seaworthycode 1.1.1 → 1.1.4

package/rules/internal/taint/rust.yaml

@@ -0,0 +1,483 @@
+# Documented exclusion: Prototype-pollution is excluded as Rust has no prototype chain.
+# attribution: CWE-79
+attribution: CWE-79
+language: rust
+applies-to: []
+
+sources:
+  - id: axum.extract.Json
+    class: http-body
+    query: |
+      (parameter
+        pattern: (tuple_struct_pattern)
+        type: (generic_type
+          type: [
+            (type_identifier) @type
+            (scoped_type_identifier name: (type_identifier) @type)
+          ]
+          (#eq? @type "Json"))) @source
+
+  - id: axum.extract.Form
+    class: http-body
+    query: |
+      (parameter
+        pattern: (tuple_struct_pattern)
+        type: (generic_type
+          type: [
+            (type_identifier) @type
+            (scoped_type_identifier name: (type_identifier) @type)
+          ]
+          (#eq? @type "Form"))) @source
+
+  - id: axum.extract.Query
+    class: http-params
+    query: |
+      (parameter
+        pattern: (tuple_struct_pattern)
+        type: (generic_type
+          type: [
+            (type_identifier) @type
+            (scoped_type_identifier name: (type_identifier) @type)
+          ]
+          (#eq? @type "Query"))) @source
+
+  - id: axum.extract.Path
+    class: http-params
+    query: |
+      (parameter
+        pattern: (tuple_struct_pattern)
+        type: (generic_type
+          type: [
+            (type_identifier) @type
+            (scoped_type_identifier name: (type_identifier) @type)
+          ]
+          (#eq? @type "Path"))) @source
+
+  - id: axum.http.HeaderMap
+    class: header
+    query: |
+      (parameter
+        type: [
+          (type_identifier) @type
+          (scoped_type_identifier name: (type_identifier) @type)
+        ]
+        (#eq? @type "HeaderMap")) @source
+
+  - id: axum.extract.CookieJar
+    class: cookie
+    query: |
+      (parameter
+        type: [
+          (type_identifier) @type
+          (scoped_type_identifier name: (type_identifier) @type)
+        ]
+        (#eq? @type "CookieJar")) @source
+
+  - id: actix.web.Json
+    class: http-body
+    query: |
+      (parameter
+        pattern: (identifier)
+        type: (generic_type
+          type: [
+            (type_identifier) @type
+            (scoped_type_identifier name: (type_identifier) @type)
+          ]
+          (#eq? @type "Json"))) @source
+
+  - id: actix.web.Form
+    class: http-body
+    query: |
+      (parameter
+        pattern: (identifier)
+        type: (generic_type
+          type: [
+            (type_identifier) @type
+            (scoped_type_identifier name: (type_identifier) @type)
+          ]
+          (#eq? @type "Form"))) @source
+
+  - id: actix.web.Query
+    class: http-params
+    query: |
+      (parameter
+        pattern: (identifier)
+        type: (generic_type
+          type: [
+            (type_identifier) @type
+            (scoped_type_identifier name: (type_identifier) @type)
+          ]
+          (#eq? @type "Query"))) @source
+
+  - id: std.env.var
+    class: env-var
+    query: |
+      (call_expression
+        function: [
+          (field_expression
+            field: (field_identifier) @func)
+          (scoped_identifier
+            name: (identifier) @func)
+        ]
+        (#match? @func "^(var|var_os)$")) @source
+
+  - id: std.env.args
+    class: process-argv
+    query: |
+      (call_expression
+        function: [
+          (field_expression
+            field: (field_identifier) @func)
+          (scoped_identifier
+            name: (identifier) @func)
+        ]
+        (#match? @func "^(args|args_os)$")) @source
+
+  - id: std.io.stdin
+    class: stdin
+    query: |
+      [
+        (call_expression
+          function: [
+            (field_expression
+              field: (field_identifier) @func)
+            (scoped_identifier
+              name: (identifier) @func)
+          ]
+          (#eq? @func "stdin")) @source
+        (call_expression
+          function: (field_expression
+            field: (field_identifier) @method
+            (#eq? @method "read_line"))
+          arguments: (arguments
+            (reference_expression
+              value: (identifier) @source)))
+      ]
+
+  - id: reqwest.response.text
+    class: network-response
+    query: |
+      (call_expression
+        function: (field_expression
+          field: (field_identifier) @method
+          (#eq? @method "text"))) @source
+
+  - id: reqwest.response.json
