seaworthycode 1.1.1 → 1.1.4

package/rules/internal/taint/typescript.test.yaml

@@ -0,0 +1,393 @@
+language: typescript
+cases:
+  - name: "AC-4.6: direct XSS flow from req.body to res.send in TS"
+    language: typescript
+    code: |
+      const x = req.body;
+      res.send(x);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: res.send
+
+  - name: "AC-4.7: XSS sanitised by encodeURIComponent in TS — no finding"
+    language: typescript
+    code: |
+      res.send(encodeURIComponent(req.body));
+    expect:
+      count: 0
+
+  - name: "SQL injection in TS — req.query to db.query"
+    language: typescript
+    code: |
+      const q = req.query.id;
+      db.query("SELECT * FROM users WHERE id = " + q);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: db.query
+
+  - name: "SQL injection sanitised by parameterised query in TS"
+    language: typescript
+    code: |
+      db.query("SELECT * FROM users WHERE id = ?", [req.query.id]);
+    expect:
+      count: 0
+
+  - name: "Sequelize query with req.query criteria"
+    language: typescript
+    code: |
+      const criteria = req.query.q;
+      models.sequelize.query(`SELECT * FROM Products WHERE name LIKE '%${criteria}%'`);
+    expect:
+      count: 2
+      flows:
+        - sourceId: req.query
+          sinkId: sequelize.query
+        - sourceId: req.query
+          sinkId: template-literal-sql
+
+  - name: "Safe parameterised Sequelize-style query"
+    language: typescript
+    code: |
+      models.sequelize.query("SELECT * FROM Products WHERE id = ?", [req.query.id]);
+    expect:
+      count: 0
+
+  - name: "URL injection in TS — req.query to res.redirect"
+    language: typescript
+    code: |
+      res.redirect(req.query.next);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: res.redirect
+
+  - name: "Command injection in TS — process.argv to child_process.exec"
+    language: typescript
+    code: |
+      child_process.exec(process.argv[2]);
+    expect:
+      count: 1
+      flows:
+        - sourceId: process.argv
+          sinkId: child_process.exec
+
+  - name: "Path traversal in TS — req.params to fs.readFile"
+    language: typescript
+    code: |
+      fs.readFile(req.params.file);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.params
+          sinkId: fs.readFile-path
+
+  - name: "Path traversal sanitised in TS — path.resolve"
+    language: typescript
+    code: |
+      fs.readFile(path.resolve("/safe", req.params.file));
+    expect:
+      count: 0
+
+  - name: "Safe fs.writeFile with literal path — zero flows"
+    language: typescript
+    code: |
+      fs.writeFile('./data/app-config.json', 'static');
+    expect:
+      count: 0
+
+  - name: "Juice Shop-style codingChallenges read — zero flows"
+    language: typescript
+    code: |
+      import fs from 'fs';
+      fs.readFile('./data/codingchallenges/readme.md');
+    expect:
+      count: 0
+
+  - name: "Path traversal in TS — req.params to res.sendFile"
+    language: typescript
+    code: |
+      res.sendFile(req.params.file);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.params
+          sinkId: res.sendFile
+
+  - name: "Path traversal in TS — req.query to res.download"
+    language: typescript
+    code: |
+      res.download(req.query.path);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: res.download
+
+  - name: "URL injection in TS — process.env to location.href"
+    language: typescript
+    code: |
+      window.location.href = process.env.REDIRECT_URL;
+    expect:
+      count: 1
+      flows:
+        - sourceId: process.env
+          sinkId: location.href
+
+  - name: "URL injection sanitised by encodeURIComponent in TS"
+    language: typescript
+    code: |
+      res.redirect(encodeURIComponent(req.query.redirect));
+    expect:
+      count: 0
+
+  - name: "TS — Function call stops propagation"
+    language: typescript
+    code: |
+      const x = req.body;
+      helper(x);
+      eval(x);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: eval
+
+  - name: "TS — Prototype pollution with merge"
+    language: typescript
+    code: |
+      const target = {};
+      merge(target, req.body);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: merge-deep
+
+  - name: "TS — Object.freeze sanitises prototype pollution"
+    language: typescript
+    code: |
+      const target = {};
+      Object.assign(target, Object.freeze(req.body));
+    expect:
+      count: 0
+
+  - name: "TS — API XSS from req.body to res.json"
+    language: typescript
+    code: |
+      res.json(req.body.label);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: res.json
+
+  - name: "TS — API XSS safe — res.json with literal object"
