seaworthycode 1.1.1 → 1.1.4

package/rules/internal/taint/javascript.yaml

@@ -0,0 +1,439 @@
+# attribution: CWE-79
+attribution: CWE-79
+language: javascript
+applies-to: []
+
+sources:
+  - id: req.body
+    class: http-body
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "req")
+        (#eq? @prop "body")) @source
+
+  - id: req.query
+    class: http-params
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "req")
+        (#eq? @prop "query")) @source
+
+  - id: req.params
+    class: http-params
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "req")
+        (#eq? @prop "params")) @source
+
+  - id: req.file.path
+    class: http-body
+    query: |
+      (member_expression
+        object: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @fileProp
+          (#eq? @obj "req")
+          (#eq? @fileProp "file"))
+        property: (property_identifier) @prop
+        (#match? @prop "^(path|filename|originalname)$")) @source
+
+  - id: process.argv
+    class: process-argv
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "process")
+        (#eq? @prop "argv")) @source
+
+  - id: process.env
+    class: env-var
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "process")
+        (#eq? @prop "env")) @source
+
+  - id: fs.readFileSync
+    class: fs-read
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "fs")
+          (#eq? @prop "readFileSync"))
+        arguments: (arguments (_) @source))
+
+  - id: fs.createReadStream
+    class: fs-read
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "fs")
+          (#eq? @prop "createReadStream"))
+        arguments: (arguments (_) @source)) @match
+
+  - id: fetch-response-text
+    class: network-response
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @thenProp
+          (#eq? @thenProp "then"))
+        arguments: (arguments
+          (arrow_function body: (identifier) @source))) @match
+
+  - id: axios-get-response
+    class: network-response
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (member_expression
+            object: (identifier) @obj
+            property: (property_identifier) @method
+            (#eq? @obj "axios")
+            (#eq? @method "get"))
+          property: (property_identifier) @thenProp
+          (#eq? @thenProp "then"))
+        arguments: (arguments (arrow_function . parameters: (formal_parameters (identifier) @resp) . body: (member_expression
+          object: (identifier) @resp2
+          property: (property_identifier) @bodyProp
+          (#eq? @resp2 @resp)
+          (#eq? @bodyProp "data")))) @source) @match
+
+sinks:
+  - id: eval
+    sink-class: code-execution
+    query: |
+      (call_expression
+        function: (identifier) @func
+        (#eq? @func "eval")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: Function
+    sink-class: code-execution
+    query: |
+      (new_expression
+        constructor: (identifier) @func
+        (#eq? @func "Function")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: vm.runInNewContext
+    sink-class: code-execution
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "vm")
+          (#eq? @prop "runInNewContext"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: res.send
+    sink-class: xss
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "res")
+          (#eq? @prop "send"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: res.write
+    sink-class: xss
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "res")
+          (#eq? @prop "write"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: res.json
+    sink-class: xss
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "res")
+          (#eq? @prop "json"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: innerHTML
+    sink-class: xss
+    query: |
+      (assignment_expression
+        left: (member_expression
+          property: (property_identifier) @prop
+          (#eq? @prop "innerHTML"))
+        right: (_) @sink) @match
+
+  - id: db.query
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "db")
+          (#eq? @prop "query"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: connection.execute
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "connection")
+          (#eq? @prop "execute"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: sequelize.query
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (member_expression)
+          property: (property_identifier) @prop
+          (#eq? @prop "query"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: Model.find-$where
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @method
+          (#eq? @method "find"))
+        arguments: (arguments (object (pair
+          key: (property_identifier) @key
+          (#eq? @key "$where")
+          value: (_) @sink)))) @match
+
+  - id: template-literal-sql
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @method
+          (#match? @method "^(query|execute|raw)$"))
+        arguments: (arguments (template_string) @sink (#match? @sink "SELECT|INSERT|UPDATE|DELETE|UNION")))
+
+  - id: child_process.exec
+    sink-class: command-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "child_process")
+          (#eq? @prop "exec"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: child_process.execSync
+    sink-class: command-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "child_process")
+          (#eq? @prop "execSync"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: exec
+    sink-class: command-injection
+    query: |
+      (call_expression
+        function: (identifier) @func
+        (#eq? @func "exec")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: fs.readFile-path
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "fs")
+          (#eq? @prop "readFile"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: fs.writeFile-path
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "fs")
+          (#eq? @prop "writeFile"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: res.sendFile
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "res")
+          (#eq? @prop "sendFile"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: res.download
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "res")
+          (#eq? @prop "download"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: express.static
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "express")
+          (#eq? @prop "static"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: res.redirect
+    sink-class: url-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "res")
+          (#eq? @prop "redirect"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: location.href
+    sink-class: url-injection
+    query: |
+      (assignment_expression
+        left: (member_expression
+          object: (member_expression
+            property: (property_identifier) @locProp
+            (#eq? @locProp "location"))
+          property: (property_identifier) @hrefProp
+          (#eq? @hrefProp "href"))
+        right: (_) @sink) @match
+
+  - id: Object.assign-pollution
+    sink-class: prototype-pollution
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "Object")
+          (#eq? @prop "assign"))
+        arguments: (arguments (_) @first (_) @sink)) @match
+
+  - id: merge-deep
+    sink-class: prototype-pollution
+    query: |
+      (call_expression
+        function: (identifier) @func
+        (#match? @func "^(merge|extend|mergeDeep)$")
+        arguments: (arguments (_) @first (_) @sink)) @match
+
+sanitisers:
+  - id: encodeURIComponent
+    sanitises: [xss, url-injection]
+    autofix-safety: global
+    query: |
+      (call_expression
+        function: (identifier) @func
+        (#eq? @func "encodeURIComponent")) @sanitiser
+
+  - id: JSON.stringify
+    sanitises: [xss]
+    autofix-safety: global
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "JSON")
+          (#eq? @prop "stringify"))) @sanitiser
+
+  - id: DOMPurify.sanitize
+    sanitises: [xss]
+    autofix-safety: requires-import
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "DOMPurify")
+          (#eq? @prop "sanitize"))) @sanitiser
+
+  - id: parameterised-query
+    sanitises: [sql-injection]
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @prop
+          (#match? @prop "^(query|execute|run)$"))
+        arguments: (arguments . (_) @first . (template_string) @params)) @sanitiser
+
+  - id: parameterised-query-placeholder
+    sanitises: [sql-injection]
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @prop
+          (#match? @prop "^(query|execute|run)$"))
+        arguments: (arguments . (_) @first . (array) @params)) @sanitiser
+
+  - id: escape-shell-arg
+    sanitises: [command-injection]
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @prop
+          (#match? @prop "^(escapeShellArg|shellEscape|quote)$"))) @sanitiser
+
+  - id: Object.freeze-pollution
+    sanitises: [prototype-pollution]
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "Object")
+          (#eq? @prop "freeze"))) @sanitiser
+
+  - id: path.resolve
+    sanitises: [path-traversal]
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "path")
+          (#eq? @prop "resolve"))) @sanitiser

