opensecurity 0.1.0 → 0.2.0

package/rules/taint/csharp.json

@@ -0,0 +1,99 @@
+{
+  "language": "csharp",
+  "rules": [
+    {
+      "id": "cs-sqli",
+      "title": "SQL Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "req", "name": "Request.QueryString", "matcher": { "calleePattern": ["Request.QueryString*", "Request.Form*"] } }
+      ],
+      "sinks": [
+        { "id": "sql", "name": "SqlCommand.Execute", "matcher": { "calleePattern": ["*.ExecuteNonQuery", "*.ExecuteReader", "*.ExecuteScalar"] } }
+      ]
+    },
+    {
+      "id": "cs-cmd",
+      "title": "Command Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "req", "name": "Request.QueryString", "matcher": { "calleePattern": ["Request.QueryString*", "Request.Form*"] } }
+      ],
+      "sinks": [
+        { "id": "proc", "name": "Process.Start", "matcher": { "calleePattern": ["Process.Start"] } }
+      ]
+    },
+    {
+      "id": "cs-path",
+      "title": "Path Traversal",
+      "severity": "high",
+      "owasp": "A01:2021 Broken Access Control",
+      "kind": "taint",
+      "sources": [
+        { "id": "req", "name": "Request.QueryString", "matcher": { "calleePattern": ["Request.QueryString*", "Request.Form*"] } }
+      ],
+      "sinks": [
+        { "id": "file", "name": "File.ReadAllText", "matcher": { "calleePattern": ["File.ReadAllText", "File.ReadAllBytes", "File.OpenRead"] } }
+      ]
+    },
+    {
+      "id": "cs-ssrf",
+      "title": "Server-Side Request Forgery",
+      "severity": "high",
+      "owasp": "A10:2021 Server-Side Request Forgery",
+      "kind": "taint",
+      "sources": [
+        { "id": "req", "name": "Request.QueryString", "matcher": { "calleePattern": ["Request.QueryString*", "Request.Form*"] } }
+      ],
+      "sinks": [
+        { "id": "http", "name": "HttpClient", "matcher": { "calleePattern": ["HttpClient.GetAsync", "HttpClient.PostAsync", "WebClient.DownloadString"] } }
+      ]
+    },
+    {
+      "id": "cs-deser",
+      "title": "Unsafe Deserialization",
+      "severity": "high",
+      "owasp": "A08:2021 Software and Data Integrity Failures",
+      "kind": "taint",
+      "sources": [
+        { "id": "req", "name": "Request.QueryString", "matcher": { "calleePattern": ["Request.QueryString*", "Request.Form*"] } }
+      ],
+      "sinks": [
+        { "id": "binary", "name": "BinaryFormatter.Deserialize", "matcher": { "calleePattern": ["BinaryFormatter.Deserialize"] } }
+      ]
+    },
+    {
+      "id": "cs-xss-template",
+      "title": "Server Template XSS",
+      "severity": "medium",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "req", "name": "Request.QueryString", "matcher": { "calleePattern": ["Request.QueryString*", "Request.Form*"] } }
+      ],
+      "sinks": [
+        { "id": "write", "name": "Response.Write", "matcher": { "calleePattern": ["Response.Write"] } }
+      ]
+    },
+    {
+      "id": "cs-weak-crypto",
+      "title": "Weak Crypto",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "direct",
+      "calleePattern": ["MD5.Create", "SHA1.Create", "*MD5*", "*SHA1*"]
+    },
+    {
+      "id": "cs-hardcoded-secret",
+      "title": "Hardcoded Secret",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "secret",
+      "literalPattern": "(api|secret|token|password|passwd|pwd|key)[^\\n\\r]{0,20}[\"'][A-Za-z0-9_\\-]{8,}[\"']"
+    }
+  ]
+}

