opensecurity 0.1.0 → 0.2.0

package/rules/taint/ruby.json

@@ -0,0 +1,101 @@
+{
+  "language": "ruby",
+  "rules": [
+    {
+      "id": "rb-sqli",
+      "title": "SQL Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "params", "name": "params[]", "matcher": { "calleePattern": ["params.*", "params[]"] } }
+      ],
+      "sinks": [
+        { "id": "exec", "name": "execute", "matcher": { "calleePattern": ["*.execute", "*.exec_query"] } }
+      ]
+    },
+    {
+      "id": "rb-cmd",
+      "title": "Command Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "params", "name": "params[]", "matcher": { "calleePattern": ["params.*", "params[]"] } }
+      ],
+      "sinks": [
+        { "id": "system", "name": "system", "matcher": { "callee": ["system"] } },
+        { "id": "exec", "name": "exec", "matcher": { "callee": ["exec"] } }
+      ]
+    },
+    {
+      "id": "rb-path",
+      "title": "Path Traversal",
+      "severity": "high",
+      "owasp": "A01:2021 Broken Access Control",
+      "kind": "taint",
+      "sources": [
+        { "id": "params", "name": "params[]", "matcher": { "calleePattern": ["params.*", "params[]"] } }
+      ],
+      "sinks": [
+        { "id": "file", "name": "File.read", "matcher": { "calleePattern": ["File.read", "File.open"] } }
+      ]
+    },
+    {
+      "id": "rb-ssrf",
+      "title": "Server-Side Request Forgery",
+      "severity": "high",
+      "owasp": "A10:2021 Server-Side Request Forgery",
+      "kind": "taint",
+      "sources": [
+        { "id": "params", "name": "params[]", "matcher": { "calleePattern": ["params.*", "params[]"] } }
+      ],
+      "sinks": [
+        { "id": "nethttp", "name": "Net::HTTP", "matcher": { "calleePattern": ["Net::HTTP.*", "Net.HTTP.*"] } }
+      ]
+    },
+    {
+      "id": "rb-deser",
+      "title": "Unsafe Deserialization",
+      "severity": "high",
+      "owasp": "A08:2021 Software and Data Integrity Failures",
+      "kind": "taint",
+      "sources": [
+        { "id": "params", "name": "params[]", "matcher": { "calleePattern": ["params.*", "params[]"] } }
+      ],
+      "sinks": [
+        { "id": "marshal", "name": "Marshal.load", "matcher": { "calleePattern": ["Marshal.load"] } },
+        { "id": "yaml", "name": "YAML.load", "matcher": { "calleePattern": ["YAML.load"] } }
+      ]
+    },
+    {
+      "id": "rb-xss-template",
+      "title": "Server Template XSS",
+      "severity": "medium",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "params", "name": "params[]", "matcher": { "calleePattern": ["params.*", "params[]"] } }
+      ],
+      "sinks": [
+        { "id": "render", "name": "render", "matcher": { "calleePattern": ["render"] } }
+      ]
+    },
+    {
+      "id": "rb-weak-crypto",
+      "title": "Weak Crypto",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "direct",
+      "calleePattern": ["*MD5*", "*SHA1*", "Digest::MD5", "Digest::SHA1"]
+    },
+    {
+      "id": "rb-hardcoded-secret",
+      "title": "Hardcoded Secret",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "secret",
+      "literalPattern": "(api|secret|token|password|passwd|pwd|key)[^\\n\\r]{0,20}[\"'][A-Za-z0-9_\\-]{8,}[\"']"
+    }
+  ]
+}