+    class: network-response
+    query: |
+      (call_expression
+        function: (field_expression
+          field: (field_identifier) @method
+          (#eq? @method "json"))) @source
+
+  - id: actix.HttpRequest.headers
+    class: header
+    query: |
+      (call_expression
+        function: (field_expression
+          field: (field_identifier) @method
+          (#eq? @method "headers"))) @source
+
+  - id: std.fs.read_to_string
+    class: fs-read
+    query: |
+      (call_expression
+        function: [
+          (field_expression
+            field: (field_identifier) @func)
+          (scoped_identifier
+            name: (identifier) @func)
+        ]
+        (#match? @func "^(read|read_to_string)$")) @source
+
+sinks:
+  - id: std.process.Command.new
+    sink-class: command-injection
+    query: |
+      (call_expression
+        function: (scoped_identifier
+          path: [
+            (identifier) @path
+            (scoped_identifier name: (identifier) @path)
+          ]
+          (#eq? @path "Command")
+          name: (identifier) @func
+          (#eq? @func "new"))
+        arguments: (arguments (_) @sink .)) @match
+
+  - id: std.process.Command.arg
+    sink-class: command-injection
+    query: |
+      (call_expression
+        function: (field_expression
+          field: (field_identifier) @method
+          (#eq? @method "arg"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: std.process.Command.code-exec
+    sink-class: code-execution
+    query: |
+      (call_expression
+        function: (scoped_identifier
+          path: [
+            (identifier) @path
+            (scoped_identifier name: (identifier) @path)
+          ]
+          (#eq? @path "Command")
+          name: (identifier) @func
+          (#eq? @func "new"))
+        arguments: (arguments (_) @sink .)) @match
+
+  - id: libloading.Library.new
+    sink-class: code-execution
+    query: |
+      (call_expression
+        function: (scoped_identifier
+          path: [
+            (identifier) @path
+            (scoped_identifier name: (identifier) @path)
+          ]
+          (#eq? @path "Library")
+          name: (identifier) @func
+          (#eq? @func "new"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: sqlx.query
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: [
+          (field_expression
+            field: (field_identifier) @func)
+          (scoped_identifier
+            name: (identifier) @func)
+        ]
+        (#eq? @func "query")
+        arguments: (arguments (_) @sink .)) @match
+
+  - id: sqlx.query_as
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: [
+          (field_expression
+            field: (field_identifier) @func)
+          (scoped_identifier
+            name: (identifier) @func)
+        ]
+        (#eq? @func "query_as")
+        arguments: (arguments (_) @sink .)) @match
+
+  - id: diesel.sql_query
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: [
+          (field_expression
+            field: (field_identifier) @func)
+          (scoped_identifier
+            name: (identifier) @func)
+        ]
+        (#eq? @func "sql_query")
+        arguments: (arguments (_) @sink .)) @match
+
+  - id: format.sql-sqli
+    sink-class: sql-injection
+    query: |
+      (macro_invocation
+        macro: (identifier) @name
+        (#eq? @name "format")
+        (token_tree
+          (string_literal) @sink
+          (#match? @sink "SELECT|INSERT|UPDATE|DELETE|UNION"))) @match
+
+  - id: std.fs.File.open
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: [
+          (field_expression
+            field: (field_identifier) @func)
+          (scoped_identifier
+            name: (identifier) @func)
+        ]
+        (#match? @func "^(open|read|read_to_string|remove_file)$")
+        arguments: (arguments (_) @sink .)) @match
+
+  - id: std.fs.write
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: [
+          (field_expression
+            field: (field_identifier) @func)
+          (scoped_identifier
+            name: (identifier) @func)
+        ]
+        (#match? @func "^(write|create_dir_all)$")
+        arguments: (arguments (_) @sink .)) @match
+
+  - id: axum.response.Html
+    sink-class: xss
+    query: |
+      (call_expression
+        function: [
+          (identifier) @func
+          (field_expression
+            field: (field_identifier) @func)
+          (scoped_identifier
+            name: (identifier) @func)
+        ]
