sdlc-agent-4-enterprise-server 1.0.0

package/src/engine/analyzers/security/taint/TaintRegistry.ts

@@ -0,0 +1,139 @@
+/**
+ * KSA-164: Taint Registry — Configuration of taint sources, sinks, and sanitizers.
+ */
+
+import type { TaintSourceType, TaintSinkType } from '../types.js';
+
+export interface SourcePattern {
+  type: TaintSourceType;
+  patterns: string[];
+  language?: string;
+}
+
+export interface SinkPattern {
+  type: TaintSinkType;
+  functions: string[];
+  paramIndex: number;
+  language?: string;
+}
+
+export interface SanitizerPattern {
+  function: string;
+  sanitizes: TaintSinkType[];
+  language?: string;
+}
+
+export class TaintRegistry {
+  private sources: SourcePattern[] = [];
+  private sinks: SinkPattern[] = [];
+  private sanitizers: SanitizerPattern[] = [];
+
+  constructor() {
+    this.loadDefaults();
+  }
+
+  /** Check if an expression matches a taint source pattern. */
+  matchSource(expression: string, language?: string): { type: TaintSourceType } | null {
+    for (const source of this.sources) {
+      if (source.language && language && source.language !== language) continue;
+      for (const pattern of source.patterns) {
+        if (expression.includes(pattern)) {
+          return { type: source.type };
+        }
+      }
+    }
+    return null;
+  }
+
+  /** Check if a function call matches a taint sink. */
+  matchSink(functionName: string, language?: string): SinkPattern | null {
+    for (const sink of this.sinks) {
+      if (sink.language && language && sink.language !== language) continue;
+      for (const fn of sink.functions) {
+        if (functionName.includes(fn)) return sink;
+      }
+    }
+    return null;
+  }
+
+  /** Check if a function is a sanitizer for a given sink type. */
+  isSanitizer(functionName: string, sinkType: TaintSinkType, language?: string): boolean {
+    for (const san of this.sanitizers) {
+      if (san.language && language && san.language !== language) continue;
+      if (functionName.includes(san.function) && san.sanitizes.includes(sinkType)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /** Get all registered source types. */
+  getSources(): SourcePattern[] { return this.sources; }
+
+  /** Get all registered sink types. */
+  getSinks(): SinkPattern[] { return this.sinks; }
+
+  /** Get all registered sanitizers. */
+  getSanitizers(): SanitizerPattern[] { return this.sanitizers; }
+
+  /** Add custom source pattern. */
+  addSource(source: SourcePattern): void { this.sources.push(source); }
+
+  /** Add custom sink pattern. */
+  addSink(sink: SinkPattern): void { this.sinks.push(sink); }
+
+  /** Add custom sanitizer. */
+  addSanitizer(sanitizer: SanitizerPattern): void { this.sanitizers.push(sanitizer); }
+
+  private loadDefaults(): void {
+    // HTTP sources (common across frameworks)
+    this.sources = [
+      { type: 'http_param', patterns: ['req.query', 'req.params', 'request.args', 'request.GET', 'request.POST', 'ctx.query', 'ctx.params'] },
+      { type: 'http_body', patterns: ['req.body', 'request.json', 'request.form', 'request.data', 'ctx.request.body'] },
+      { type: 'http_header', patterns: ['req.headers', 'req.get(', 'request.headers', 'ctx.headers'] },
+      { type: 'http_cookie', patterns: ['req.cookies', 'request.cookies', 'ctx.cookies'] },
+      { type: 'url_param', patterns: ['req.url', 'req.originalUrl', 'request.url', 'window.location'] },
+      { type: 'file_read', patterns: ['fs.readFile', 'readFileSync', 'open(', 'fread'] },
+      { type: 'env_var', patterns: ['process.env', 'os.environ', 'getenv'] },
+      { type: 'user_input', patterns: ['prompt(', 'readline', 'input(', 'stdin'] },
+      { type: 'cli_arg', patterns: ['process.argv', 'sys.argv', 'args['] },
+      { type: 'db_result', patterns: ['.query(', '.findOne(', '.find(', '.execute('] },
+      { type: 'websocket', patterns: ['ws.on(', 'socket.on(', 'message.data'] },
+    ];
+
+    // Sinks
+    this.sinks = [
