npm - seaworthycode - Versions diffs - 1.1.1 → 1.1.4 - Mend

seaworthycode 1.1.1 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (68) hide show

package/dist/index.js +269 -59
package/dist/index.js.map +1 -1
package/package.json +16 -12
package/rules/external/configuration/insecure-cookie-flags.test.yaml +114 -0
package/rules/external/configuration/insecure-cookie-flags.yaml +77 -0
package/rules/external/configuration/missing-ssl-verification.test.yaml +130 -0
package/rules/external/configuration/missing-ssl-verification.yaml +123 -0
package/rules/external/data-exposure/debug-artifacts.test.yaml +143 -0
package/rules/external/data-exposure/debug-artifacts.yaml +57 -0
package/rules/external/data-exposure/hardcoded-ip.test.yaml +131 -0
package/rules/external/data-exposure/hardcoded-ip.yaml +67 -0
package/rules/external/data-exposure/localstorage-sensitive-data.test.yaml +58 -0
package/rules/external/data-exposure/localstorage-sensitive-data.yaml +60 -0
package/rules/external/dependencies/deprecated-functions.test.yaml +92 -0
package/rules/external/dependencies/deprecated-functions.yaml +66 -0
package/rules/external/ops/hardcoded-port.test.yaml +141 -0
package/rules/external/ops/hardcoded-port.yaml +91 -0
package/rules/external/ops/insecure-file-permissions.test.yaml +111 -0
package/rules/external/ops/insecure-file-permissions.yaml +91 -0
package/rules/external/resilience/missing-memory-limit.test.yaml +54 -0
package/rules/external/resilience/missing-memory-limit.yaml +59 -0
package/rules/external/resilience/missing-timeout-config.test.yaml +179 -0
package/rules/external/resilience/missing-timeout-config.yaml +124 -0
package/rules/external/security/broken-crypto-algorithm.test.yaml +104 -0
package/rules/external/security/broken-crypto-algorithm.yaml +79 -0
package/rules/external/security/http-method-override.test.yaml +40 -0
package/rules/external/security/http-method-override.yaml +35 -0
package/rules/external/security/http-no-tls.test.yaml +115 -0
package/rules/external/security/http-no-tls.yaml +59 -0
package/rules/external/security/path-traversal.test.yaml +188 -0
package/rules/external/security/path-traversal.yaml +210 -0
package/rules/external/security/unsafe-innerhtml.test.yaml +72 -0
package/rules/external/security/unsafe-innerhtml.yaml +46 -0
package/rules/external/security/untrusted-deserialization.test.yaml +79 -0
package/rules/external/security/untrusted-deserialization.yaml +48 -0
package/rules/external/security/weak-encryption-mode.test.yaml +126 -0
package/rules/external/security/weak-encryption-mode.yaml +104 -0
package/rules/external/security/weak-hash-algorithm.test.yaml +121 -0
package/rules/external/security/weak-hash-algorithm.yaml +87 -0
package/rules/external/security/xxe-parsing.test.yaml +76 -0
package/rules/external/security/xxe-parsing.yaml +63 -0
package/rules/internal/security/dangerous-eval.test.yaml +126 -0
package/rules/internal/security/dangerous-eval.yaml +134 -0
package/rules/internal/security/no-document-write.test.yaml +33 -0
package/rules/internal/security/no-document-write.yaml +40 -0
package/rules/internal/taint/MATRIX.md +16 -0
package/rules/internal/taint/bash.test.yaml +84 -0
package/rules/internal/taint/bash.yaml +166 -0
package/rules/internal/taint/dvwa.test.yaml +217 -0
package/rules/internal/taint/go.test.yaml +207 -0
package/rules/internal/taint/go.yaml +325 -0
package/rules/internal/taint/java.test.yaml +158 -0
package/rules/internal/taint/java.yaml +318 -0
package/rules/internal/taint/javascript.test.yaml +374 -0
package/rules/internal/taint/javascript.yaml +439 -0
package/rules/internal/taint/php.test.yaml +134 -0
package/rules/internal/taint/php.yaml +331 -0
package/rules/internal/taint/python.test.yaml +427 -0
package/rules/internal/taint/python.yaml +636 -0
package/rules/internal/taint/ruby.test.yaml +148 -0
package/rules/internal/taint/ruby.yaml +233 -0
package/rules/internal/taint/rust.test.yaml +585 -0