package/rules/taint/go.json

@@ -0,0 +1,86 @@
+{
+  "language": "go",
+  "rules": [
+    {
+      "id": "go-sqli",
+      "title": "SQL Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "query", "name": "r.URL.Query", "matcher": { "calleePattern": ["*.Query", "*.Query().Get", "*.FormValue"] } }
+      ],
+      "sinks": [
+        { "id": "sql-exec", "name": "db.Exec", "matcher": { "calleePattern": ["*.Exec", "*.Query", "*.QueryRow"] } }
+      ]
+    },
+    {
+      "id": "go-cmd",
+      "title": "Command Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "query", "name": "r.URL.Query", "matcher": { "calleePattern": ["*.Query", "*.Query().Get", "*.FormValue"] } }
+      ],
+      "sinks": [
+        { "id": "exec", "name": "exec.Command", "matcher": { "calleePattern": ["exec.Command"] } }
+      ]
+    },
+    {
+      "id": "go-path",
+      "title": "Path Traversal",
+      "severity": "high",
+      "owasp": "A01:2021 Broken Access Control",
+      "kind": "taint",
+      "sources": [
+        { "id": "query", "name": "r.URL.Query", "matcher": { "calleePattern": ["*.Query", "*.Query().Get", "*.FormValue"] } }
+      ],
+      "sinks": [
+        { "id": "os-open", "name": "os.Open", "matcher": { "calleePattern": ["os.Open", "os.OpenFile", "ioutil.ReadFile", "os.ReadFile"] } }
+      ]
+    },
+    {
+      "id": "go-ssrf",
+      "title": "Server-Side Request Forgery",
+      "severity": "high",
+      "owasp": "A10:2021 Server-Side Request Forgery",
+      "kind": "taint",
+      "sources": [
+        { "id": "query", "name": "r.URL.Query", "matcher": { "calleePattern": ["*.Query", "*.Query().Get", "*.FormValue"] } }
+      ],
+      "sinks": [
+        { "id": "http", "name": "http.Get", "matcher": { "calleePattern": ["http.Get", "http.Post", "http.NewRequest"] } }
+      ]
+    },
+    {
+      "id": "go-xss-template",
+      "title": "Server Template XSS",
+      "severity": "medium",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "query", "name": "r.URL.Query", "matcher": { "calleePattern": ["*.Query", "*.Query().Get", "*.FormValue"] } }
+      ],
+      "sinks": [
+        { "id": "tmpl", "name": "template.Execute", "matcher": { "calleePattern": ["*.Execute", "*.ExecuteTemplate"] } }
+      ]
+    },
+    {
+      "id": "go-weak-crypto",
+      "title": "Weak Crypto",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "direct",
+      "calleePattern": ["*md5*", "*sha1*"]
+    },
+    {
+      "id": "go-hardcoded-secret",
+      "title": "Hardcoded Secret",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "secret",
+      "literalPattern": "(api|secret|token|password|passwd|pwd|key)[^\\n\\r]{0,20}[\"'][A-Za-z0-9_\\-]{8,}[\"']"
+    }
+  ]
+}