+      { type: 'sql_query', functions: ['query(', 'execute(', 'raw(', 'sequelize.query', 'knex.raw', 'db.run(', 'cursor.execute'], paramIndex: 0 },
+      { type: 'shell_exec', functions: ['exec(', 'execSync(', 'spawn(', 'system(', 'popen(', 'subprocess.run', 'child_process'], paramIndex: 0 },
+      { type: 'file_write', functions: ['writeFile(', 'writeFileSync(', 'createWriteStream(', 'fwrite'], paramIndex: 1 },
+      { type: 'file_path', functions: ['readFile(', 'readFileSync(', 'open(', 'path.join(', 'path.resolve('], paramIndex: 0 },
+      { type: 'html_output', functions: ['innerHTML', 'outerHTML', 'document.write(', 'res.send(', 'render(', 'dangerouslySetInnerHTML'], paramIndex: 0 },
+      { type: 'eval', functions: ['eval(', 'Function(', 'setTimeout(', 'setInterval(', 'vm.runInContext'], paramIndex: 0 },
+      { type: 'deserialize', functions: ['unserialize(', 'pickle.loads(', 'yaml.load(', 'JSON.parse('], paramIndex: 0 },
+      { type: 'ldap_query', functions: ['ldap.search(', 'ldap.bind(', 'ldapjs.search'], paramIndex: 0 },
+      { type: 'xml_parse', functions: ['parseXML(', 'DOMParser', 'xml2js.parse', 'libxml.parse', 'etree.fromstring'], paramIndex: 0 },
+      { type: 'url_fetch', functions: ['fetch(', 'axios(', 'axios.get(', 'axios.post(', 'http.get(', 'request(', 'urllib.request', 'requests.get'], paramIndex: 0 },
+      { type: 'redirect', functions: ['res.redirect(', 'response.redirect(', 'window.location', 'location.href'], paramIndex: 0 },
+      { type: 'log_output', functions: ['console.log(', 'logger.info(', 'logger.error(', 'logging.info'], paramIndex: 0 },
+    ];
+
+    // Sanitizers
+    this.sanitizers = [
+      { function: 'escape', sanitizes: ['html_output', 'sql_query'] },
+      { function: 'sanitize', sanitizes: ['html_output', 'sql_query', 'shell_exec'] },
+      { function: 'encodeURI', sanitizes: ['url_fetch', 'redirect'] },
+      { function: 'encodeURIComponent', sanitizes: ['url_fetch', 'redirect', 'html_output'] },
+      { function: 'parseInt', sanitizes: ['sql_query', 'shell_exec', 'file_path'] },
+      { function: 'Number(', sanitizes: ['sql_query', 'shell_exec'] },
+      { function: 'validator.', sanitizes: ['sql_query', 'html_output', 'shell_exec'] },
+      { function: 'DOMPurify', sanitizes: ['html_output'] },
+      { function: 'xss(', sanitizes: ['html_output'] },
+      { function: 'sqlstring.escape', sanitizes: ['sql_query'] },
+      { function: 'parameterize', sanitizes: ['sql_query'] },
+      { function: 'shellescape', sanitizes: ['shell_exec'] },
+      { function: 'path.basename', sanitizes: ['file_path'] },
+      { function: 'path.normalize', sanitizes: ['file_path'] },
+      { function: 'new URL(', sanitizes: ['url_fetch', 'redirect'] },
+    ];
+  }
+}

package/src/engine/analyzers/security/types.ts

@@ -0,0 +1,326 @@
+/**
+ * KSA-164/165/166/167: Security Analysis — Shared type definitions.
+ */
+
+import type { SyntaxNode } from '../../parsers/types.js';
+
+// ─── CFG Types (KSA-164) ───────────────────────────────────────────────────
+
+export type BlockType = 'entry' | 'exit' | 'normal' | 'branch' | 'loop-header' | 'catch';
+
+export type EdgeType =
+  | 'sequential'
+  | 'branch-true'
+  | 'branch-false'
+  | 'loop-back'
+  | 'loop-exit'
+  | 'exception'
+  | 'return';
+
+export interface Statement {
+  node: SyntaxNode;
+  line: number;
+  type: string;
+  text: string;
+}
+
+export interface VariableDef {
+  name: string;
+  line: number;
+  blockId: number;
+  node: SyntaxNode;
+}
+
+export interface VariableUse {
+  name: string;
+  line: number;
+  blockId: number;
+  node: SyntaxNode;
+}
+
+// ─── Data Flow Types (KSA-164) ─────────────────────────────────────────────
+
+export interface Definition {
+  variable: string;
+  line: number;
+  blockId: number;
+  id: number;
+}
+
+export interface DefUseChain {
+  definition: Definition;
+  uses: Array<{ line: number; blockId: number }>;
+}
+
+export interface DataFlowResult {
+  reachingDefs: Map<number, Set<Definition>>;
+  defUseChains: DefUseChain[];
+  definitions: Definition[];
+}
+
