opensecurity 0.2.0 → 0.3.0

package/dist/engines/native/taint.js

@@ -0,0 +1,312 @@
+function getNodeText(node, source) {
+    return source.slice(node.startIndex, node.endIndex);
+}
+function normalizeTraverseNode(node) {
+    return node;
+}
+function matchesCallee(name, matcher) {
+    if (matcher.callee) {
+        const match = matcher.callee;
+        if (Array.isArray(match) && match.includes(name))
+            return true;
+        if (match === name)
+            return true;
+    }
+    if (matcher.calleePrefix) {
+        const match = matcher.calleePrefix;
+        if (Array.isArray(match) && match.some((prefix) => name.startsWith(prefix)))
+            return true;
+        if (typeof match === "string" && name.startsWith(match))
+            return true;
+    }
+    if (matcher.calleePattern) {
+        const match = matcher.calleePattern;
+        const patterns = Array.isArray(match) ? match : [match];
+        return patterns.some((pattern) => matchGlob(name, pattern));
+    }
+    return false;
+}
+function matchGlob(value, pattern) {
+    if (pattern === value)
+        return true;
+    try {
+        const picomatch = require("picomatch");
+        const isMatch = picomatch(pattern, { nocase: false, dot: true });
+        return isMatch(value);
+    }
+    catch {
+        return false;
+    }
+}
+function getNodeNames(node, lang, source) {
+    if (lang.identifierNodes.includes(node.type)) {
+        return [getNodeText(node, source)];
+    }
+    if (lang.memberNodes.includes(node.type)) {
+        const objectNode = pickField(node, lang.memberObjectFields);
+        const propNode = pickField(node, lang.memberPropertyFields);
+        const objectNames = objectNode ? getNodeNames(objectNode, lang, source) : [];
+        const propName = propNode ? (getNodeNames(propNode, lang, source)[0] ?? getNodeText(propNode, source)) : null;
+        if (!propName)
+            return [];
+        const fullNames = objectNames.length ? objectNames.map((name) => `${name}.${propName}`) : [propName];
+        const variants = new Set();
+        for (const fullName of fullNames) {
+            const parts = fullName.split(".");
+            for (let i = 0; i < parts.length; i += 1) {
+                variants.add(parts.slice(i).join("."));
+            }
+        }
+        return Array.from(variants);
+    }
+    return [];
+}
+function pickField(node, fields) {
+    for (const field of fields) {
+        const child = node.childForFieldName?.(field);
+        if (child)
+            return normalizeTraverseNode(child);
+    }
+    return null;
+}
+function getCallNames(node, lang, source) {
+    const callee = pickField(node, lang.callCalleeFields) ??
+        (node.namedChildren?.[0] ? normalizeTraverseNode(node.namedChildren[0]) : null);
+    if (!callee)
+        return [];
+    const names = getNodeNames(callee, lang, source);
+    if (names.length)
+        return names;
+    return [getNodeText(callee, source)];
+}
+function getCallArguments(node, lang) {
+    const argNode = pickField(node, lang.callArgumentFields);
+    if (argNode?.namedChildren?.length) {
+        return argNode.namedChildren.map(normalizeTraverseNode);
+    }
+    return [];
+}
+function getAssignmentSides(node, lang) {
+    const left = pickField(node, lang.assignmentLeftFields);
+    const right = pickField(node, lang.assignmentRightFields);
+    return { left: left ? normalizeTraverseNode(left) : null, right: right ? normalizeTraverseNode(right) : null };
+}
+function isStringNode(node, lang) {
+    return lang.stringNodes.includes(node.type);
+}
+function walk(node, fn) {
+    fn(node);
+    const children = node.namedChildren ?? [];
+    for (const child of children) {
+        walk(normalizeTraverseNode(child), fn);
+    }
+}
+function walkWithScopes(node, isScopeNode, onEnterScope, onExitScope, fn) {
+    const scoped = isScopeNode(node);
+    if (scoped)
+        onEnterScope();
+    fn(node);
+    const children = node.namedChildren ?? [];
+    for (const child of children) {
+        walkWithScopes(normalizeTraverseNode(child), isScopeNode, onEnterScope, onExitScope, fn);
+    }
+    if (scoped)
+        onExitScope();
+}