package/rules/taint/java.json

@@ -0,0 +1,101 @@
+{
+  "language": "java",
+  "rules": [
+    {
+      "id": "java-sqli",
+      "title": "SQL Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.getParameter", "matcher": { "calleePattern": ["*.getParameter", "*.getHeader"] } }
+      ],
+      "sinks": [
+        { "id": "jdbc", "name": "Statement.execute", "matcher": { "calleePattern": ["*.execute", "*.executeQuery", "*.executeUpdate"] } }
+      ]
+    },
+    {
+      "id": "java-cmd",
+      "title": "Command Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.getParameter", "matcher": { "calleePattern": ["*.getParameter", "*.getHeader"] } }
+      ],
+      "sinks": [
+        { "id": "runtime", "name": "Runtime.exec", "matcher": { "calleePattern": ["Runtime.getRuntime.exec", "*.exec"] } },
+        { "id": "process", "name": "ProcessBuilder", "matcher": { "calleePattern": ["ProcessBuilder"] } }
+      ]
+    },
+    {
+      "id": "java-path",
+      "title": "Path Traversal",
+      "severity": "high",
+      "owasp": "A01:2021 Broken Access Control",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.getParameter", "matcher": { "calleePattern": ["*.getParameter", "*.getHeader"] } }
+      ],
+      "sinks": [
+        { "id": "file", "name": "FileInputStream", "matcher": { "calleePattern": ["FileInputStream", "Files.readAllBytes", "Files.readString"] } }
+      ]
+    },
+    {
+      "id": "java-ssrf",
+      "title": "Server-Side Request Forgery",
+      "severity": "high",
+      "owasp": "A10:2021 Server-Side Request Forgery",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.getParameter", "matcher": { "calleePattern": ["*.getParameter", "*.getHeader"] } }
+      ],
+      "sinks": [
+        { "id": "url", "name": "URL.openConnection", "matcher": { "calleePattern": ["*.openConnection"] } },
+        { "id": "rest", "name": "RestTemplate", "matcher": { "calleePattern": ["*.getForObject", "*.postForObject", "*.exchange"] } }
+      ]
+    },
+    {
+      "id": "java-deser",
+      "title": "Unsafe Deserialization",
+      "severity": "high",
+      "owasp": "A08:2021 Software and Data Integrity Failures",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.getParameter", "matcher": { "calleePattern": ["*.getParameter", "*.getHeader"] } }
+      ],
+      "sinks": [
+        { "id": "ois", "name": "ObjectInputStream.readObject", "matcher": { "calleePattern": ["*.readObject"] } }
+      ]
+    },
+    {
+      "id": "java-xss-template",
+      "title": "Server Template XSS",
+      "severity": "medium",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.getParameter", "matcher": { "calleePattern": ["*.getParameter", "*.getHeader"] } }
+      ],
+      "sinks": [
+        { "id": "model", "name": "ModelAndView", "matcher": { "calleePattern": ["ModelAndView"] } }
+      ]
+    },
+    {
+      "id": "java-weak-crypto",
+      "title": "Weak Crypto",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "direct",
+      "calleePattern": ["MessageDigest.getInstance", "*MD5*", "*SHA1*"]
+    },
+    {
+      "id": "java-hardcoded-secret",
+      "title": "Hardcoded Secret",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "secret",
+      "literalPattern": "(api|secret|token|password|passwd|pwd|key)[^\\n\\r]{0,20}[\"'][A-Za-z0-9_\\-]{8,}[\"']"
+    }
+  ]
+}

package/rules/taint/kotlin.json

@@ -0,0 +1,86 @@
+{
+  "language": "kotlin",
+  "rules": [
+    {
+      "id": "kt-sqli",
+      "title": "SQL Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.getParameter", "matcher": { "calleePattern": ["*.getParameter", "*.getHeader"] } }
+      ],
+      "sinks": [
+        { "id": "jdbc", "name": "Statement.execute", "matcher": { "calleePattern": ["*.execute", "*.executeQuery", "*.executeUpdate"] } }
+      ]
+    },
+    {
+      "id": "kt-cmd",
+      "title": "Command Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.getParameter", "matcher": { "calleePattern": ["*.getParameter", "*.getHeader"] } }
+      ],
+      "sinks": [
+        { "id": "runtime", "name": "Runtime.exec", "matcher": { "calleePattern": ["Runtime.getRuntime.exec", "*.exec"] } }
+      ]
+    },
+    {
+      "id": "kt-path",
+      "title": "Path Traversal",
+      "severity": "high",
+      "owasp": "A01:2021 Broken Access Control",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.getParameter", "matcher": { "calleePattern": ["*.getParameter", "*.getHeader"] } }
+      ],
+      "sinks": [
+        { "id": "file", "name": "Files.readAllBytes", "matcher": { "calleePattern": ["Files.readAllBytes", "Files.readString", "FileInputStream"] } }
+      ]
+    },
+    {
+      "id": "kt-ssrf",
+      "title": "Server-Side Request Forgery",
+      "severity": "high",
+      "owasp": "A10:2021 Server-Side Request Forgery",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.getParameter", "matcher": { "calleePattern": ["*.getParameter", "*.getHeader"] } }
+      ],
+      "sinks": [
+        { "id": "url", "name": "URL.openConnection", "matcher": { "calleePattern": ["*.openConnection"] } }
+      ]
+    },
+    {
+      "id": "kt-xss-template",
+      "title": "Server Template XSS",
+      "severity": "medium",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.getParameter", "matcher": { "calleePattern": ["*.getParameter", "*.getHeader"] } }
+      ],
+      "sinks": [
+        { "id": "tmpl", "name": "render", "matcher": { "calleePattern": ["render", "*.render"] } }
+      ]
+    },
+    {
+      "id": "kt-weak-crypto",
+      "title": "Weak Crypto",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "direct",
+      "calleePattern": ["*MD5*", "*SHA1*"]
+    },
+    {
+      "id": "kt-hardcoded-secret",
+      "title": "Hardcoded Secret",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "secret",
+      "literalPattern": "(api|secret|token|password|passwd|pwd|key)[^\\n\\r]{0,20}[\"'][A-Za-z0-9_\\-]{8,}[\"']"
+    }
+  ]
+}

