pumuki 6.3.7

package/core/facts/detectors/fs/syncPart3PathOps.ts

@@ -0,0 +1,116 @@
+import { hasNode, isObject } from '../utils/astHelpers';
+
+export const hasFsCpSyncCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression' || callee.computed === true) {
+      return false;
+    }
+    const objectNode = callee.object;
+    const propertyNode = callee.property;
+    return (
+      isObject(objectNode) &&
+      objectNode.type === 'Identifier' &&
+      objectNode.name === 'fs' &&
+      isObject(propertyNode) &&
+      propertyNode.type === 'Identifier' &&
+      propertyNode.name === 'cpSync'
+    );
+  });
+};
+
+export const hasFsOpenSyncCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression' || callee.computed === true) {
+      return false;
+    }
+    const objectNode = callee.object;
+    const propertyNode = callee.property;
+    return (
+      isObject(objectNode) &&
+      objectNode.type === 'Identifier' &&
+      objectNode.name === 'fs' &&
+      isObject(propertyNode) &&
+      propertyNode.type === 'Identifier' &&
+      propertyNode.name === 'openSync'
+    );
+  });
+};
+
+export const hasFsOpendirSyncCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression' || callee.computed === true) {
+      return false;
+    }
+    const objectNode = callee.object;
+    const propertyNode = callee.property;
+    return (
+      isObject(objectNode) &&
+      objectNode.type === 'Identifier' &&
+      objectNode.name === 'fs' &&
+      isObject(propertyNode) &&
+      propertyNode.type === 'Identifier' &&
+      propertyNode.name === 'opendirSync'
+    );
+  });
+};
+
+export const hasFsMkdtempSyncCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression' || callee.computed === true) {
+      return false;
+    }
+    const objectNode = callee.object;
+    const propertyNode = callee.property;
+    return (
+      isObject(objectNode) &&
+      objectNode.type === 'Identifier' &&
+      objectNode.name === 'fs' &&
+      isObject(propertyNode) &&
+      propertyNode.type === 'Identifier' &&
+      propertyNode.name === 'mkdtempSync'
+    );
+  });
+};
+
+export const hasFsAppendFileSyncCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression' || callee.computed === true) {
+      return false;
+    }
+    const objectNode = callee.object;
+    const propertyNode = callee.property;
+    return (
+      isObject(objectNode) &&
+      objectNode.type === 'Identifier' &&
+      objectNode.name === 'fs' &&
+      isObject(propertyNode) &&
+      propertyNode.type === 'Identifier' &&
+      propertyNode.name === 'appendFileSync'
+    );
+  });
+};