+function findIdentifiers(node, lang, source) {
+    const names = [];
+    walk(node, (n) => {
+        const name = getNodeNames(n, lang, source)[0];
+        if (name && lang.identifierNodes.includes(n.type))
+            names.push(name);
+    });
+    return names;
+}
+function matchesAnyCallee(names, matcher) {
+    for (const name of names) {
+        if (matchesCallee(name, matcher))
+            return true;
+    }
+    return false;
+}
+function indexToLineColumn(source, index) {
+    const before = source.slice(0, Math.max(0, index));
+    const lines = before.split("\n");
+    const line = lines.length;
+    const column = lines[lines.length - 1]?.length ?? 0;
+    return { line, column: column + 1 };
+}
+export function runNativeTaint(tree, source, lang, ruleSet, filePath) {
+    const root = normalizeTraverseNode(tree.rootNode ?? tree);
+    const findings = [];
+    const taintedVarsStack = [new Set()];
+    const taintedExpressions = new WeakSet();
+    const sanitizedVarsStack = [new Set()];
+    const sanitizedExpressions = new WeakSet();
+    const pushScope = () => taintedVarsStack.push(new Set());
+    const popScope = () => taintedVarsStack.pop();
+    const currentScope = () => taintedVarsStack[taintedVarsStack.length - 1];
+    const taint = (name) => currentScope()?.add(name);
+    const untaint = (name) => currentScope()?.delete(name);
+    const isTainted = (name) => currentScope()?.has(name) ?? false;
+    const pushSanitizedScope = () => sanitizedVarsStack.push(new Set());
+    const popSanitizedScope = () => sanitizedVarsStack.pop();
+    const currentSanitizedScope = () => sanitizedVarsStack[sanitizedVarsStack.length - 1];
+    const sanitize = (name) => currentSanitizedScope()?.add(name);
+    const unsanitize = (name) => currentSanitizedScope()?.delete(name);
+    const isSanitized = (name) => currentSanitizedScope()?.has(name) ?? false;
+    const isScopeNode = (node) => (lang.functionNodes ?? []).includes(node.type);
+    const valueIsSanitized = (node, rule) => {
+        if (sanitizedExpressions.has(node))
+            return true;
+        const nodeNames = getNodeNames(node, lang, source);
+        const primaryName = nodeNames[0];
+        if (lang.identifierNodes.includes(node.type) && primaryName) {
+            return isSanitized(primaryName);
+        }
+        if (lang.memberNodes.includes(node.type) && primaryName) {
+            return isSanitized(primaryName);
+        }
+        if (lang.callNodes.includes(node.type)) {
+            const calleeNames = getCallNames(node, lang, source);
+            if (calleeNames.length && rule.sanitizers?.some((san) => matchesAnyCallee(calleeNames, san.matcher))) {
+                sanitizedExpressions.add(node);
+                return true;
+            }
+        }
+        const children = node.namedChildren ?? [];
+        return children.some((child) => valueIsSanitized(normalizeTraverseNode(child), rule));
+    };
+    const valueIsTainted = (node, rule) => {
+        if (valueIsSanitized(node, rule))
+            return false;
+        if (taintedExpressions.has(node))
+            return true;
+        const nodeNames = getNodeNames(node, lang, source);
+        if (nodeNames.length && rule.sources?.some((src) => matchesAnyCallee(nodeNames, src.matcher))) {
+            return true;
+        }
+        const primaryName = nodeNames[0];
+        if (lang.identifierNodes.includes(node.type) && primaryName) {
+            return isTainted(primaryName);
+        }
+        if (lang.memberNodes.includes(node.type) && primaryName) {
+            return isTainted(primaryName);
+        }
+        if (lang.callNodes.includes(node.type)) {
+            const calleeNames = getCallNames(node, lang, source);
+            if (calleeNames.length) {
+                if (rule.sanitizers?.some((san) => matchesAnyCallee(calleeNames, san.matcher))) {
+                    sanitizedExpressions.add(node);
+                    return false;
+                }
+                if (rule.sources?.some((src) => matchesAnyCallee(calleeNames, src.matcher)))
+                    return true;
+            }
+        }
+        const children = node.namedChildren ?? [];
