0) {
                 if (!options.silent)
                     console.log("  ✔ No suspicious patterns detected.");

package/dist/utils/code-pattern-scanner.js

@@ -93,6 +93,109 @@ const RULES = [
         regex: /\b(fetch|axios\.get|axios\.post|request)\s*\(\s*[^)]*\+\s*\w+/,
         description: "Outbound HTTP request built via concatenation with a variable — potential SSRF if that variable is user-controlled.",
     },
+    // ── Insecure deserialization ───────────────────────────────────────────────
+    {
+        type: "insecure_deserialization",
+        severity: "critical",
+        regex: /\b(unserialize|pickle\.loads|deserialize)\s*\(/,
+        description: "Unvalidated data passed to a deserialization function — can enable remote code execution if input is attacker-controlled.",
+    },
+    {
+        type: "insecure_deserialization",
+        severity: "critical",
+        regex: /yaml\.load\s*\([^,)]+\)(?!.*Loader)/,
+        description: "yaml.load() without a safe Loader — enables arbitrary code execution via crafted YAML input.",
+        languages: ["python"],
+    },
+    // ── XXE injection ──────────────────────────────────────────────────────────
+    {
+        type: "xxe_injection",
+        severity: "high",
+        regex: /resolve_entities\s*=\s*True|load_dtd\s*=\s*True/,
+        description: "XML parser configured with external entity resolution or DTD loading enabled — XXE injection vulnerability.",
+        languages: ["python"],
+    },
+    {
+        type: "xxe_injection",
+        severity: "high",
+        regex: /libxml_disable_entity_loader\s*\(\s*false\s*\)/,
+        description: "PHP XML external entity loading explicitly enabled — XXE injection vulnerability.",
+        languages: ["php"],
+    },
+    // ── Open redirect ─────────────────────────────────────────────────────────
+    {
+        type: "open_redirect",
+        severity: "high",
+        regex: /\bres\.redirect\s*\([^)]*(?:req\.|params\.|query\.)/,
+        description: "Redirect target built from user-supplied request data — potential open redirect enabling phishing attacks.",
+    },
+    {
+        type: "open_redirect",
+        severity: "high",
+        regex: /header\s*\(\s*['"]Location.*(?:\$_GET|\$_POST|\$_REQUEST)/,
+        description: "Location header set from user-supplied input — open redirect vulnerability.",
+        languages: ["php"],
+    },
+    // ── Mass assignment ───────────────────────────────────────────────────────
+    {
+        type: "mass_assignment",
+        severity: "high",
+        regex: /Object\.assign\s*\([^,)]+,\s*req\.body/,
+        description: "User-supplied request body merged directly into an object via Object.assign — potential mass assignment.",
+    },
+    {
+        type: "mass_assignment",
+        severity: "high",
+        regex: /\$request->all\(\)|\$request->input\(\)/,
+        description: "All user input bound directly to model without allowlist — mass assignment vulnerability in Laravel/PHP.",
+        languages: ["php"],
+    },
+    // ── Prototype pollution ───────────────────────────────────────────────────
+    {
+        type: "prototype_pollution",
+        severity: "critical",
+        regex: /\[['"]__proto__['"]\]|__proto__\s*=/,
+        description: "Prototype pollution — modification of __proto__ through user-controlled input can corrupt the global object prototype.",
+    },
+    {
+        type: "prototype_pollution",
+        severity: "critical",
+        regex: /constructor\.prototype\s*=/,
+        description: "Direct modification of constructor.prototype — potential prototype pollution vulnerability.",
+    },
+    // ── CORS misconfiguration ─────────────────────────────────────────────────
+    {
+        type: "cors_misconfiguration",
+        severity: "high",
+        regex: /['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/,
+        description: "Wildcard CORS policy — allows any origin to make cross-origin requests to this endpoint.",
+    },
+    {
+        type: "cors_misconfiguration",
+        severity: "moderate",
+        regex: /origin\s*[:=]\s*req\.headers(?:\.origin|\.get\s*\(\s*['"]origin)/,
+        description: "CORS origin reflected directly from request headers without validation — allows attacker-controlled origins.",
+    },
+    // ── Timing attacks ────────────────────────────────────────────────────────
+    {
+        type: "timing_attack",
+        severity: "moderate",
+        regex: /(?:token|secret|password|apiKey|api_key)\s*===\s*(?:req|request|input|provided)/,
+        description: "Non-constant-time comparison in a security-sensitive context — vulnerable to timing attacks that can leak secret values.",
+    },
+    // ── Insecure session management ───────────────────────────────────────────
+    {
+        type: "insecure_session",
+        severity: "high",
+        regex: /(?:session|sessionId|session_id)\s*[:=][^;\n]*Math\.random/,
+        description: "Session ID generated using Math.random() — not cryptographically secure, session IDs are predictable.",
+    },
+    {
+        type: "insecure_session",
+        severity: "moderate",
+        regex: /res\.cookie\s*\([^)]+\)(?!.*httpOnly)(?!.*secure)/,
+        description: "Cookie set without httpOnly or Secure flags — session cookie may be accessible to JavaScript or transmitted over HTTP.",
+    },
 ];
 /**
  * Scans a single symbol's body against all pattern rules. Returns every match —

package/dist/utils/security-code-analyzer.js

@@ -73,12 +73,39 @@ function findMissingAuthCandidatesLocal(graph, symbolsByFingerprint) {
 /**
  * Runs both Layer 1 detectors and assembles full code context for every
  * flagged candidate — ready to send to the server for Layer 2 LLM judgment.
+ * Dynamic rules from OSV-driven generation are applied alongside static rules.
  */
-function analyzeForSecurityCandidates(repoRoot, graph, symbols) {
+function analyzeForSecurityCandidates(repoRoot, graph, symbols, dynamicRules = []) {
     const symbolsByFingerprint = new Map(symbols.map(s => [s.fingerprint, s]));
     const candidates = [];
-    // ── Code pattern findings ────────────────────────────────────────────────
+    // ── Code pattern findings — static + dynamic rules ────────────────────────
     const patternFindings = (0, code_pattern_scanner_1.scanAllSymbolsForPatterns)(symbols);
+    // Apply dynamic rules generated from OSV vulnerability data
+    for (const sym of symbols) {
+        const language = sym.language ?? "unknown";
+        for (const rule of dynamicRules) {
+            if (rule.languages && !rule.languages.includes(language))
+                continue;
+            try {
+                const regex = new RegExp(rule.regexPattern);
+                const match = sym.body.match(regex);
+                if (match && match.index !== undefined) {
+                    patternFindings.push({
+                        patternType: rule.patternType,
+                        symbol: sym.name,
+                        file: sym.file,
+                        startLine: sym.startLine,
+                        severity: rule.severity,
+                        snippet: sym.body.slice(Math.max(0, match.index - 20), match.index + 100).trim(),
+                        description: rule.description,
+                    });
+                }
+            }
+            catch {
+                continue;
+            }
+        }
+    }
     for (const finding of patternFindings) {
         const sym = symbols.find(s => s.name === finding.symbol && s.file === finding.file);
         const fingerprint = sym?.fingerprint ?? "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodingo-cli",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Kodingo CLI",
   "license": "MIT",
   "private": false,