package/core/facts/detectors/process/core.test.ts

@@ -0,0 +1,147 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  hasChildProcessImport,
+  hasExecCall,
+  hasExecSyncCall,
+  hasProcessEnvMutation,
+  hasProcessExitCall,
+} from './core';
+
+test('hasProcessExitCall detecta process.exit y descarta otras llamadas', () => {
+  const exitAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'process' },
+      property: { type: 'Identifier', name: 'exit' },
+    },
+    arguments: [{ type: 'NumericLiteral', value: 1 }],
+  };
+  const otherAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'process' },
+      property: { type: 'Identifier', name: 'kill' },
+    },
+    arguments: [{ type: 'Identifier', name: 'pid' }],
+  };
+
+  assert.equal(hasProcessExitCall(exitAst), true);
+  assert.equal(hasProcessExitCall(otherAst), false);
+});
+
+test('hasChildProcessImport detecta import y require de child_process', () => {
+  const importAst = {
+    type: 'ImportDeclaration',
+    source: { type: 'StringLiteral', value: 'child_process' },
+  };
+  const requireAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'require' },
+    arguments: [{ type: 'StringLiteral', value: 'child_process' }],
+  };
+  const otherImportAst = {
+    type: 'ImportDeclaration',
+    source: { type: 'StringLiteral', value: 'fs' },
+  };
+
+  assert.equal(hasChildProcessImport(importAst), true);
+  assert.equal(hasChildProcessImport(requireAst), true);
+  assert.equal(hasChildProcessImport(otherImportAst), false);
+});
+
+test('hasProcessEnvMutation detecta mutaciones sobre process.env', () => {
+  const envMutationAst = {
+    type: 'AssignmentExpression',
+    operator: '=',
+    left: {
+      type: 'MemberExpression',
+      computed: false,
+      object: {
+        type: 'MemberExpression',
+        computed: false,
+        object: { type: 'Identifier', name: 'process' },
+        property: { type: 'Identifier', name: 'env' },
+      },
+      property: { type: 'Identifier', name: 'NODE_ENV' },
+    },
+    right: { type: 'StringLiteral', value: 'production' },
+  };
+  const otherMutationAst = {
+    type: 'AssignmentExpression',
+    operator: '=',
+    left: {
+      type: 'MemberExpression',
+      computed: false,
+      object: {
+        type: 'MemberExpression',
+        computed: false,
+        object: { type: 'Identifier', name: 'config' },
+        property: { type: 'Identifier', name: 'env' },
+      },
+      property: { type: 'Identifier', name: 'NODE_ENV' },
+    },
+    right: { type: 'StringLiteral', value: 'production' },
+  };
+
+  assert.equal(hasProcessEnvMutation(envMutationAst), true);
+  assert.equal(hasProcessEnvMutation(otherMutationAst), false);
+});
+
+test('hasExecSyncCall detecta execSync directo y por member expression', () => {
+  const identifierAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'execSync' },
+    arguments: [{ type: 'StringLiteral', value: 'ls' }],
+  };
+  const memberAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'childProcess' },
+      property: { type: 'Identifier', name: 'execSync' },
+    },
+    arguments: [{ type: 'StringLiteral', value: 'ls' }],
+  };
+  const otherAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'execFileSync' },
+    arguments: [{ type: 'StringLiteral', value: 'ls' }],
+  };
+
+  assert.equal(hasExecSyncCall(identifierAst), true);
+  assert.equal(hasExecSyncCall(memberAst), true);
+  assert.equal(hasExecSyncCall(otherAst), false);
+});
+
+test('hasExecCall detecta exec directo y por member expression', () => {
+  const identifierAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'exec' },
+    arguments: [{ type: 'StringLiteral', value: 'ls' }],
+  };
+  const memberAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'childProcess' },
+      property: { type: 'Identifier', name: 'exec' },
+    },
+    arguments: [{ type: 'StringLiteral', value: 'ls' }],
+  };
+  const otherAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'spawn' },
+    arguments: [{ type: 'StringLiteral', value: 'ls' }],
+  };
+
+  assert.equal(hasExecCall(identifierAst), true);
+  assert.equal(hasExecCall(memberAst), true);
+  assert.equal(hasExecCall(otherAst), false);
+});

