openqodex 0.1.0

package/lenses/async-promise-all-swallows-errors.md

@@ -0,0 +1,42 @@
+---
+name: async-promise-all-swallows-errors
+description: Promise.all over fire-and-forget side effects loses partial failures
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+  hunk_regex: "Promise\\.all\\s*\\("
+confidence_floor: 0.7
+---
+
+`Promise.all([...])` rejects on the FIRST rejection and silently
+discards the results of every later promise, even ones that
+succeeded after rejection. When the array members are independent
+side-effects (insert N rows, fire N webhooks, send N emails), the
+caller only sees one error but several side-effects may have run
+and several may have silently not run. Recovery / retry becomes
+impossible because the caller can't tell which ones happened.
+
+Flag a `Promise.all([...])` where each item is an INDEPENDENT
+side-effect (call to db/insert, http POST, message publish, file
+write) and the caller doesn't:
+- use `Promise.allSettled` to inspect each result, OR
+- wrap each item in `.catch` to translate rejections into per-item
+  status
+
+Suppress when:
+- the items are reads (the all-or-nothing semantic matches "I need
+  every value to proceed")
+- the wrapper IS `Promise.allSettled`
+- the items are wrapped individually with `.catch` so the all sees
+  only fulfilled promises

package/lenses/async-unhandled-rejection-in-handler.md

@@ -0,0 +1,42 @@
+---
+name: async-unhandled-rejection-in-handler
+description: Express / Hono / Fastify handler is async but has no try/catch and no errorHandler middleware
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+  hunk_regex: "(app|router|server|fastify)\\.(get|post|put|patch|delete|on)\\s*\\([\\s\\S]{0,200}?\\basync\\b"
+confidence_floor: 0.7
+---
+
+An HTTP route handler is declared `async` but its body contains an
+`await` that can throw, no `try/catch`, and the framework in use is
+NOT auto-promoting promise rejections to error middleware. Express 4
+silently hangs the request; Express 5 + Hono + Fastify auto-handle,
+but a misconfigured app or an older Express still drops these on the
+floor: the client sees a request that times out at the LB while
+the server logs a `UnhandledPromiseRejectionWarning` somewhere.
+
+Flag when:
+- handler is `async (req, res) => { ... await ... }`
+- framework is Express 4 (check imports) OR the project has no
+  registered error-handling middleware visible
+
+Suppress when:
+- the handler is wrapped in an `asyncHandler` / `expressAsyncHandler`
+  / `tryCatch` helper that translates rejection → next(err)
+- framework is Hono / Fastify / Express 5 with the default error
+  surface (rejections become 500s automatically)
+- the body has a top-level `try/catch` that ends in `res.status(...)`
+- the handler is `next` style with the rejection threaded into
+  `.catch(next)`

package/lenses/auth-missing-on-state-change-route.md

@@ -0,0 +1,60 @@
+---
+name: auth-missing-on-state-change-route
+description: POST / PUT / PATCH / DELETE route registered without an auth middleware in sight
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.py"
+    - "*.go"
+    - "*.rb"
+    - "*.java"
+    - "*.kt"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.py"
+    - "**/*.go"
+    - "**/*.rb"
+    - "**/*.java"
+    - "**/*.kt"
+  hunk_regex: "\\.(post|put|patch|delete)\\s*\\(|@(Post|Put|Patch|Delete)\\b|@(post|put|patch|delete)\\b|@app\\.route\\b|@(Post|Put|Patch|Delete)Mapping\\b|@RequestMapping\\b"
+security: true
+confidence_floor: 0.75
+---
+
+A new route handler for a state-changing verb (POST / PUT / PATCH /
+DELETE) is registered with no auth middleware chained on the route,
+no `@auth` / `requireAuth` decorator, and no `req.user` /
+`session.user` guard inside the body. Anyone with the URL can mutate
+state. Particularly dangerous when the route is added under an
+existing prefix where the dev assumed auth was inherited but the
+prefix isn't actually protected.
+
+Flag when the diff adds a state-changing route AND the body doesn't
+reference an authenticated principal, AND no auth middleware appears
+on the same route registration.
+
+Suppress when:
+- the route is explicitly public (signup, login, password-reset
+  request, public webhook with HMAC validation)
+- a middleware chain on the router/app applies auth globally (look
+  for `app.use(authMiddleware)` / `router.use(...)` earlier in the
+  file)
+- the framework auto-applies auth via a base controller / module
+  decorator (read the surrounding file before raising; the auth
+  may live one level up)
+- the route reads/validates a signed token (webhook with HMAC,
+  short-lived signed URL)
+
+In Java and Kotlin the same shape is `@PostMapping` / `@PutMapping` /
+`@PatchMapping` / `@DeleteMapping` (or `@RequestMapping` with a method)
+on a controller method with no `@PreAuthorize`, no `@Secured`, and no
+rule in the security configuration covering the path.