package/rules/taint/php.json

@@ -0,0 +1,100 @@
+{
+  "language": "php",
+  "rules": [
+    {
+      "id": "php-sqli",
+      "title": "SQL Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "get", "name": "$_GET", "matcher": { "calleePattern": ["$_GET*", "$_POST*", "$_REQUEST*"] } }
+      ],
+      "sinks": [
+        { "id": "query", "name": "query", "matcher": { "calleePattern": ["*.query", "*.exec"] } }
+      ]
+    },
+    {
+      "id": "php-cmd",
+      "title": "Command Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "get", "name": "$_GET", "matcher": { "calleePattern": ["$_GET*", "$_POST*", "$_REQUEST*"] } }
+      ],
+      "sinks": [
+        { "id": "system", "name": "system", "matcher": { "callee": ["system", "exec", "shell_exec", "passthru"] } }
+      ]
+    },
+    {
+      "id": "php-path",
+      "title": "Path Traversal",
+      "severity": "high",
+      "owasp": "A01:2021 Broken Access Control",
+      "kind": "taint",
+      "sources": [
+        { "id": "get", "name": "$_GET", "matcher": { "calleePattern": ["$_GET*", "$_POST*", "$_REQUEST*"] } }
+      ],
+      "sinks": [
+        { "id": "file", "name": "file_get_contents", "matcher": { "callee": ["file_get_contents", "fopen", "readfile"] } }
+      ]
+    },
+    {
+      "id": "php-ssrf",
+      "title": "Server-Side Request Forgery",
+      "severity": "high",
+      "owasp": "A10:2021 Server-Side Request Forgery",
+      "kind": "taint",
+      "sources": [
+        { "id": "get", "name": "$_GET", "matcher": { "calleePattern": ["$_GET*", "$_POST*", "$_REQUEST*"] } }
+      ],
+      "sinks": [
+        { "id": "curl", "name": "curl_exec", "matcher": { "callee": ["curl_exec"] } },
+        { "id": "fopen", "name": "fopen", "matcher": { "callee": ["fopen", "file_get_contents"] } }
+      ]
+    },
+    {
+      "id": "php-deser",
+      "title": "Unsafe Deserialization",
+      "severity": "high",
+      "owasp": "A08:2021 Software and Data Integrity Failures",
+      "kind": "taint",
+      "sources": [
+        { "id": "get", "name": "$_GET", "matcher": { "calleePattern": ["$_GET*", "$_POST*", "$_REQUEST*"] } }
+      ],
+      "sinks": [
+        { "id": "unserialize", "name": "unserialize", "matcher": { "callee": ["unserialize"] } }
+      ]
+    },
+    {
+      "id": "php-xss-template",
+      "title": "Server Template XSS",
+      "severity": "medium",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "get", "name": "$_GET", "matcher": { "calleePattern": ["$_GET*", "$_POST*", "$_REQUEST*"] } }
+      ],
+      "sinks": [
+        { "id": "echo", "name": "echo", "matcher": { "calleePattern": ["echo", "print"] } }
+      ]
+    },
+    {
+      "id": "php-weak-crypto",
+      "title": "Weak Crypto",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "direct",
+      "calleePattern": ["*md5*", "*sha1*"]
+    },
+    {
+      "id": "php-hardcoded-secret",
+      "title": "Hardcoded Secret",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "secret",
+      "literalPattern": "(api|secret|token|password|passwd|pwd|key)[^\\n\\r]{0,20}[\"'][A-Za-z0-9_\\-]{8,}[\"']"
+    }
+  ]
+}

