omen-sec-cli 1.0.16 → 1.0.18

package/core/local-scanner.js

@@ -45,10 +45,15 @@ export async function scanLocalProject() {
           osvRes.data.vulns.forEach(vuln => {
             vulnerabilities.push({
               id: vuln.id,
-              type: 'Vulnerable Component (OSV.dev)',
-              severity: 'High',
+              kind: 'tech',
+              category: 'confirmed',
+              confidence: 'high',
+              severity: 'high',
+              title: `Vulnerable Dependency: ${name}`,
               description: `Real CVE found for ${name}@${cleanVersion}: ${vuln.summary || vuln.details}`,
-              cwe: vuln.database_specific?.cwe_ids?.[0] || 'N/A'
+              cwe: vuln.database_specific?.cwe_ids?.[0] || 'N/A',
+              evidence: { package: name, version: cleanVersion, vuln_id: vuln.id },
+              remediation: `Update ${name} to a secure version as recommended by OSV/NVD.`
             });
           });
         }
@@ -57,27 +62,33 @@ export async function scanLocalProject() {
       }
     }
 
-    // Exemplos de dependências conhecidas (fallback mock)
+    // Fallback mocks
     if (deps['lodash'] && deps['lodash'].match(/[~^]?4\.17\.[0-20]/)) {
       vulnerabilities.push({
         id: `LOC-VULN-${Date.now()}-1`,
-        category: 'Confirmed',
-        confidence: 'High',
-        severity: 'High',
+        kind: 'tech',
+        category: 'confirmed',
+        confidence: 'high',
+        severity: 'high',
+        title: 'Vulnerable Lodash Version',
         description: `Outdated dependency detected in package.json: lodash (${deps['lodash']}). Known Prototype Pollution risk.`,
         cwe: 'CWE-1321',
-        evidence: { file: 'package.json', finding: `lodash: ${deps['lodash']}` }
+        evidence: { file: 'package.json', finding: `lodash: ${deps['lodash']}` },
+        remediation: 'Update lodash to version 4.17.21 or higher.'
       });
     }
     if (deps['express'] && deps['express'].match(/[~^]?3\./)) {
       vulnerabilities.push({
         id: `LOC-VULN-${Date.now()}-2`,
-        category: 'Confirmed',
-        confidence: 'High',
-        severity: 'High',
+        kind: 'tech',
+        category: 'confirmed',
+        confidence: 'high',
+        severity: 'high',
+        title: 'Critical Outdated Express',
         description: `Severely outdated Express.js version (${deps['express']}) detected. Multiple CVEs exist.`,
         cwe: 'CWE-1104',
-        evidence: { file: 'package.json', finding: `express: ${deps['express']}` }
+        evidence: { file: 'package.json', finding: `express: ${deps['express']}` },
+        remediation: 'Upgrade Express.js to the latest stable version (4.x or 5.x).'
       });
     }
   } catch (err) {
@@ -98,55 +109,154 @@ export async function scanLocalProject() {
       filesScanned.push(path.basename(file));
 
       lines.forEach((line, index) => {
-        // Regra 1: Hardcoded Secrets (AWS Keys, API Keys simples)
-        if (/(api_key|apikey|secret|password|token)\s*=\s*['"][a-zA-Z0-9_-]{10,}['"]/i.test(line)) {
+        // Regra 1: Hardcoded Secrets (Improved)
+        const secretRegex = /(api_key|apikey|secret|password|token|jwt_secret|connection_string|private_key|aws_key|aws_secret|db_pass)\s*[:=]\s*['"][a-zA-Z0-9_\-\.\/\+\=]{12,}['"]/i;
+        if (secretRegex.test(line)) {
           vulnerabilities.push({
-            id: `LOC-VULN-${Date.now()}-3`,
-            category: 'Confirmed',
-            confidence: 'Medium', // Could be a test key
-            severity: 'Critical',
-            description: `Potential hardcoded secret found in ${path.basename(file)} at line ${index + 1}`,
+            id: `LOC-SEC-${Date.now()}-${index}`,
+            kind: 'content',
+            category: 'confirmed',
+            confidence: 'high',
+            severity: 'critical',
+            title: 'Exposed Hardcoded Secret',
+            description: `A potential sensitive credential or token was found hardcoded in ${path.basename(file)} at line ${index + 1}.`,
             cwe: 'CWE-798',
-            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Immediately rotate this secret and move it to an environment variable or a secret manager vault.'
           });
         }
 