+// ─── Taint Types (KSA-164) ─────────────────────────────────────────────────
+
+export type TaintSourceType =
+  | 'http_param' | 'http_body' | 'http_header' | 'http_cookie'
+  | 'url_param' | 'file_read' | 'env_var' | 'db_result'
+  | 'user_input' | 'cli_arg' | 'websocket';
+
+export type TaintSinkType =
+  | 'sql_query' | 'shell_exec' | 'file_write' | 'file_path'
+  | 'html_output' | 'eval' | 'deserialize' | 'ldap_query'
+  | 'xml_parse' | 'url_fetch' | 'redirect' | 'log_output';
+
+export interface TaintSource {
+  variable: string;
+  type: TaintSourceType;
+  line: number;
+  expression: string;
+}
+
+export interface TaintSink {
+  function: string;
+  type: TaintSinkType;
+  line: number;
+  expression: string;
+  paramIndex: number;
+}
+
+export interface TaintStep {
+  variable: string;
+  line: number;
+  action: 'assign' | 'concat' | 'template_literal' | 'format_string'
+    | 'function_call' | 'collection_add' | 'destructure' | 'sanitize' | 'pass_through';
+  expression: string;
+}
+
+export interface TaintPath {
+  source: TaintSource;
+  sink: TaintSink;
+  chain: TaintStep[];
+  sanitized: boolean;
+  length: number;
+}
+
+export interface TaintResult {
+  paths: TaintPath[];
+  sources: TaintSource[];
+  sinks: TaintSink[];
+  sanitizers: Array<{ function: string; line: number; sinkTypes: TaintSinkType[] }>;
+}
+
+export interface TaintOptions {
+  maxPathLength?: number;
+  includeSanitized?: boolean;
+  sinkTypes?: TaintSinkType[];
+  sourceTypes?: TaintSourceType[];
+}
+
+// ─── Injection Types (KSA-165) ──────────────────────────────────────────────
+
+export type Severity = 'Critical' | 'High' | 'Medium' | 'Low' | 'Info';
+export type Confidence = 'High' | 'Medium' | 'Low';
+
+export interface InjectionPattern {
+  id: number;
+  name: string;
+  category: string;
+  cwe: string;
+  severity: Severity;
+  sinkPatterns: string[];
+  dangerousOps: string[];
+  safePatterns: string[];
+  description: string;
+}
+
+export interface Finding {
+  id: string;
+  ruleId: string;
+  category: string;
+  pattern: InjectionPattern;
+  taintPath: TaintPath;
+  severity: Severity;
+  confidence: Confidence;
+  cwe: string;
+  message: string;
+  remediation: string;
+  location: {
+    file: string;
+    startLine: number;
+    endLine: number;
+  };
+  suppressed: boolean;
+  suppressionInfo?: SuppressionInfo;
+}
+
+export interface SuppressionInfo {
+  marker: string;
+  scope: 'line' | 'block' | 'file';
+  line: number;
+}
+
+export interface ScanOptions {
+  filePath?: string;
+  includeSuppressed?: boolean;
+  severityThreshold?: Severity;
+  categories?: string[];
+  outputFormat?: 'json' | 'sarif';
+}
+
+export interface ScanResult {
+  findings: Finding[];
+  suppressed: Finding[];
+  summary: {
+    total: number;
+    bySeverity: Record<Severity, number>;
+    byCategory: Record<string, number>;
+    filesScanned: number;
+    scanDuration: number;
+  };
+}
+
+// ─── SSRF/IDOR/Auth Types (KSA-166) ────────────────────────────────────────
+
+export type TrustTier = 'T1' | 'T2' | 'T3';
+
+export interface SSRFFinding {
+  handler: string;
+  filePath: string;
+  source: TaintSource;
+  sink: TaintSink;
+  path: number[];
+  trustTier: TrustTier;
+  confidence: number;
+  missingControl: string;
+  cwe: string;
+  severity: Severity;
+}
+
+export interface IDORFinding {
+  handler: string;
+  filePath: string;
+  idParam: string;
+  dbLookup: { function: string; line: number };
+  missingAuthzCheck: boolean;
+  trustTier: TrustTier;
+  confidence: number;
+  cwe: string;
+  severity: Severity;
+}
+
+export interface MissingAuthFinding {
+  handler: string;
+  filePath: string;
+  route: string;
+  httpMethod: string;
+  controller: string;
+  siblingAuthRatio: number;
+  confidence: number;
+  cwe: string;
+  severity: Severity;
+}
+
+// ─── Misconfig/Secrets/SBOM Types (KSA-167) ────────────────────────────────
+
+export interface MisconfigFinding {
+  id: string;
+  pattern: string;
+  file: string;
+  line: number;
+  key: string;
+  value: string;