package/rules/taint/python.json

@@ -0,0 +1,108 @@
+{
+  "language": "python",
+  "rules": [
+    {
+      "id": "py-sqli",
+      "title": "SQL Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "req-args", "name": "request.args.get", "matcher": { "calleePrefix": ["request.args.get", "request.form.get", "request.values.get"] } },
+        { "id": "input", "name": "input", "matcher": { "callee": ["input", "raw_input"] } }
+      ],
+      "sinks": [
+        { "id": "cursor-exec", "name": "cursor.execute", "matcher": { "calleePattern": ["*.execute", "*.executemany"] } }
+      ],
+      "sanitizers": [
+        { "id": "param", "name": "param", "matcher": { "calleePattern": ["*.execute"] } }
+      ]
+    },
+    {
+      "id": "py-cmd",
+      "title": "Command Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "req", "name": "request.args.get", "matcher": { "calleePrefix": ["request.args.get", "request.form.get", "request.values.get"] } },
+        { "id": "input", "name": "input", "matcher": { "callee": ["input", "raw_input"] } }
+      ],
+      "sinks": [
+        { "id": "os-system", "name": "os.system", "matcher": { "callee": ["os.system"] } },
+        { "id": "subprocess", "name": "subprocess", "matcher": { "calleePrefix": ["subprocess.run", "subprocess.call", "subprocess.Popen"] } }
+      ]
+    },
+    {
+      "id": "py-path",
+      "title": "Path Traversal",
+      "severity": "high",
+      "owasp": "A01:2021 Broken Access Control",
+      "kind": "taint",
+      "sources": [
+        { "id": "req", "name": "request.args.get", "matcher": { "calleePrefix": ["request.args.get", "request.form.get", "request.values.get"] } }
+      ],
+      "sinks": [
+        { "id": "open", "name": "open", "matcher": { "callee": ["open"] } },
+        { "id": "os-open", "name": "os.open", "matcher": { "calleePrefix": ["os.open", "os.listdir", "os.remove"] } }
+      ]
+    },
+    {
+      "id": "py-ssrf",
+      "title": "Server-Side Request Forgery",
+      "severity": "high",
+      "owasp": "A10:2021 Server-Side Request Forgery",
+      "kind": "taint",
+      "sources": [
+        { "id": "req", "name": "request.args.get", "matcher": { "calleePrefix": ["request.args.get", "request.form.get", "request.values.get"] } }
+      ],
+      "sinks": [
+        { "id": "requests", "name": "requests", "matcher": { "calleePrefix": ["requests.get", "requests.post", "requests.request"] } },
+        { "id": "urllib", "name": "urllib.request.urlopen", "matcher": { "calleePrefix": ["urllib.request.urlopen"] } }
+      ]
+    },
+    {
+      "id": "py-deser",
+      "title": "Unsafe Deserialization",
+      "severity": "high",
+      "owasp": "A08:2021 Software and Data Integrity Failures",
+      "kind": "taint",
+      "sources": [
+        { "id": "req", "name": "request.args.get", "matcher": { "calleePrefix": ["request.args.get", "request.form.get", "request.values.get"] } }
+      ],
+      "sinks": [
+        { "id": "pickle", "name": "pickle.loads", "matcher": { "calleePrefix": ["pickle.loads", "pickle.load"] } },
+        { "id": "yaml", "name": "yaml.load", "matcher": { "calleePrefix": ["yaml.load"] } }
+      ]
+    },
+    {
+      "id": "py-xss-template",
+      "title": "Server Template XSS",
+      "severity": "medium",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "req", "name": "request.args.get", "matcher": { "calleePrefix": ["request.args.get", "request.form.get", "request.values.get"] } }
+      ],
+      "sinks": [
+        { "id": "render", "name": "render_template", "matcher": { "calleePrefix": ["render_template", "render"] } }
+      ]
+    },
+    {
+      "id": "py-weak-crypto",
+      "title": "Weak Crypto",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "direct",
+      "calleePattern": ["*md5*", "*sha1*", "hashlib.md5", "hashlib.sha1"]
+    },
+    {
+      "id": "py-hardcoded-secret",
+      "title": "Hardcoded Secret",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "secret",
+      "literalPattern": "(api|secret|token|password|passwd|pwd|key)[^\\n\\r]{0,20}[\"'][A-Za-z0-9_\\-]{8,}[\"']"
+    }
+  ]
+}