+        return children.some((child) => valueIsTainted(normalizeTraverseNode(child), rule));
+    };
+    const handleAssignment = (node, rule) => {
+        const { left, right } = getAssignmentSides(node, lang);
+        if (!left || !right)
+            return;
+        const targetNames = findIdentifiers(left, lang, source);
+        const sanitized = valueIsSanitized(right, rule);
+        const tainted = valueIsTainted(right, rule);
+        for (const name of targetNames) {
+            if (sanitized) {
+                untaint(name);
+                sanitize(name);
+            }
+            else if (tainted) {
+                taint(name);
+                taintedExpressions.add(right);
+                unsanitize(name);
+            }
+            else {
+                untaint(name);
+                unsanitize(name);
+            }
+        }
+    };
+    const reportFinding = (rule, node, message) => {
+        const loc = node.startPosition;
+        const fallback = loc ? null : indexToLineColumn(source, node.startIndex);
+        findings.push({
+            ruleId: rule.id,
+            ruleTitle: rule.title,
+            severity: rule.severity,
+            owasp: rule.owasp,
+            file: filePath,
+            line: loc ? loc.row + 1 : fallback?.line,
+            column: loc ? loc.column + 1 : fallback?.column,
+            message
+        });
+    };
+    const runRule = (rule) => {
+        if (rule.kind === "secret") {
+            const pattern = rule.literalPattern ? new RegExp(rule.literalPattern, "i") : null;
+            if (!pattern)
+                return;
+            walk(root, (node) => {
+                if (!isStringNode(node, lang))
+                    return;
+                const text = getNodeText(node, source);
+                if (pattern.test(text)) {
+                    reportFinding(rule, node, rule.title);
+                }
+            });
+            return;
+        }
+        if (rule.kind === "direct") {
+            const matcher = {
+                callee: rule.callee,
+                calleePrefix: rule.calleePrefix,
+                calleePattern: rule.calleePattern
+            };
+            walk(root, (node) => {
+                if (!lang.callNodes.includes(node.type))
+                    return;
+                const names = getCallNames(node, lang, source);
+                if (names.length && matchesAnyCallee(names, matcher)) {
+                    reportFinding(rule, node, rule.title);
+                }
+            });
+            return;
+        }
+        walkWithScopes(root, isScopeNode, () => {
+            pushScope();
+            pushSanitizedScope();
+        }, () => {
+            popScope();
+            popSanitizedScope();
+        }, (node) => {
+            if (lang.assignmentNodes.includes(node.type)) {
+                handleAssignment(node, rule);
+                return;
+            }
+            if (lang.callNodes.includes(node.type)) {
+                const calleeNames = getCallNames(node, lang, source);
+                if (!calleeNames.length)
+                    return;
+                const sink = rule.sinks?.find((candidate) => matchesAnyCallee(calleeNames, candidate.matcher));
+                if (!sink)
+                    return;
+                const args = getCallArguments(node, lang);
+                const hasTainted = args.some((arg) => valueIsTainted(arg, rule));
+                if (hasTainted) {
+                    reportFinding(rule, node, `Tainted data reaches sink ${sink.name}`);
+                }
+            }
+        });
+    };
+    for (const rule of ruleSet.rules) {
+        taintedVarsStack.length = 0;
+        taintedVarsStack.push(new Set());
+        sanitizedVarsStack.length = 0;
+        sanitizedVarsStack.push(new Set());
+        runRule(rule);
+    }
+    return findings;
+}

package/dist/engines/rules/defaultRules.js

@@ -0,0 +1,177 @@
+export const DEFAULT_RULES = [
+    {
+        id: "js-eval-injection",
+        name: "Eval Injection",
+        description: "Untrusted data reaches eval or Function",
+        severity: "high",
+        owasp: "A03:2021 Injection",
+        sources: [