package/lenses/auth-role-from-user-input.md

@@ -0,0 +1,49 @@
+---
+name: auth-role-from-user-input
+description: Role / permission / isAdmin value taken from request body or query
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.py"
+    - "*.go"
+    - "*.rb"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.py"
+    - "**/*.go"
+    - "**/*.rb"
+  hunk_regex: "(role|permission|isAdmin|is_admin|tier|plan|scopes?)\\b"
+security: true
+confidence_floor: 0.75
+---
+
+A role / permission / `isAdmin` / tier / plan value is being read
+from request input (`req.body`, `req.query`, form data, JSON
+payload) and used for an authorization check OR written to a
+persistent record. This is the classic privilege-escalation bug:
+the attacker passes `{"role": "admin"}` in the POST and the system
+trusts it.
+
+Flag when:
+- a string/bool from request input is assigned to a `role` /
+  `permission` / `isAdmin` column on an `INSERT` / `UPDATE`
+- a check like `if (req.body.role === 'admin')` gates an action
+- a JWT / session is created with a `role` claim copied from input
+
+Suppress when:
+- the role assignment is explicitly gated by an admin-only
+  authorization check earlier in the function (look for
+  `requireRole('admin')` / `ctx.user.isAdmin`)
+- the input goes through an allow-list AND the user is already an
+  admin (e.g. an admin promoting another user)
+- the value is being compared to derive a STRING used for routing /
+  filtering (not for an authorization decision)

package/lenses/auth-timing-attack-password-compare.md

@@ -0,0 +1,59 @@
+---
+name: auth-timing-attack-password-compare
+description: Password / token / secret compared with == / === instead of a constant-time check
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.py"
+    - "*.go"
+    - "*.rb"
+    - "*.java"
+    - "*.kt"
+    - "*.cs"
+    - "*.php"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.py"
+    - "**/*.go"
+    - "**/*.rb"
+    - "**/*.java"
+    - "**/*.kt"
+    - "**/*.cs"
+    - "**/*.php"
+  hunk_regex: "(password|secret|token|hmac|signature|apiKey|api_key)\\b\\s*[!=]==?"
+security: true
+confidence_floor: 0.7
+---
+
+A password / token / signature / HMAC / API key is being compared
+with `==`, `===`, `!=`, `!==`, `.equals()`, or `strcmp`, all of
+which short-circuit on the first byte mismatch and leak timing
+information. An attacker can recover the secret byte-by-byte by
+measuring response latency, especially against repeatedly-callable
+endpoints.
+
+Flag when:
+- the comparison's left or right operand is named or sourced from
+  the request as a `password|secret|token|hmac|signature|apiKey`
+- the operator is a default `==` / `===` / `!==` / `equals`
+
+Suppress when:
+- the call is `crypto.timingSafeEqual` /
+  `hmac.compare_digest` (Python) /
+  `subtle.ConstantTimeCompare` (Go) /
+  `MessageDigest.isEqual` (Java)
+- the comparison is on the OUTPUT of a verified KDF (bcrypt /
+  scrypt / argon2 `compare`); the KDF wrapper is already
+  constant-time and that's the recommended API
+- the comparison is against a literal "empty"/"missing" sentinel
+  (`token === undefined`); that's an existence check, not a value
+  match