package/rules/internal/taint/rust.yaml +483 -0
package/rules/internal/taint/tsx.test.yaml +140 -0
package/rules/internal/taint/tsx.yaml +51 -0
package/rules/internal/taint/typescript.test.yaml +393 -0
package/rules/internal/taint/typescript.yaml +660 -0
package/wasm/tree-sitter-sql.wasm +0 -0

package/rules/internal/taint/python.yaml ADDED Viewed

@@ -0,0 +1,636 @@
+# attribution: CWE-79
+attribution: CWE-79
+language: python
+applies-to: []
+sources:
+  - id: flask.request.json
+    class: http-body
+    query: |
+      [
+        (call
+          function: (attribute
+            object: [
+              (attribute
+                object: (identifier) @obj
+                attribute: (identifier) @attr1
+                (#eq? @obj "flask")
+                (#eq? @attr1 "request"))
+              (identifier) @req
+              (#eq? @req "request")
+            ]
+            attribute: (identifier) @attr2
+            (#match? @attr2 "^(get_json|json)$"))) @source
+        (attribute
+          object: [
+            (attribute
+              object: (identifier) @obj
+              attribute: (identifier) @attr1
+              (#eq? @obj "flask")
+              (#eq? @attr1 "request"))
+            (identifier) @req
+            (#eq? @req "request")
+          ]
+          attribute: (identifier) @attr2
+          (#match? @attr2 "^(get_json|json)$")) @source
+      ]
+  - id: flask.request.form
+    class: http-body
+    query: |
+      (attribute
+        object: [
+          (attribute
+            object: (identifier) @obj
+            attribute: (identifier) @attr1
+            (#eq? @obj "flask")
+            (#eq? @attr1 "request"))
+          (identifier) @req
+          (#eq? @req "request")
+        ]
+        attribute: (identifier) @attr2
+        (#eq? @attr2 "form")) @source
+  - id: request.args
+    class: http-params
+    query: |
+      (attribute
+        object: [
+          (attribute
+            object: (attribute
+              object: (identifier) @obj
+              attribute: (identifier) @attr1
+              (#eq? @obj "flask")
+              (#eq? @attr1 "request"))
+            attribute: (identifier) @attr2
+            (#eq? @attr2 "args"))
+          (attribute
+            object: (identifier) @req
+            attribute: (identifier) @attr2
+            (#eq? @req "request")
+            (#eq? @attr2 "args"))
+        ]) @source
+  - id: request.values
+    class: http-params
+    query: |
+      (attribute
+        object: [
+          (attribute
+            object: (attribute
+              object: (identifier) @obj
+              attribute: (identifier) @attr1
+              (#eq? @obj "flask")
+              (#eq? @attr1 "request"))
+            attribute: (identifier) @attr2
+            (#eq? @attr2 "values"))
+          (attribute
+            object: (identifier) @req
+            attribute: (identifier) @attr2
+            (#eq? @req "request")
+            (#eq? @attr2 "values"))
+        ]) @source
+  - id: django.request.GET
+    class: http-params
+    query: |
+      (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @attr
+        (#eq? @obj "request")
+        (#eq? @attr "GET")) @source
+  - id: django.request.POST
+    class: http-body
+    query: |
+      (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @attr
+        (#eq? @obj "request")
+        (#eq? @attr "POST")) @source
+  - id: django.request.COOKIES
+    class: http-params
+    query: |
+      (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @attr
+        (#eq? @obj "request")
+        (#eq? @attr "COOKIES")) @source
+  - id: sys.argv
+    class: process-argv
+    query: |
+      (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @attr
+        (#eq? @obj "sys")
+        (#eq? @attr "argv")) @source
+  - id: os.environ.get
+    class: env-var
+    query: |
+      (call
+        function: (attribute
+          object: (attribute