+  cwe: string;
+  severity: Severity;
+  remediation: string;
+}
+
+export interface SecretFinding {
+  id: string;
+  pattern: string;
+  file: string;
+  line: number;
+  match: string;
+  entropy: number;
+  cwe: string;
+  severity: Severity;
+  masked: string;
+}
+
+export interface Dependency {
+  name: string;
+  version: string;
+  scope: 'required' | 'dev' | 'optional';
+  ecosystem: string;
+  hashes: string[];
+  license?: string;
+}
+
+export interface Vulnerability {
+  id: string;
+  summary: string;
+  severity: Severity;
+  affectedVersions: string;
+  fixedVersion?: string;
+  references: string[];
+}
+
+export interface SBOMComponent {
+  type: 'library';
+  name: string;
+  version: string;
+  purl: string;
+  scope: string;
+  hashes: Array<{ alg: string; content: string }>;
+  licenses: string[];
+}
+
+// ─── SARIF Types (shared KSA-165/167) ───────────────────────────────────────
+
+export interface SARIFLog {
+  $schema: string;
+  version: '2.1.0';
+  runs: SARIFRun[];
+}
+
+export interface SARIFRun {
+  tool: {
+    driver: {
+      name: string;
+      version: string;
+      rules: SARIFRule[];
+    };
+  };
+  results: SARIFResult[];
+}
+
+export interface SARIFRule {
+  id: string;
+  name: string;
+  shortDescription: { text: string };
+  fullDescription?: { text: string };
+  defaultConfiguration: { level: 'error' | 'warning' | 'note' };
+  properties: { tags: string[] };
+}
+
+export interface SARIFResult {
+  ruleId: string;
+  level: 'error' | 'warning' | 'note';
+  message: { text: string };
+  locations: SARIFLocation[];
+  codeFlows?: SARIFCodeFlow[];
+}
+
+export interface SARIFLocation {
+  physicalLocation: {
+    artifactLocation: { uri: string };
+    region: { startLine: number; endLine?: number; startColumn?: number };
+  };
+}
+
+export interface SARIFCodeFlow {
+  threadFlows: Array<{
+    locations: Array<{
+      location: SARIFLocation;
+      message?: { text: string };
+    }>;
+  }>;
+}

package/src/engine/analyzers/similarity/ClusterBuilder.ts

@@ -0,0 +1,68 @@
+/**
+ * KSA-168: Cluster Builder — Union-Find data structure for grouping duplicates.
+ * Uses path compression and union by rank for near-O(1) operations.
+ */
+
+export class ClusterBuilder {
+  private parent: Map<number, number> = new Map();
+  private rank: Map<number, number> = new Map();
+
+  /** Find the cluster representative (with path compression). */
+  find(x: number): number {
+    if (!this.parent.has(x)) {
+      this.parent.set(x, x);
+      this.rank.set(x, 0);
+    }
+    const p = this.parent.get(x)!;
+    if (p !== x) {
+      const root = this.find(p);
+      this.parent.set(x, root);
+      return root;
+    }
+    return x;
+  }
+
+  /** Merge two nodes into the same cluster (union by rank). */
+  union(a: number, b: number): void {
+    const rootA = this.find(a);
+    const rootB = this.find(b);
+    if (rootA === rootB) return;
+
+    const rankA = this.rank.get(rootA) ?? 0;
+    const rankB = this.rank.get(rootB) ?? 0;
+
+    if (rankA < rankB) {
+      this.parent.set(rootA, rootB);
+    } else if (rankA > rankB) {
+      this.parent.set(rootB, rootA);
+    } else {
+      this.parent.set(rootB, rootA);
+      this.rank.set(rootA, rankA + 1);
+    }
+  }
+
+  /** Get all clusters (groups of 2+ members). */
+  getClusters(): Map<number, number[]> {
+    const clusters = new Map<number, number[]>();
+    for (const node of this.parent.keys()) {
+      const root = this.find(node);
+      if (!clusters.has(root)) clusters.set(root, []);
+      clusters.get(root)!.push(node);
+    }
+    // Filter to clusters with 2+ members
+    for (const [root, members] of clusters) {
+      if (members.length < 2) clusters.delete(root);
+    }
+    return clusters;
+  }
+
+  /** Check if two nodes are in the same cluster. */
+  connected(a: number, b: number): boolean {
+    return this.find(a) === this.find(b);
+  }
+
+  /** Get total number of distinct clusters. */
+  getClusterCount(): number {
+    return this.getClusters().size;
+  }
+}