package/lenses/cookie-missing-secure-httponly.md

@@ -0,0 +1,46 @@
+---
+name: cookie-missing-secure-httponly
+description: Auth / session cookie set without HttpOnly + Secure + SameSite
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.py"
+    - "*.go"
+    - "*.rb"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.py"
+    - "**/*.go"
+    - "**/*.rb"
+  hunk_regex: "Set-Cookie\\b|res\\.cookie\\b|c\\.cookie\\b|reply\\.setCookie\\b|response\\.setHeader\\(.{0,40}cookie"
+security: true
+confidence_floor: 0.7
+---
+
+A `Set-Cookie` for a session / auth / refresh / CSRF cookie is
+emitted without `HttpOnly` (JS-readable, stealable via XSS),
+without `Secure` (sent over plain HTTP), or without a `SameSite`
+attribute (allows CSRF via cross-site form submits in older
+browsers / strict-mode-off contexts).
+
+Flag when a cookie name containing `session|sid|auth|token|refresh`
+is set with options that omit `httpOnly: true`, `secure: true`, or
+`sameSite: 'strict'|'lax'`.
+
+Suppress when:
+- the cookie is intentionally JS-readable (e.g. a CSRF token cookie
+  paired with a header-based defense pattern), but check that
+  `secure + sameSite` are still set
+- the environment is dev/test and the env-gated config explicitly
+  disables `secure` for local HTTP only
+- a wrapper / framework default applies these attributes globally
+  (look for the wrapper's defaults before raising)

package/lenses/cors-wildcard-with-credentials.md

@@ -0,0 +1,47 @@
+---
+name: cors-wildcard-with-credentials
+description: "CORS allows '*' origin while also setting credentials: true"
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.py"
+    - "*.go"
+    - "*.rb"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.py"
+    - "**/*.go"
+    - "**/*.rb"
+  hunk_regex: "(Access-Control-Allow-Origin|cors\\s*\\(|allowOrigins|allow_origin)"
+security: true
+confidence_floor: 0.75
+---
+
+CORS is configured with `Access-Control-Allow-Origin: *` (or a
+reflective `origin: true` that echoes the request's `Origin`)
+together with `Access-Control-Allow-Credentials: true`. Browsers
+reject wildcard + credentials together, but reflective Origin +
+credentials lets any origin run authenticated requests against the
+API: CSRF and cookie theft become trivial.
+
+Flag when:
+- `origin: '*'` is set with `credentials: true`
+- `origin: true` (reflective) is set with `credentials: true` AND
+  there's no allow-list checked first
+
+Suppress when:
+- the origin is a concrete allow-list (`['https://app.example.com', ...]`)
+  or matched against one before being echoed
+- `credentials: false` (the wildcard is safe without cookies)
+- the API is genuinely public read-only and never reads / accepts
+  cookies / Authorization headers (defense in depth: still
+  recommend a concrete allow-list)

package/lenses/crypto-jwt-verify-without-algo-allowlist.md

@@ -0,0 +1,41 @@
+---
+name: crypto-jwt-verify-without-algo-allowlist
+description: jwt.verify called without an explicit algorithms allowlist
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+  hunk_regex: "jwt(\\.|.{0,40})verify\\s*\\(|jsonwebtoken|jose"
+security: true
+confidence_floor: 0.75
+---
+
+A JWT is verified without passing an explicit `algorithms` option.
+The `jsonwebtoken` library historically accepted whatever the token
+header declared, which lets an attacker switch to `alg: "none"`
+(no signature) or downgrade an RSA-signed token to an HMAC verify
+where the public key gets reused as the HMAC secret. Recent
+versions tightened defaults but the attack returns the moment the
+project pins an older version or uses an alternate library with
+permissive defaults.
+
+Flag when `jwt.verify(token, secret)` is called without `{
+algorithms: ['HS256'|'RS256'|...] }` in the third argument.
+
+Suppress when:
+- `algorithms: [...]` is passed (with a concrete allow-list, not
+  e.g. `['none', ...]`)
+- the library is `jose` and the call form already enforces alg via
+  the key object's `alg` field
+- the verify is inside a wrapper that lints algorithms internally
+  (look for the wrapper definition before raising)