package/rules/taint/rust.json

@@ -0,0 +1,86 @@
+{
+  "language": "rust",
+  "rules": [
+    {
+      "id": "rs-sqli",
+      "title": "SQL Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "query", "name": "web::Query", "matcher": { "calleePattern": ["Query::*", "Form::*"] } }
+      ],
+      "sinks": [
+        { "id": "sqlx", "name": "query", "matcher": { "calleePattern": ["sqlx::query", "*.execute", "*.query"] } }
+      ]
+    },
+    {
+      "id": "rs-cmd",
+      "title": "Command Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "query", "name": "web::Query", "matcher": { "calleePattern": ["Query::*", "Form::*"] } }
+      ],
+      "sinks": [
+        { "id": "cmd", "name": "Command::new", "matcher": { "calleePattern": ["Command::new"] } }
+      ]
+    },
+    {
+      "id": "rs-path",
+      "title": "Path Traversal",
+      "severity": "high",
+      "owasp": "A01:2021 Broken Access Control",
+      "kind": "taint",
+      "sources": [
+        { "id": "query", "name": "web::Query", "matcher": { "calleePattern": ["Query::*", "Form::*"] } }
+      ],
+      "sinks": [
+        { "id": "fs", "name": "fs::read", "matcher": { "calleePattern": ["fs::read", "fs::read_to_string", "File::open"] } }
+      ]
+    },
+    {
+      "id": "rs-ssrf",
+      "title": "Server-Side Request Forgery",
+      "severity": "high",
+      "owasp": "A10:2021 Server-Side Request Forgery",
+      "kind": "taint",
+      "sources": [
+        { "id": "query", "name": "web::Query", "matcher": { "calleePattern": ["Query::*", "Form::*"] } }
+      ],
+      "sinks": [
+        { "id": "reqwest", "name": "reqwest", "matcher": { "calleePattern": ["reqwest::get", "reqwest::Client.get", "reqwest::Client.post"] } }
+      ]
+    },
+    {
+      "id": "rs-xss-template",
+      "title": "Server Template XSS",
+      "severity": "medium",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "query", "name": "web::Query", "matcher": { "calleePattern": ["Query::*", "Form::*"] } }
+      ],
+      "sinks": [
+        { "id": "tmpl", "name": "Template.render", "matcher": { "calleePattern": ["*.render"] } }
+      ]
+    },
+    {
+      "id": "rs-weak-crypto",
+      "title": "Weak Crypto",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "direct",
+      "calleePattern": ["*md5*", "*sha1*"]
+    },
+    {
+      "id": "rs-hardcoded-secret",
+      "title": "Hardcoded Secret",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "secret",
+      "literalPattern": "(api|secret|token|password|passwd|pwd|key)[^\\n\\r]{0,20}[\"'][A-Za-z0-9_\\-]{8,}[\"']"
+    }
+  ]
+}

package/rules/taint/swift.json

@@ -0,0 +1,86 @@
+{
+  "language": "swift",
+  "rules": [
+    {
+      "id": "swift-sqli",
+      "title": "SQL Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.query", "matcher": { "calleePattern": ["request.query*", "request.form*"] } }
+      ],
+      "sinks": [
+        { "id": "sql", "name": "execute", "matcher": { "calleePattern": ["*.execute", "*.executeQuery"] } }
+      ]
+    },
+    {
+      "id": "swift-cmd",
+      "title": "Command Injection",
+      "severity": "high",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.query", "matcher": { "calleePattern": ["request.query*", "request.form*"] } }
+      ],
+      "sinks": [
+        { "id": "process", "name": "Process", "matcher": { "calleePattern": ["Process", "Process.run"] } }
+      ]
+    },
+    {
+      "id": "swift-path",
+      "title": "Path Traversal",
+      "severity": "high",
+      "owasp": "A01:2021 Broken Access Control",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.query", "matcher": { "calleePattern": ["request.query*", "request.form*"] } }
+      ],
+      "sinks": [
+        { "id": "file", "name": "FileHandle", "matcher": { "calleePattern": ["FileHandle", "String.init", "Data.init"] } }
+      ]
+    },
+    {
+      "id": "swift-ssrf",
+      "title": "Server-Side Request Forgery",
+      "severity": "high",
+      "owasp": "A10:2021 Server-Side Request Forgery",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.query", "matcher": { "calleePattern": ["request.query*", "request.form*"] } }
+      ],
+      "sinks": [
+        { "id": "urlsession", "name": "URLSession", "matcher": { "calleePattern": ["URLSession.shared.dataTask", "URLSession.dataTask"] } }
+      ]
+    },
+    {
+      "id": "swift-xss-template",
+      "title": "Server Template XSS",
+      "severity": "medium",
+      "owasp": "A03:2021 Injection",
+      "kind": "taint",
+      "sources": [
+        { "id": "param", "name": "request.query", "matcher": { "calleePattern": ["request.query*", "request.form*"] } }
+      ],
+      "sinks": [
+        { "id": "render", "name": "render", "matcher": { "calleePattern": ["render"] } }
+      ]
+    },
+    {
+      "id": "swift-weak-crypto",
+      "title": "Weak Crypto",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "direct",
+      "calleePattern": ["*MD5*", "*SHA1*"]
+    },
+    {
+      "id": "swift-hardcoded-secret",
+      "title": "Hardcoded Secret",
+      "severity": "medium",
+      "owasp": "A02:2021 Cryptographic Failures",
+      "kind": "secret",
+      "literalPattern": "(api|secret|token|password|passwd|pwd|key)[^\\n\\r]{0,20}[\"'][A-Za-z0-9_\\-]{8,}[\"']"
+    }
+  ]
+}