-        // Regra 2: Uso de Eval (Code Injection)
+        // Regra 10: Insecure CORS configuration
+        if (/Access-Control-Allow-Origin.*\*['"]/i.test(line)) {
+          vulnerabilities.push({
+            id: `LOC-CORS-${Date.now()}-${index}`,
+            kind: 'content',
+            category: 'hardening',
+            confidence: 'high',
+            severity: 'medium',
+            title: 'Overly Permissive CORS Policy',
+            description: `CORS policy allows all origins (*) in ${path.basename(file)} at line ${index + 1}. This can lead to CSRF or data leakage.`,
+            cwe: 'CWE-942',
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Restrict Access-Control-Allow-Origin to specific, trusted domains instead of using "*".'
+          });
+        }
+
+        // Regra 11: Insecure Cookie Attributes
+        if (/res\.cookie\(.*\{/i.test(line) && !/httpOnly:\s*true/i.test(line)) {
+          vulnerabilities.push({
+            id: `LOC-COOKIE-${Date.now()}-${index}`,
+            kind: 'content',
+            category: 'hardening',
+            confidence: 'medium',
+            severity: 'low',
+            title: 'Insecure Cookie (Missing httpOnly)',
+            description: `Cookie created without 'httpOnly' flag in ${path.basename(file)} at line ${index + 1}. This makes the cookie accessible via client-side scripts (XSS risk).`,
+            cwe: 'CWE-1004',
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Always set { httpOnly: true } when creating sensitive cookies to prevent XSS-based theft.'
+          });
+        }
+
+        // Regra 12: Insecure Randomness
+        if (/Math\.random\(\)/.test(line)) {
+          vulnerabilities.push({
+            id: `LOC-RAND-${Date.now()}-${index}`,
+            kind: 'content',
+            category: 'hardening',
+            confidence: 'medium',
+            severity: 'low',
+            title: 'Insecure Randomness',
+            description: `Math.random() used in ${path.basename(file)} at line ${index + 1}. This is not cryptographically secure.`,
+            cwe: 'CWE-330',
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Use crypto.getRandomValues() or the "crypto" module for security-sensitive random values.'
+          });
+        }
+
+        // Regra 13: Potential ReDoS (Regex Denial of Service)
+        if (/\/\(.*\+\)\+\//.test(line) || /\/\(.*\*\)\*\//.test(line)) {
+          vulnerabilities.push({
+            id: `LOC-REDOS-${Date.now()}-${index}`,
+            kind: 'content',
+            category: 'probable',
+            confidence: 'medium',
+            severity: 'medium',
+            title: 'Potential ReDoS Pattern',
+            description: `A potentially catastrophic backtracking regex pattern was found in ${path.basename(file)} at line ${index + 1}.`,
+            cwe: 'CWE-1333',
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Review and simplify the regex pattern to avoid nested quantifiers that cause exponential backtracking.'
+          });
+        }
+
+        // Regra 8: Weak JWT Configuration
+        if (/jwt\.sign\(.*,\s*['"][^'"]{1,10}['"]\s*,/i.test(line)) {
+          vulnerabilities.push({
+            id: `LOC-AUTH-${Date.now()}`,
+            kind: 'content',
+            category: 'confirmed',
+            confidence: 'high',
+            severity: 'high',
+            title: 'Weak JWT Secret detected',
+            description: `The JWT signing secret appears to be a short, hardcoded string in ${path.basename(file)}: line ${index + 1}`,
+            cwe: 'CWE-522',
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Use a strong, randomly generated secret stored in environment variables.'
+          });
+        }
+
+        // Regra 9: Missing CSRF Protection (Express example)
+        if (discoveryData && discoveryData.stack === 'Node/Express' && path.basename(file) === 'app.js') {
+           // This would require multi-line or AST, but let's do a simple check
+        }
+
+
+        // Regra 2: Uso de Eval
         if (/eval\s*\(/.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-4`,
-            category: 'Confirmed',
-            confidence: 'High',
-            severity: 'Critical',
+            kind: 'content',
+            category: 'confirmed',
+            confidence: 'high',
+            severity: 'critical',
+            title: 'Dangerous eval() Usage',
             description: `Dangerous use of eval() detected in ${path.basename(file)} at line ${index + 1}`,
             cwe: 'CWE-94',
-            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Avoid using eval(). Use safer alternatives like JSON.parse() or specific logic.'
           });
         }
 
-        // Regra 3: SQLi (Concatenação crua de strings com SELECT)
+        // Regra 3: SQLi
         if (/SELECT.*FROM.*WHERE.*(\+|`|\${)/i.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-5`,
-            category: 'Probable',
-            confidence: 'Medium',
-            severity: 'Critical',
+            kind: 'content',
+            category: 'probable',
+            confidence: 'medium',
+            severity: 'critical',
+            title: 'Potential SQL Injection',
             description: `Potential SQL Injection (raw string concatenation) in ${path.basename(file)} at line ${index + 1}.`,
             cwe: 'CWE-89',
-            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Use parameterized queries or an ORM to prevent SQL injection.'
           });
         }
 
-        // Regra 6: Local File Inclusion (LFI) via require/import dinâmico
+        // Regra 6: LFI
         if (/(require|import)\s*\(['"]?.*(\+|`|\${)/i.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-6`,
-            category: 'Probable',
-            confidence: 'Medium',
-            severity: 'High',
-            description: `Potential LFI detected in ${path.basename(file)} at line ${index + 1}. Dynamic loading of files based on user input can lead to sensitive data exposure.`,
+            kind: 'content',
+            category: 'probable',
+            confidence: 'medium',
+            severity: 'high',
+            title: 'Potential LFI',
+            description: `Potential Local File Inclusion (LFI) detected in ${path.basename(file)} at line ${index + 1}.`,
             cwe: 'CWE-22',
-            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Validate and sanitize file paths before dynamic loading.'
           });
         }
 
@@ -154,12 +264,15 @@ export async function scanLocalProject() {
         if (/\.prototype\.[a-zA-Z0-9_]+\s*=\s*/.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-7`,
-            category: 'Hardening',
-            confidence: 'Low',
-            severity: 'Medium',
-            description: `Direct prototype modification in ${path.basename(file)} at line ${index + 1}. This can lead to Prototype Pollution if user input reaches this assignment.`,
+            kind: 'content',
+            category: 'hardening',
+            confidence: 'low',
+            severity: 'medium',
+            title: 'Prototype Modification Risk',
+            description: `Direct prototype modification in ${path.basename(file)} at line ${index + 1}.`,
             cwe: 'CWE-1321',
-            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Avoid direct prototype modification. Use Object.defineProperty if necessary.'
           });
         }