package/lenses/crypto-math-random-for-tokens.md

@@ -0,0 +1,53 @@
+---
+name: crypto-math-random-for-tokens
+description: Math.random() used to generate tokens, IDs, or secrets
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.java"
+    - "*.kt"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.java"
+    - "**/*.kt"
+  hunk_regex: "Math\\.random\\s*\\(|\\bRandom\\s*\\("
+security: true
+confidence_floor: 0.75
+---
+
+`Math.random()` is a non-cryptographic PRNG. Its state is small,
+its output is predictable from observed values, and modern V8 has
+been shown to allow practical state-recovery attacks. Any token /
+ID / nonce / one-time code generated with `Math.random()` and
+used for a security purpose can be guessed.
+
+Flag when `Math.random()` is used to build:
+- session / password-reset / verify-email / magic-link tokens
+- API keys, invite codes, OTP codes
+- CSRF tokens or nonces
+- request IDs that gate access (e.g. order-pickup codes)
+
+Suppress when used for:
+- jitter / backoff timing
+- A/B test bucketing
+- animation / UI randomness
+- non-security IDs (telemetry trace fragments where collision is
+  the only concern)
+- in tests, where determinism (`seedrandom`) or non-crypto values
+  are the point
+
+Recommend `crypto.randomUUID()` / `crypto.randomBytes(n)` /
+`crypto.getRandomValues(...)` per platform.
+
+In Java and Kotlin the same bug is `new Random()`, `java.util.Random()`
+or Kotlin's `Random()` where `SecureRandom` is required. `SecureRandom`
+itself is the fix, not the bug.

package/lenses/crypto-md5-sha1-for-secrets.md

@@ -0,0 +1,60 @@
+---
+name: crypto-md5-sha1-for-secrets
+description: MD5 / SHA-1 used for passwords, tokens, or signatures
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.py"
+    - "*.go"
+    - "*.rb"
+    - "*.java"
+    - "*.kt"
+    - "*.cs"
+    - "*.php"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.py"
+    - "**/*.go"
+    - "**/*.rb"
+    - "**/*.java"
+    - "**/*.kt"
+    - "**/*.cs"
+    - "**/*.php"
+  hunk_regex: "\\b(md5|sha1|sha-?1)\\b|MessageDigest\\.getInstance\\s*\\(\\s*[\"'](MD5|SHA-?1)[\"']"
+security: true
+confidence_floor: 0.7
+---
+
+MD5 and SHA-1 are broken hashes for any security-bearing use:
+collision attacks are practical on both, and pre-image attacks
+on MD5 are within reach. Using them to hash passwords, derive
+keys, or sign / verify integrity is a real bug, not a stylistic
+preference.
+
+Flag when MD5 / SHA-1 is used to:
+- hash a password / passphrase (use bcrypt / scrypt / argon2)
+- derive a key from a secret (use HKDF / PBKDF2)
+- sign or verify a token / payload (use HMAC-SHA256 or better)
+
+Suppress when:
+- used for a NON-security purpose: ETag generation, cache key,
+  content addressing, deterministic identifier (the hash's
+  cryptographic weakness doesn't matter for cache invalidation)
+- used to verify an integrity tag returned by an external system
+  that itself uses MD5 / SHA-1 (S3 ETag, legacy webhook contract)
+- the call is to a `crypto.createHmac('sha1', ...)` and the spec
+  the code implements (e.g. AWS Signature V1, older OAuth flows)
+  mandates SHA-1
+
+In Java and Kotlin this is `MessageDigest.getInstance("MD5")` or
+`getInstance("SHA-1")`. The fix is BCrypt or Argon2 for passwords and
+SHA-256 or better for signatures.