package/rules/internal/taint/php.test.yaml

@@ -0,0 +1,134 @@
+language: php
+cases:
+  - name: "SQLi from $_REQUEST to mysqli_query"
+    language: php
+    code: |
+      <?php
+      $id = $_REQUEST['id'];
+      $query = "SELECT * FROM users WHERE id = '$id';";
+      mysqli_query($conn, $query);
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.REQUEST
+          sinkId: mysqli_query
+
+  - name: "SQLi sanitised by prepared statement"
+    language: php
+    code: |
+      <?php
+      $stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
+      $stmt->execute([$_GET['id']]);
+    expect:
+      count: 0
+
+  - name: "XSS from $_GET via concat to echo"
+    language: php
+    code: |
+      <?php
+      $html .= '<pre>' . $_GET['name'] . '</pre>';
+      echo $html;
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.GET
+          sinkId: echo
+
+  - name: "XSS from $_POST to printf"
+    language: php
+    code: |
+      <?php
+      printf('<div>%s</div>', $_POST['msg']);
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.POST
+          sinkId: printf
+
+  - name: "XSS from $_GET via short echo"
+    language: php
+    code: |
+      <?= $_GET['label'] ?>
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.GET
+          sinkId: short-echo
+
+  - name: "XSS sanitised by htmlspecialchars"
+    language: php
+    code: |
+      <?php
+      $x = htmlspecialchars($_GET['x']);
+      echo $x;
+    expect:
+      count: 0
+
+  - name: "Command injection from $_GET to system"
+    language: php
+    code: |
+      <?php
+      system($_GET['cmd']);
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.GET
+          sinkId: system
+
+  - name: "Command injection sanitised by escapeshellarg"
+    language: php
+    code: |
+      <?php
+      system(escapeshellarg($_GET['cmd']));
+    expect:
+      count: 0
+
+  - name: "Path traversal via include"
+    language: php
+    code: |
+      <?php
+      include($_GET['page']);
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.GET
+          sinkId: include
+
+  - name: "Path traversal sanitised by basename"
+    language: php
+    code: |
+      <?php
+      include(basename($_GET['page']));
+    expect:
+      count: 0
+
+  - name: "Open redirect via header"
+    language: php
+    code: |
+      <?php
+      header('location: ' . $_GET['redirect']);
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.GET
+          sinkId: header
+
+  - name: "No source match — zero flows"
+    language: php
+    code: |
+      <?php
+      echo "hello world";
+    expect:
+      count: 0
+
+  - name: "encodeURIComponent equivalent does not cover sql-injection"
+    language: php
+    code: |
+      <?php
+      $q = htmlspecialchars($_GET['id']);
+      mysqli_query($conn, $q);
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.GET
+          sinkId: mysqli_query