+            { id: "src-getUserInput", name: "getUserInput", matcher: { callee: "getUserInput" } },
+            { id: "src-req-param", name: "req.param", matcher: { callee: "req.param" } },
+            { id: "src-prompt", name: "prompt", matcher: { callee: "prompt" } },
+            { id: "src-readline", name: "readline.question", matcher: { callee: "readline.question" } }
+        ],
+        sinks: [
+            { id: "sink-eval", name: "eval", matcher: { callee: "eval" } },
+            { id: "sink-function", name: "Function", matcher: { callee: "Function" } }
+        ],
+        sanitizers: [
+            { id: "san-sanitize", name: "sanitize", matcher: { callee: "sanitize" } },
+            { id: "san-escape", name: "escape", matcher: { callee: "escape" } },
+            { id: "san-validator-escape", name: "validator.escape", matcher: { callee: "validator.escape" } }
+        ]
+    },
+    {
+        id: "js-command-injection",
+        name: "Command Injection",
+        description: "Untrusted data reaches child_process execution",
+        severity: "critical",
+        owasp: "A03:2021 Injection",
+        sources: [
+            { id: "src-getUserInput", name: "getUserInput", matcher: { callee: "getUserInput" } },
+            { id: "src-req-param", name: "req.param", matcher: { callee: "req.param" } },
+            { id: "src-prompt", name: "prompt", matcher: { callee: "prompt" } }
+        ],
+        sinks: [
+            { id: "sink-exec", name: "child_process.exec", matcher: { callee: "child_process.exec" } },
+            { id: "sink-execsync", name: "child_process.execSync", matcher: { callee: "child_process.execSync" } },
+            { id: "sink-spawn", name: "child_process.spawn", matcher: { callee: "child_process.spawn" } },
+            { id: "sink-spawnsync", name: "child_process.spawnSync", matcher: { callee: "child_process.spawnSync" } },
+            { id: "sink-execfile", name: "child_process.execFile", matcher: { callee: "child_process.execFile" } },
+            { id: "sink-execfilesync", name: "child_process.execFileSync", matcher: { callee: "child_process.execFileSync" } }
+        ],
+        sanitizers: [
+            { id: "san-shellescape", name: "shellescape", matcher: { callee: "shellescape" } },
+            { id: "san-escapeshellarg", name: "escapeShellArg", matcher: { callee: "escapeShellArg" } }
+        ]
+    },
+    {
+        id: "js-ssrf",
+        name: "Server-Side Request Forgery",
+        description: "Untrusted data reaches network request",
+        severity: "high",
+        owasp: "A10:2021 Server-Side Request Forgery",
+        sources: [
+            { id: "src-getUserInput", name: "getUserInput", matcher: { callee: "getUserInput" } },
+            { id: "src-req-param", name: "req.param", matcher: { callee: "req.param" } },
+            { id: "src-prompt", name: "prompt", matcher: { callee: "prompt" } }
+        ],
+        sinks: [
+            { id: "sink-fetch", name: "fetch", matcher: { callee: "fetch" } },
+            { id: "sink-axios", name: "axios", matcher: { callee: "axios" } },
+            { id: "sink-axios-get", name: "axios.get", matcher: { callee: "axios.get" } },
+            { id: "sink-axios-post", name: "axios.post", matcher: { callee: "axios.post" } },
+            { id: "sink-axios-request", name: "axios.request", matcher: { callee: "axios.request" } },
+            { id: "sink-got", name: "got", matcher: { callee: "got" } },
+            { id: "sink-got-get", name: "got.get", matcher: { callee: "got.get" } },
+            { id: "sink-got-post", name: "got.post", matcher: { callee: "got.post" } },
+            { id: "sink-undici-request", name: "undici.request", matcher: { callee: "undici.request" } },
+            { id: "sink-undici-fetch", name: "undici.fetch", matcher: { callee: "undici.fetch" } },
+            { id: "sink-http-get", name: "http.get", matcher: { callee: "http.get" } },
+            { id: "sink-https-get", name: "https.get", matcher: { callee: "https.get" } },
+            { id: "sink-request", name: "request", matcher: { callee: "request" } },
+            { id: "sink-request-get", name: "request.get", matcher: { callee: "request.get" } },