package/core/facts/detectors/process/core.ts

@@ -0,0 +1,120 @@
+import { hasNode, isObject } from '../utils/astHelpers';
+
+export const hasProcessExitCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression' || callee.computed === true) {
+      return false;
+    }
+
+    const objectNode = callee.object;
+    const propertyNode = callee.property;
+    return (
+      isObject(objectNode) &&
+      objectNode.type === 'Identifier' &&
+      objectNode.name === 'process' &&
+      isObject(propertyNode) &&
+      propertyNode.type === 'Identifier' &&
+      propertyNode.name === 'exit'
+    );
+  });
+};
+
+export const hasChildProcessImport = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type === 'ImportDeclaration') {
+      const source = value.source;
+      return (
+        isObject(source) &&
+        ((source.type === 'StringLiteral' && source.value === 'child_process') ||
+          (source.type === 'Literal' && source.value === 'child_process'))
+      );
+    }
+
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'Identifier' || callee.name !== 'require') {
+      return false;
+    }
+    const args = value.arguments as unknown[];
+    const firstArg = Array.isArray(args) ? args[0] : undefined;
+    return (
+      isObject(firstArg) &&
+      ((firstArg.type === 'StringLiteral' && firstArg.value === 'child_process') ||
+        (firstArg.type === 'Literal' && firstArg.value === 'child_process'))
+    );
+  });
+};
+
+export const hasProcessEnvMutation = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'AssignmentExpression') {
+      return false;
+    }
+    const left = value.left;
+    if (!isObject(left) || left.type !== 'MemberExpression') {
+      return false;
+    }
+    const outerObjectNode = left.object;
+    if (!isObject(outerObjectNode) || outerObjectNode.type !== 'MemberExpression') {
+      return false;
+    }
+    const processNode = outerObjectNode.object;
+    const envNode = outerObjectNode.property;
+    return (
+      isObject(processNode) &&
+      processNode.type === 'Identifier' &&
+      processNode.name === 'process' &&
+      isObject(envNode) &&
+      envNode.type === 'Identifier' &&
+      envNode.name === 'env'
+    );
+  });
+};
+
+export const hasExecSyncCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+    const callee = value.callee;
+    if (!isObject(callee)) {
+      return false;
+    }
+
+    // child_process.execSync() or execSync()
+    if (callee.type === 'MemberExpression' && !callee.computed) {
+      const property = callee.property;
+      return isObject(property) && property.type === 'Identifier' && property.name === 'execSync';
+    }
+
+    return callee.type === 'Identifier' && callee.name === 'execSync';
+  });
+};
+
+export const hasExecCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+    const callee = value.callee;
+    if (!isObject(callee)) {
+      return false;
+    }
+
+    // child_process.exec() or exec()
+    if (callee.type === 'MemberExpression' && !callee.computed) {
+      const property = callee.property;
+      return isObject(property) && property.type === 'Identifier' && property.name === 'exec';
+    }
+
+    return callee.type === 'Identifier' && callee.name === 'exec';
+  });
+};
+

package/core/facts/detectors/process/index.test.ts

@@ -0,0 +1,61 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  hasDynamicShellInvocationCall,
+  hasProcessExitCall,
+  hasSpawnSyncCall,
+} from './index';
+
+test('process barrel expone detectores de core, shell y spawn', () => {
+  const processExitAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'process' },
+      property: { type: 'Identifier', name: 'exit' },
+    },
+    arguments: [{ type: 'NumericLiteral', value: 1 }],
+  };
+  const dynamicShellAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'exec' },
+    arguments: [{ type: 'Identifier', name: 'cmd' }],
+  };
+  const spawnSyncAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'spawnSync' },
+    arguments: [],
+  };
+
+  assert.equal(hasProcessExitCall(processExitAst), true);
+  assert.equal(hasDynamicShellInvocationCall(dynamicShellAst), true);
+  assert.equal(hasSpawnSyncCall(spawnSyncAst), true);
+});
+
+test('process barrel descarta casos no coincidentes', () => {
+  const processKillAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'process' },
+      property: { type: 'Identifier', name: 'kill' },
+    },
+    arguments: [{ type: 'Identifier', name: 'pid' }],
+  };
+  const staticShellAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'exec' },
+    arguments: [{ type: 'StringLiteral', value: 'ls -la' }],
+  };
+  const spawnAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'spawn' },
+    arguments: [],
+  };
+
+  assert.equal(hasProcessExitCall(processKillAst), false);
+  assert.equal(hasDynamicShellInvocationCall(staticShellAst), false);
+  assert.equal(hasSpawnSyncCall(spawnAst), false);
+});

package/core/facts/detectors/process/index.ts

@@ -0,0 +1,3 @@
+export * from './core';
+export * from './shell';
+export * from './spawn';