+            object: (identifier) @obj
+            attribute: (identifier) @attr1
+            (#eq? @obj "os")
+            (#eq? @attr1 "environ"))
+          attribute: (identifier) @attr2
+          (#eq? @attr2 "get"))) @source
+  - id: starlette.request.query_params
+    class: http-params
+    query: |
+      (call
+        function: (attribute
+          object: (attribute
+            object: (identifier) @obj
+            attribute: (identifier) @attr1
+            (#eq? @obj "request")
+            (#eq? @attr1 "query_params"))
+          attribute: (identifier) @attr2
+          (#eq? @attr2 "get"))) @source
+  - id: starlette.request.path_params
+    class: http-params
+    query: |
+      (subscript
+        value: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr1
+          (#eq? @obj "request")
+          (#eq? @attr1 "path_params"))) @source
+  - id: fastapi.UploadFile.filename
+    class: http-body
+    query: |
+      (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @attr
+        (#eq? @obj "upload_file")
+        (#eq? @attr "filename")) @source
+  - id: open-read
+    class: fs-read
+    query: |
+      (call
+        function: (attribute
+          object: (call
+            function: (identifier) @func
+            (#eq? @func "open")
+            arguments: (argument_list (_) @arg))
+          attribute: (identifier) @attr
+          (#eq? @attr "read"))) @source
+  - id: requests.response.text
+    class: network-response
+    query: |
+      [
+        (call
+          function: (attribute
+            object: (call
+              function: (attribute
+                object: (identifier) @obj
+                attribute: (identifier) @method
+                (#eq? @obj "requests")
+                (#match? @method "^(get|post|put|delete|patch)$"))
+              arguments: (argument_list (_) @url))
+            attribute: (identifier) @attr
+            (#eq? @attr "text"))) @source
+        (attribute
+          object: (call
+            function: (attribute
+              object: (identifier) @obj
+              attribute: (identifier) @method
+              (#eq? @obj "requests")
+              (#match? @method "^(get|post|put|delete|patch)$"))
+            arguments: (argument_list (_) @url))
+          attribute: (identifier) @attr
+          (#eq? @attr "text")) @source
+      ]
+  - id: requests.response.json
+    class: network-response
+    query: |
+      (call
+        function: (attribute
+          object: (call
+            function: (attribute
+              object: (identifier) @obj
+              attribute: (identifier) @method
+              (#eq? @obj "requests")
+              (#match? @method "^(get|post|put|delete|patch)$"))
+            arguments: (argument_list (_) @url))
+          attribute: (identifier) @attr
+          (#eq? @attr "json"))) @source
+  - id: request.headers
+    class: http-params
+    # NOTE: These queries match any identifier named "request", not just
+    # framework-provided request objects. This may produce false positives
+    # when local variables are named "request".
+    query: |
+      [
+        (attribute
+          object: (attribute
+            object: (identifier) @obj
+            attribute: (identifier) @attr
+            (#eq? @obj "request")
+            (#eq? @attr "headers"))) @source
+        (attribute
+          object: (attribute
+            object: (attribute
+              object: (identifier) @flask
+              attribute: (identifier) @req
+              (#eq? @flask "flask")
+              (#eq? @req "request"))
+            attribute: (identifier) @headers
+            (#eq? @headers "headers"))) @source
+      ]
+  - id: request.cookies
+    class: http-params
+    # NOTE: These queries match any identifier named "request", not just
+    # framework-provided request objects. This may produce false positives
+    # when local variables are named "request".