+        (#eq? @func "Html")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: actix.HttpResponse.body
+    sink-class: xss
+    query: |
+      (call_expression
+        function: (field_expression
+          field: (field_identifier) @method
+          (#eq? @method "body"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: axum.response.Redirect
+    sink-class: url-injection
+    query: |
+      (call_expression
+        function: [
+          (field_expression
+            field: (field_identifier) @method)
+          (scoped_identifier
+            name: (identifier) @method)
+        ]
+        (#eq? @method "to")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: actix.HttpResponse.redirect
+    sink-class: url-injection
+    query: |
+      (call_expression
+        function: (field_expression
+          field: (field_identifier) @method
+          (#eq? @method "insert_header"))
+        arguments: (arguments
+          (tuple_expression
+            (_) @name
+            (_) @sink
+            (#match? @name "Location")))) @match
+
+sanitisers:
+  - id: str.parse.i32
+    sanitises: [sql-injection]
+    autofix-safety: global
+    query: |
+      (call_expression
+        function: (generic_function
+          function: (field_expression
+            field: (field_identifier) @method
+            (#eq? @method "parse"))
+          type_arguments: (type_arguments
+            [
+              (type_identifier) @type
+              (primitive_type) @type
+            ]
+            (#eq? @type "i32")))) @sanitiser
+
+  - id: str.parse.f64
+    sanitises: [sql-injection]
+    autofix-safety: global
+    query: |
+      (call_expression
+        function: (generic_function
+          function: (field_expression
+            field: (field_identifier) @method
+            (#eq? @method "parse"))
+          type_arguments: (type_arguments
+            [
+              (type_identifier) @type
+              (primitive_type) @type
+            ]
+            (#eq? @type "f64")))) @sanitiser
+
+  - id: str.parse.bool
+    sanitises: [sql-injection]
+    autofix-safety: global
+    query: |
+      (call_expression
+        function: (generic_function
+          function: (field_expression
+            field: (field_identifier) @method
+            (#eq? @method "parse"))
+          type_arguments: (type_arguments
+            [
+              (type_identifier) @type
+              (primitive_type) @type
+            ]
+            (#eq? @type "bool")))) @sanitiser
+
+  - id: html_escape.encode_safe
+    sanitises: [xss]
+    autofix-safety: requires-import
+    query: |
+      (call_expression
+        function: [
+          (field_expression
+            field: (field_identifier) @func)
+          (scoped_identifier
+            name: (identifier) @func)
+        ]
+        (#match? @func "^(encode_safe|encode_text)$")) @sanitiser
+
+  - id: sqlx.query.bind
+    sanitises: [sql-injection]
+    autofix-safety: global
+    query: |
+      (call_expression
+        function: (field_expression
+          field: (field_identifier) @method
+          (#eq? @method "bind"))) @sanitiser
+
+  - id: diesel.sql_query.bind
+    sanitises: [sql-injection]
+    autofix-safety: global
+    query: |
+      (call_expression
+        function: (generic_function
+          function: (field_expression
+            field: (field_identifier) @method
+            (#eq? @method "bind")))) @sanitiser
+
+  - id: std.path.Path.canonicalize
+    sanitises: [path-traversal]
+    autofix-safety: requires-import
+    query: |
+      (call_expression
+        function: (field_expression
+          field: (field_identifier) @method
+          (#eq? @method "canonicalize"))) @sanitiser
+
+  - id: url.Url.parse
+    sanitises: [url-injection]
+    autofix-safety: requires-import
+    query: |
+      (call_expression
+        function: [
+          (field_expression
+            field: (field_identifier) @func)
+          (scoped_identifier
+            name: (identifier) @func)
+        ]
+        (#eq? @func "parse")) @sanitiser
+
+  - id: shell_words.join
+    sanitises: [command-injection]
+    autofix-safety: requires-import
+    query: |
+      (call_expression
+        function: [
+          (field_expression
+            field: (field_identifier) @func)
+          (scoped_identifier
+            name: (identifier) @func)
+        ]
+        (#eq? @func "join")) @sanitiser

package/rules/internal/taint/tsx.test.yaml

@@ -0,0 +1,140 @@
+language: tsx
+cases:
+  - name: "TSX — direct XSS flow from req.body to res.send"
+    language: tsx
+    code: |
+      const x = req.body;
+      res.send(x);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: res.send
+
+  - name: "TSX — SQL injection from req.query"
+    language: tsx
+    code: |
+      const q = req.query.id;
+      db.query("SELECT * FROM users WHERE id = " + q);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: db.query
+
+  - name: "TSX — no source match returns zero flows"
+    language: tsx
+    code: |
+      console.log("hello world");
+    expect:
+      count: 0
+
+  - name: "TSX — dangerouslySetInnerHTML XSS from req.body"
+    language: tsx
+    code: |
+      export default function Page() {
+        return <div dangerouslySetInnerHTML={{ __html: req.body }} />;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: dangerouslySetInnerHTML
+
+  - name: "TSX — dangerouslySetInnerHTML safe static __html"
+    language: tsx
+    code: |
+      export default function Page() {
+        return <div dangerouslySetInnerHTML={{ __html: "<p>safe</p>" }} />;
+      }
+    expect:
+      count: 0
+
+  - name: "TSX — path traversal fs.readFile in server component"
+    language: tsx
+    code: |
+      export default function Page() {
+        fs.readFile(req.params.file);
+        return <div />;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.params
+          sinkId: fs.readFile-path
+
+  - name: "TSX — command injection exec in server component"
+    language: tsx
+    code: |
+      export default function Page() {
+        exec(req.query.cmd);
+        return <div />;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: exec
+
+  - name: "TSX — open redirect via Next redirect()"
+    language: tsx
+    code: |
+      export default function Page() {
+        redirect(req.query.next);
+        return <div />;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: next.redirect
+
+  - name: "TSX — open redirect via Link href"
+    language: tsx
+    code: |
+      export default function Page() {
+        const url = req.query.next;
+        return <Link href={url} />;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: jsx-href
+
+  - name: "TSX — prototype pollution merge in client component"
+    language: tsx
+    code: |
+      export default function Page() {
+        const target = {};
+        merge(target, req.body);
+        return <div />;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: merge-deep
+
+  - name: "TSX — formData.get to SQLi in server action"
+    language: tsx
+    code: |
+      export async function submit(formData: FormData) {
+        const id = formData.get("id");
+        db.query("SELECT * FROM users WHERE id = " + id);
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: formData.get
+          sinkId: db.query
+
+  - name: "TSX — DOMPurify sanitises dangerouslySetInnerHTML"
+    language: tsx
+    code: |
+      export default function Page() {
+        const html = DOMPurify.sanitize(req.body);
+        return <div dangerouslySetInnerHTML={{ __html: html }} />;
+      }
+    expect:
+      count: 0

package/rules/internal/taint/tsx.yaml

@@ -0,0 +1,51 @@
+# attribution: CWE-79
+# JSX-only taint rules (supplement-only). Plain TypeScript grammar cannot compile these queries.
+# Shared Node/Next sinks (e.g. next.redirect, res.send) live in typescript.yaml with applies-to: [tsx].
+# Do not duplicate sink IDs from typescript.yaml here — the loader rejects duplicate IDs on merge.
+attribution: CWE-79
+language: tsx
+supplement-only: true
+
+sources:
+  - id: formData.get
+    class: http-body
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "formData")
+          (#eq? @prop "get"))) @source
+
+sinks:
+  - id: dangerouslySetInnerHTML
+    sink-class: xss
+    query: |
+      (jsx_attribute
+        (property_identifier) @prop
+        (#eq? @prop "dangerouslySetInnerHTML")
+        (jsx_expression
+          (object
+            (pair
+              key: (property_identifier) @key
+              (#eq? @key "__html")
+              value: (_) @sink)))) @match
+
+  - id: dangerouslySetInnerHTML-spread
+    sink-class: xss
+    query: |
+      (jsx_attribute
+        (property_identifier) @prop
+        (#eq? @prop "dangerouslySetInnerHTML")
+        (jsx_expression
+          (spread_element (_) @sink))) @match
+
+  - id: jsx-href
+    sink-class: url-injection
+    query: |
+      (jsx_attribute
+        (property_identifier) @prop
+        (#eq? @prop "href")
+        (jsx_expression (_) @sink)) @match
+
+sanitisers: []