+    language: typescript
+    code: |
+      res.json({ ok: true });
+    expect:
+      count: 0
+
+  - name: "TS — destructuring SQLi from req.query"
+    language: typescript
+    code: |
+      const { id } = req.query;
+      db.query("SELECT * FROM users WHERE id = " + id);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: db.query
+
+  - name: "TS — MongoDB $where injection"
+    language: typescript
+    code: |
+      Product.find({ $where: req.query.q });
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: Model.find-$where
+
+  - name: "TS — upload path traversal via fs.writeFile"
+    language: typescript
+    code: |
+      fs.writeFile(req.body.path, req.body.data);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: fs.writeFile-path
+
+  - name: "TS — DOMPurify sanitises res.json XSS"
+    language: typescript
+    code: |
+      res.json(DOMPurify.sanitize(req.body.x));
+    expect:
+      count: 0
+
+  - name: "TS — optional chaining req?.body to res.send"
+    language: typescript
+    code: |
+      const x = req?.body;
+      res.send(x);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: res.send
+
+  - name: "TS — multer req.file.path to fs.writeFile"
+    language: typescript
+    code: |
+      fs.writeFile(req.file.path, buf);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.file.path
+          sinkId: fs.writeFile-path
+
+  - name: "TS — Fastify request.body to res.send XSS"
+    language: typescript
+    code: |
+      const x = request.body;
+      res.send(x);
+    expect:
+      count: 1
+      flows:
+        - sourceId: fastify.request.body
+          sinkId: res.send
+
+  - name: "TS — req.headers to res.redirect"
+    language: typescript
+    code: |
+      res.redirect(req.headers.referer);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.headers
+          sinkId: res.redirect
+
+  - name: "TS — Prisma $queryRaw SQLi"
+    language: typescript
+    code: |
+      const id = req.query.id;
+      prisma.$queryRaw("SELECT * FROM users WHERE id = " + id);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: prisma.queryRaw
+
+  - name: "TS — child_process.spawn command injection"
+    language: typescript
+    code: |
+      child_process.spawn(process.argv[2]);
+    expect:
+      count: 1
+      flows:
+        - sourceId: process.argv
+          sinkId: child_process.spawn
+
+  - name: "TS — child_process.spawn with constant argv — no flow"
+    language: typescript
+    code: |
+      child_process.spawn('ls', ['-la']);
+    expect:
+      count: 0
+
+  - name: "TS — NestJS @Body to res.send XSS"
+    language: typescript
+    code: |
+      function handler(@Body() body: unknown) {
+        res.send(body);
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: nest.decorator-body
+          sinkId: res.send
+
+  - name: "TS — Hono c.req.body to res.send"
+    language: typescript
+    code: |
+      const x = c.req.body;
+      res.send(x);
+    expect:
+      count: 1
+      flows:
+        - sourceId: hono.req.body
+          sinkId: res.send
+
+  - name: "TS — GraphQL @Args to db.query SQLi"
+    language: typescript
+    code: |
+      function resolver(@Args('id') args: string) {
+        db.query("SELECT * FROM t WHERE id = " + args);
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: graphql.args
+          sinkId: db.query
+
+  - name: "TS — Next.js redirect URL injection"
+    language: typescript
+    code: |
+      redirect(req.query.next);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: next.redirect
+
+  - name: "TS — fs/promises readFile path traversal"
+    language: typescript
+    code: |
+      import * as fs from 'fs';
+      fs.promises.readFile(req.params.path);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.params
+          sinkId: fs.promises.readFile
+
+  - name: "TS — WebSocket on message to res.send XSS"
+    language: typescript
+    code: |
+      ws.on('message', (data: string) => {
+        res.send(data);
+      });
+    expect:
+      count: 1
+      flows:
+        - sourceId: websocket.message
+          sinkId: res.send
+
+  - name: "TS — code-execution sanitised static Function — no flow"
+    language: typescript
+    code: |
+      const x = req.body;
+      new Function("return 1");
+    expect:
+      count: 0
+
+  - name: "TS — url-injection sanitised encodeURIComponent on redirect"
+    language: typescript
+    code: |
+      res.redirect(encodeURIComponent(req.query.next));
+    expect:
+      count: 0
+
+  - name: "TS — zod.parse blocks XSS to res.send"
+    language: typescript
+    code: |
+      const parsed = z.object({ x: z.string() }).parse(req.body);
+      res.send(parsed.x);
+    expect:
+      count: 0