+    query: |
+      [
+        (attribute
+          object: (attribute
+            object: (identifier) @obj
+            attribute: (identifier) @attr
+            (#eq? @obj "request")
+            (#match? @attr "^(cookies|COOKIES)$"))) @source
+        (attribute
+          object: (attribute
+            object: (attribute
+              object: (identifier) @flask
+              attribute: (identifier) @req
+              (#eq? @flask "flask")
+              (#eq? @req "request"))
+            attribute: (identifier) @cookies
+            (#eq? @cookies "cookies"))) @source
+      ]
+  - id: input
+    class: stdin
+    query: |
+      (call
+        function: (identifier) @func
+        (#eq? @func "input")) @source
+sinks:
+  - id: eval
+    sink-class: code-execution
+    query: |
+      (call
+        function: (identifier) @func
+        (#eq? @func "eval")
+        arguments: (argument_list (_) @sink)) @match
+  - id: exec
+    sink-class: code-execution
+    query: |
+      (call
+        function: (identifier) @func
+        (#eq? @func "exec")
+        arguments: (argument_list (_) @sink)) @match
+  - id: os.system
+    sink-class: command-injection
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @obj "os")
+          (#eq? @attr "system"))
+        arguments: (argument_list (_) @sink)) @match
+  - id: subprocess.call
+    sink-class: command-injection
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @obj "subprocess")
+          (#match? @attr "^(call|check_call|check_output|run)$"))
+        arguments: (argument_list (_) @sink)) @match
+  - id: subprocess.Popen
+    sink-class: command-injection
+    query: |
+      (call
+        function: (identifier) @func
+        (#eq? @func "Popen")
+        arguments: (argument_list (_) @sink)) @match
+  - id: django.http.HttpResponse
+    sink-class: xss
+    query: |
+      (call
+        function: (identifier) @func
+        (#eq? @func "HttpResponse")
+        arguments: (argument_list (_) @sink)) @match
+  - id: flask.render_template_string
+    sink-class: xss
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @obj "flask")
+          (#match? @attr "^(render_template_string|Markup)$"))
+        arguments: (argument_list (_) @sink)) @match
+  - id: flask.make_response
+    sink-class: xss
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @obj "flask")
+          (#eq? @attr "make_response"))
+        arguments: (argument_list (_) @sink)) @match
+  - id: cursor.execute
+    sink-class: sql-injection
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @attr "execute"))
+        arguments: (argument_list (_) @sink)) @match
+  - id: connection.execute
+    sink-class: sql-injection
+    query: |
+      (call
+        function: (attribute
+          object: (attribute
+            object: (identifier) @obj
+            attribute: (identifier) @attr1
+            (#eq? @attr1 "connection"))
+          attribute: (identifier) @attr2
+          (#eq? @attr2 "execute"))
+        arguments: (argument_list (_) @sink)) @match
+  - id: open-write
+    sink-class: path-traversal
+    query: |
+      (call
+        function: (identifier) @func
+        (#eq? @func "open")
+        arguments: (argument_list (_) @sink)) @match
+  - id: django.http.HttpResponseRedirect
+    sink-class: url-injection
+    query: |
+      (call
+        function: (identifier) @func
+        (#eq? @func "HttpResponseRedirect")
+        arguments: (argument_list (_) @sink)) @match
+  - id: flask.redirect
+    sink-class: url-injection
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @obj "flask")
+          (#eq? @attr "redirect"))
+        arguments: (argument_list (_) @sink)) @match
+  - id: dict.update
+    sink-class: prototype-pollution
+    query: |
+      (call
+        function: (attribute
+          object: (_) @obj
+          attribute: (identifier) @attr
+          (#eq? @attr "update"))
+        arguments: (argument_list (_) @sink)) @match
+  - id: dict.setdefault
+    sink-class: prototype-pollution
+    query: |
+      (call
+        function: (attribute
+          object: (_) @obj
+          attribute: (identifier) @attr
+          (#eq? @attr "setdefault"))
+        arguments: (argument_list (_) @key (_) @sink)) @match
+  - id: pickle.loads
+    sink-class: code-execution
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @obj "pickle")
+          (#eq? @attr "loads"))
+        arguments: (argument_list (_) @sink)) @match
+  - id: yaml.unsafe_load
+    sink-class: code-execution
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @obj "yaml")
+          (#eq? @attr "unsafe_load"))
+        arguments: (argument_list (_) @sink)) @match
+  - id: starlette.RedirectResponse