package/lenses/env-vars-read-at-module-top.md

@@ -0,0 +1,42 @@
+---
+name: env-vars-read-at-module-top
+description: process.env read at module-evaluate time, undefined before loadEnvFile
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+  hunk_regex: "process\\.env\\."
+confidence_floor: 0.75
+---
+
+A module reads `process.env.X` at module-evaluate time (top-level
+`const X = process.env.X` or in a default-export object). ESM
+evaluates all imports BEFORE the entry's body, so any env var set
+by `dotenv` / `process.loadEnvFile()` / a manual setup at the
+entry point is undefined when this module loads.
+
+Symptom: the value is `undefined` in dev despite the variable
+existing in `.env`; client init silently uses defaults; integration
+breaks in a way that's hard to root-cause from a stack trace.
+
+Flag when a module's top-level body (NOT inside a function) reads
+`process.env.X` AND the resulting value is exported / used to
+initialize a client / SDK / config object.
+
+Suppress when:
+- the read is inside a function the entry point calls AFTER env
+  loading (lazy init pattern)
+- the module documents that it must be imported AFTER env setup
+  with a comment explaining why
+- the read is for a build-time constant baked in via the bundler
+  (Vite's `import.meta.env`, esbuild's `--define`)

package/lenses/eval-on-user-input.md

@@ -0,0 +1,51 @@
+---
+name: eval-on-user-input
+description: eval / new Function / vm.runInThisContext over untrusted input, RCE
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "*.java"
+    - "*.kt"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+    - "**/*.java"
+    - "**/*.kt"
+  hunk_regex: "\\beval\\s*\\(|new\\s+Function\\s*\\(|vm\\.(runInThisContext|runInNewContext|runInContext)|child_process\\.(exec|execSync)|Runtime\\.getRuntime\\s*\\(\\s*\\)\\.exec|ProcessBuilder\\s*\\(|ScriptEngine\\b"
+security: true
+confidence_floor: 0.85
+---
+
+`eval(input)`, `new Function(input)`, or `vm.runInThisContext(input)`
+called with a value derived from user input is server-side remote
+code execution. `child_process.exec(input)` (the unsanitized
+shell-string form) is the same thing for OS commands. There is no
+"weak" version of this finding; if the input traces back to user
+control, it is a critical bug.
+
+Flag with high confidence when any of these calls receive a value
+sourced from request body / query / path / form / env / file
+contents.
+
+Suppress when:
+- the argument is a build-time constant
+- the argument is derived from a strictly-typed structured input
+  (e.g. an integer parsed from `req.params.id`) embedded into a
+  fixed template, but recommend the safer alternative anyway
+- `child_process.execFile` / `spawn` with an array of args is used
+  instead (no shell parsing)
+- the input is run through a parser → AST → restricted-evaluator
+  (e.g. a sandboxed expression evaluator like `expr-eval`) rather
+  than the JS runtime
+
+In Java and Kotlin the equivalents are `Runtime.getRuntime().exec(...)`,
+`ProcessBuilder`, and the `ScriptEngine` family evaluating a script
+string that came from a request.

package/lenses/fetch-without-timeout.md

@@ -0,0 +1,41 @@
+---
+name: fetch-without-timeout
+description: Outbound HTTP request without timeout / abort signal, request thread hang
+triggers:
+  files:
+    - "*.ts"
+    - "*.tsx"
+    - "*.js"
+    - "*.jsx"
+    - "*.mjs"
+    - "*.cjs"
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+  hunk_regex: "\\bfetch\\s*\\(|axios\\.(get|post|put|patch|delete|request)|got\\(|undici|ky\\(|node-fetch"
+security: true
+confidence_floor: 0.7
+---
+
+A server-side outbound HTTP call (fetch / axios / got / ky / undici)
+is made without a timeout or `AbortSignal`. The upstream can take
+seconds to minutes to time out at the network layer; meanwhile the
+request handler is blocked, downstream callers stack up, and one
+slow third party can drag the whole API into cascading latency.
+
+Flag when:
+- the call is `fetch(url)` with no `signal:` option
+- `axios.get(...)` / `axios.request(...)` with no `timeout:` option
+- the call is to a third-party host (not the same service / not
+  localhost)
+
+Suppress when:
+- `signal: AbortSignal.timeout(N)` is passed
+- `timeout: N` is set
+- the project-wide HTTP client wrapper applies a default timeout
+  (look for the wrapper before raising)
+- the call is to a local sidecar / same-pod service where timeouts
+  are explicitly managed at the platform layer (rare in app code)