package/core/facts/detectors/process/shell.test.ts

@@ -0,0 +1,137 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  hasChildProcessShellTrueCall,
+  hasDynamicShellInvocationCall,
+  hasExecFileUntrustedArgsCall,
+} from './shell';
+
+test('hasDynamicShellInvocationCall detecta exec/execSync con comando dinamico', () => {
+  const identifierAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'exec' },
+    arguments: [{ type: 'Identifier', name: 'cmd' }],
+  };
+  const memberAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'childProcess' },
+      property: { type: 'Identifier', name: 'execSync' },
+    },
+    arguments: [{ type: 'Identifier', name: 'cmd' }],
+  };
+  const staticAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'exec' },
+    arguments: [{ type: 'StringLiteral', value: 'ls -la' }],
+  };
+
+  assert.equal(hasDynamicShellInvocationCall(identifierAst), true);
+  assert.equal(hasDynamicShellInvocationCall(memberAst), true);
+  assert.equal(hasDynamicShellInvocationCall(staticAst), false);
+});
+
+test('hasChildProcessShellTrueCall detecta opciones shell: true en spawn/execFile', () => {
+  const spawnAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'spawn' },
+    arguments: [
+      { type: 'StringLiteral', value: 'node' },
+      { type: 'ArrayExpression', elements: [] },
+      {
+        type: 'ObjectExpression',
+        properties: [
+          {
+            type: 'ObjectProperty',
+            key: { type: 'Identifier', name: 'shell' },
+            value: { type: 'BooleanLiteral', value: true },
+          },
+        ],
+      },
+    ],
+  };
+  const computedAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: true,
+      object: { type: 'Identifier', name: 'cp' },
+      property: { type: 'StringLiteral', value: 'execFileSync' },
+    },
+    arguments: [
+      { type: 'StringLiteral', value: 'node' },
+      { type: 'ArrayExpression', elements: [] },
+      {
+        type: 'ObjectExpression',
+        properties: [
+          {
+            type: 'ObjectProperty',
+            key: { type: 'StringLiteral', value: 'shell' },
+            value: { type: 'BooleanLiteral', value: true },
+          },
+        ],
+      },
+    ],
+  };
+  const safeAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'spawn' },
+    arguments: [
+      { type: 'StringLiteral', value: 'node' },
+      { type: 'ArrayExpression', elements: [] },
+      {
+        type: 'ObjectExpression',
+        properties: [
+          {
+            type: 'ObjectProperty',
+            key: { type: 'Identifier', name: 'shell' },
+            value: { type: 'BooleanLiteral', value: false },
+          },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(hasChildProcessShellTrueCall(spawnAst), true);
+  assert.equal(hasChildProcessShellTrueCall(computedAst), true);
+  assert.equal(hasChildProcessShellTrueCall(safeAst), false);
+});
+
+test('hasExecFileUntrustedArgsCall detecta args no confiables y descarta arrays estaticos', () => {
+  const untrustedAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'execFile' },
+    arguments: [
+      { type: 'StringLiteral', value: '/usr/bin/git' },
+      { type: 'Identifier', name: 'userArgs' },
+    ],
+  };
+  const safeAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'execFileSync' },
+    arguments: [
+      { type: 'StringLiteral', value: '/usr/bin/git' },
+      {
+        type: 'ArrayExpression',
+        elements: [
+          { type: 'StringLiteral', value: 'status' },
+          { type: 'StringLiteral', value: '--short' },
+        ],
+      },
+    ],
+  };
+  const dynamicFileAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'execFile' },
+    arguments: [
+      { type: 'Identifier', name: 'binPath' },
+      { type: 'Identifier', name: 'userArgs' },
+    ],
+  };
+
+  assert.equal(hasExecFileUntrustedArgsCall(untrustedAst), true);
+  assert.equal(hasExecFileUntrustedArgsCall(safeAst), false);
+  assert.equal(hasExecFileUntrustedArgsCall(dynamicFileAst), false);
+});