+    sink-class: url-injection
+    query: |
+      (call
+        function: [
+          (identifier) @func
+          (attribute
+            attribute: (identifier) @func)
+        ]
+        (#eq? @func "RedirectResponse")
+        arguments: (argument_list (_) @sink)) @match
+  - id: starlette.HTMLResponse
+    sink-class: xss
+    query: |
+      (call
+        function: [
+          (identifier) @func
+          (attribute
+            attribute: (identifier) @func)
+        ]
+        (#eq? @func "HTMLResponse")
+        arguments: (argument_list (_) @sink)) @match
+  - id: jinja2.Template
+    sink-class: xss
+    query: |
+      (call
+        function: [
+          (identifier) @func
+          (attribute
+            attribute: (identifier) @func)
+        ]
+        (#eq? @func "Template")
+        arguments: (argument_list (_) @sink)) @match
+  - id: django.db.models.raw
+    sink-class: sql-injection
+    query: |
+      (call
+        function: (attribute
+          attribute: (identifier) @method
+          (#eq? @method "raw"))
+        arguments: (argument_list (_) @sink)) @match
+  - id: django.db.models.expressions.RawSQL
+    sink-class: sql-injection
+    query: |
+      (call
+        function: [
+          (identifier) @func
+          (attribute
+            attribute: (identifier) @func)
+        ]
+        (#eq? @func "RawSQL")
+        arguments: (argument_list (_) @sink)) @match
+sanitisers:
+  - id: html.escape
+    sanitises: [xss]
+    autofix-safety: requires-import
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @obj "html")
+          (#eq? @attr "escape"))) @sanitiser
+  - id: markupsafe.escape
+    sanitises: [xss]
+    autofix-safety: requires-import
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @obj "markupsafe")
+          (#eq? @attr "escape"))) @sanitiser
+  - id: django.utils.html.escape
+    sanitises: [xss]
+    autofix-safety: requires-import
+    query: |
+      (call
+        function: (attribute
+          object: (attribute
+            object: (attribute
+              object: (identifier) @obj
+              attribute: (identifier) @attr1
+              (#eq? @obj "django")
+              (#eq? @attr1 "utils"))
+            attribute: (identifier) @attr2
+            (#eq? @attr2 "html"))
+          attribute: (identifier) @attr3
+          (#eq? @attr3 "escape"))) @sanitiser
+  - id: parameterised-query
+    sanitises: [sql-injection]
+    query: |
+      (call
+        function: (attribute
+          object: (_) @obj
+          attribute: (identifier) @attr
+          (#eq? @attr "execute"))
+        arguments: (argument_list (string) @sql (list) @params)) @sanitiser
+  - id: parameterised-query-named
+    sanitises: [sql-injection]
+    query: |
+      (call
+        function: (attribute
+          object: (_) @obj
+          attribute: (identifier) @attr
+          (#eq? @attr "execute"))
+        arguments: (argument_list (string) @sql (dictionary) @params)) @sanitiser
+  - id: shlex.quote
+    sanitises: [command-injection]
+    autofix-safety: requires-import
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @obj "shlex")
+          (#eq? @attr "quote"))) @sanitiser
+  - id: os.path.realpath
+    sanitises: [path-traversal]
+    autofix-safety: requires-import
+    query: |
+      (call
+        function: (attribute
+          object: (attribute
+            object: (identifier) @obj
+            attribute: (identifier) @attr1
+            (#eq? @obj "os")
+            (#eq? @attr1 "path"))
+          attribute: (identifier) @attr2
+          (#eq? @attr2 "realpath"))) @sanitiser
+  - id: urllib.parse.quote
+    sanitises: [url-injection]
+    autofix-safety: requires-import
+    query: |
+      (call
+        function: (attribute
+          object: (attribute
+            object: (identifier) @obj
+            attribute: (identifier) @attr1
+            (#eq? @obj "urllib")
+            (#eq? @attr1 "parse"))
+          attribute: (identifier) @attr2
+          (#eq? @attr2 "quote"))) @sanitiser
+  - id: json.dumps
+    sanitises: [prototype-pollution]
+    autofix-safety: requires-import
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @obj "json")
+          (#eq? @attr "dumps"))) @sanitiser
+  - id: copy.deepcopy
+    sanitises: [prototype-pollution]
+    autofix-safety: requires-import
+    query: |
+      (call
+        function: (attribute
+          object: (identifier) @obj
+          attribute: (identifier) @attr
+          (#eq? @obj "copy")
+          (#eq? @attr "deepcopy"))) @sanitiser
+  - id: int.float.cast
+    sanitises: [sql-injection]
+    query: |
+      (call
+        function: (identifier) @func
+        (#match? @func "^(int|float)$")) @sanitiser