+            { id: "sink-request-post", name: "request.post", matcher: { callee: "request.post" } },
+            { id: "sink-superagent-get", name: "superagent.get", matcher: { callee: "superagent.get" } },
+            { id: "sink-superagent-post", name: "superagent.post", matcher: { callee: "superagent.post" } }
+        ],
+        sanitizers: [
+            { id: "san-sanitizeurl", name: "sanitizeUrl", matcher: { callee: "sanitizeUrl" } },
+            { id: "san-validateurl", name: "validateUrl", matcher: { callee: "validateUrl" } },
+            { id: "san-encodeuri", name: "encodeURI", matcher: { callee: "encodeURI" } },
+            { id: "san-encodeuricomp", name: "encodeURIComponent", matcher: { callee: "encodeURIComponent" } }
+        ]
+    },
+    {
+        id: "js-path-traversal",
+        name: "Path Traversal",
+        description: "Untrusted data reaches filesystem APIs",
+        severity: "high",
+        owasp: "A01:2021 Broken Access Control",
+        sources: [
+            { id: "src-getUserInput", name: "getUserInput", matcher: { callee: "getUserInput" } },
+            { id: "src-req-param", name: "req.param", matcher: { callee: "req.param" } },
+            { id: "src-prompt", name: "prompt", matcher: { callee: "prompt" } },
+            { id: "src-readline", name: "readline.question", matcher: { callee: "readline.question" } }
+        ],
+        sinks: [
+            { id: "sink-readfile", name: "fs.readFile", matcher: { callee: "fs.readFile" } },
+            { id: "sink-readfilesync", name: "fs.readFileSync", matcher: { callee: "fs.readFileSync" } },
+            { id: "sink-writefile", name: "fs.writeFile", matcher: { callee: "fs.writeFile" } },
+            { id: "sink-writefilesync", name: "fs.writeFileSync", matcher: { callee: "fs.writeFileSync" } },
+            { id: "sink-appendfile", name: "fs.appendFile", matcher: { callee: "fs.appendFile" } },
+            { id: "sink-appendfilesync", name: "fs.appendFileSync", matcher: { callee: "fs.appendFileSync" } },
+            { id: "sink-createreadstream", name: "fs.createReadStream", matcher: { callee: "fs.createReadStream" } },
+            { id: "sink-createwritestream", name: "fs.createWriteStream", matcher: { callee: "fs.createWriteStream" } },
+            { id: "sink-readdir", name: "fs.readdir", matcher: { callee: "fs.readdir" } },
+            { id: "sink-readdirsync", name: "fs.readdirSync", matcher: { callee: "fs.readdirSync" } },
+            { id: "sink-stat", name: "fs.stat", matcher: { callee: "fs.stat" } },
+            { id: "sink-statsync", name: "fs.statSync", matcher: { callee: "fs.statSync" } },
+            { id: "sink-lstat", name: "fs.lstat", matcher: { callee: "fs.lstat" } },
+            { id: "sink-lstatsync", name: "fs.lstatSync", matcher: { callee: "fs.lstatSync" } },
+            { id: "sink-rm", name: "fs.rm", matcher: { callee: "fs.rm" } },
+            { id: "sink-rmsync", name: "fs.rmSync", matcher: { callee: "fs.rmSync" } },
+            { id: "sink-unlink", name: "fs.unlink", matcher: { callee: "fs.unlink" } },
+            { id: "sink-unlinksync", name: "fs.unlinkSync", matcher: { callee: "fs.unlinkSync" } },
+            { id: "sink-rmdir", name: "fs.rmdir", matcher: { callee: "fs.rmdir" } },
+            { id: "sink-rmdirsync", name: "fs.rmdirSync", matcher: { callee: "fs.rmdirSync" } }
+        ],
+        sanitizers: [
+            { id: "san-path-normalize", name: "path.normalize", matcher: { callee: "path.normalize" } },
+            { id: "san-path-resolve", name: "path.resolve", matcher: { callee: "path.resolve" } },
+            { id: "san-path-join", name: "path.join", matcher: { callee: "path.join" } }
+        ]
+    },
+    {
+        id: "js-sqli",
+        name: "SQL Injection",
+        description: "Untrusted data reaches database query execution",
+        severity: "critical",
+        owasp: "A03:2021 Injection",
+        sources: [
+            { id: "src-getUserInput", name: "getUserInput", matcher: { callee: "getUserInput" } },
+            { id: "src-req-param", name: "req.param", matcher: { callee: "req.param" } },
+            { id: "src-prompt", name: "prompt", matcher: { callee: "prompt" } }
+        ],
+        sinks: [
+            { id: "sink-mysql-query", name: "mysql.query", matcher: { callee: "mysql.query" } },
+            { id: "sink-mysql2-query", name: "mysql2.query", matcher: { callee: "mysql2.query" } },
+            { id: "sink-pg-query", name: "pg.query", matcher: { callee: "pg.query" } },
+            { id: "sink-client-query", name: "client.query", matcher: { callee: "client.query" } },
+            { id: "sink-pool-query", name: "pool.query", matcher: { callee: "pool.query" } },
+            { id: "sink-connection-query", name: "connection.query", matcher: { callee: "connection.query" } },
+            { id: "sink-db-query", name: "db.query", matcher: { callee: "db.query" } },
+            { id: "sink-sequelize-query", name: "sequelize.query", matcher: { callee: "sequelize.query" } },
+            { id: "sink-knex-raw", name: "knex.raw", matcher: { callee: "knex.raw" } }
+        ],
+        sanitizers: [
+            { id: "san-sql-escape", name: "escape", matcher: { callee: "escape" } },
+            { id: "san-sql-escapeid", name: "escapeId", matcher: { callee: "escapeId" } },
+            { id: "san-sql-parameterize", name: "parameterize", matcher: { callee: "parameterize" } }
+        ]
+    },
+    {
+        id: "js-xss-template",
+        name: "XSS (Server Templates)",
+        description: "Untrusted data reaches server response rendering",
+        severity: "high",
+        owasp: "A03:2021 Injection",
+        sources: [
+            { id: "src-getUserInput", name: "getUserInput", matcher: { callee: "getUserInput" } },
+            { id: "src-req-param", name: "req.param", matcher: { callee: "req.param" } },
+            { id: "src-prompt", name: "prompt", matcher: { callee: "prompt" } }
+        ],
+        sinks: [
+            { id: "sink-res-send", name: "res.send", matcher: { callee: "res.send" } },
+            { id: "sink-res-write", name: "res.write", matcher: { callee: "res.write" } },
+            { id: "sink-res-end", name: "res.end", matcher: { callee: "res.end" } },
+            { id: "sink-res-render", name: "res.render", matcher: { callee: "res.render" } },
+            { id: "sink-reply-send", name: "reply.send", matcher: { callee: "reply.send" } }
+        ],
+        sanitizers: [
+            { id: "san-escape", name: "escape", matcher: { callee: "escape" } },
+            { id: "san-encodeuri", name: "encodeURI", matcher: { callee: "encodeURI" } },
+            { id: "san-encodeuricomp", name: "encodeURIComponent", matcher: { callee: "encodeURIComponent" } }
+        ]
+    }
+];

package/dist/engines/rules/loadRules.js

@@ -0,0 +1,14 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { DEFAULT_RULES } from "./defaultRules.js";
+export async function loadRules(rulesPath, cwd) {
+    if (!rulesPath)
+        return DEFAULT_RULES;
+    const resolved = path.isAbsolute(rulesPath) ? rulesPath : path.join(cwd, rulesPath);
+    const raw = await fs.readFile(resolved, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) {
+        throw new Error("Rules file must be a JSON array");
+    }
+    return parsed;
+}

package/dist/io/fileWalker.js

@@ -0,0 +1,27 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import picomatch from "picomatch";
+export async function walkFiles(rootDir, options) {
+    const includeMatchers = options.include.map((p) => picomatch(p, { dot: true }));
+    const excludeMatchers = options.exclude.map((p) => picomatch(p, { dot: true }));
+    const results = [];
+    async function visit(currentDir) {
+        const entries = await fs.readdir(currentDir, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = path.join(currentDir, entry.name);
+            const relPath = path.relative(rootDir, fullPath).split(path.sep).join("/");
+            if (excludeMatchers.some((m) => m(relPath))) {
+                continue;
+            }
+            if (entry.isDirectory()) {
+                await visit(fullPath);
+                continue;
+            }
+            if (includeMatchers.length === 0 || includeMatchers.some((m) => m(relPath))) {
+                results.push(fullPath);
+            }
+        }
+    }
+    await visit(rootDir);
+    return results;
+}