seaworthycode 1.1.1 → 1.1.4

package/rules/internal/taint/typescript.yaml

@@ -0,0 +1,660 @@
+# attribution: CWE-79
+# Server Actions ('use server'): file-scoped boundary — use pro/LLM checks; not modelled as intra-file taint here.
+# zod/valibot: schema.parse / safeParse treated as manual sanitiser (no autofix).
+attribution: CWE-79
+language: typescript
+applies-to: [tsx]
+
+sources:
+  - id: req.body
+    class: http-body
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "req")
+        (#eq? @prop "body")) @source
+
+  - id: req.query
+    class: http-params
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "req")
+        (#eq? @prop "query")) @source
+
+  - id: req.params
+    class: http-params
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "req")
+        (#eq? @prop "params")) @source
+
+  - id: req.headers
+    class: header
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "req")
+        (#eq? @prop "headers")) @source
+
+  - id: req.cookies
+    class: cookie
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "req")
+        (#eq? @prop "cookies")) @source
+
+  - id: fastify.request.body
+    class: http-body
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "request")
+        (#eq? @prop "body")) @source
+
+  - id: fastify.request.query
+    class: http-params
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "request")
+        (#eq? @prop "query")) @source
+
+  - id: fastify.request.params
+    class: http-params
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "request")
+        (#eq? @prop "params")) @source
+
+  - id: hono.req.body
+    class: http-body
+    query: |
+      (member_expression
+        object: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @reqProp
+          (#match? @obj "^(c|ctx)$")
+          (#eq? @reqProp "req"))
+        property: (property_identifier) @prop
+        (#eq? @prop "body")) @source
+
+  - id: hono.req.query
+    class: http-params
+    query: |
+      (member_expression
+        object: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @reqProp
+          (#match? @obj "^(c|ctx)$")
+          (#eq? @reqProp "req"))
+        property: (property_identifier) @prop
+        (#match? @prop "^(query|param)$")) @source
+
+  - id: nest.decorator-body
+    class: http-body
+    query: |
+      (required_parameter
+        (decorator
+          (call_expression
+            function: (identifier) @dec
+            (#eq? @dec "Body")))
+        (identifier) @source)
+
+  - id: nest.decorator-query
+    class: http-params
+    query: |
+      (required_parameter
+        (decorator
+          (call_expression
+            function: (identifier) @dec
+            (#eq? @dec "Query")))
+        (identifier) @source)
+
+  - id: nest.decorator-param
+    class: http-params
+    query: |
+      (required_parameter
+        (decorator
+          (call_expression
+            function: (identifier) @dec
+            (#eq? @dec "Param")))
+        (identifier) @source)
+
+  - id: nest.decorator-headers
+    class: header
+    query: |
+      (required_parameter
+        (decorator
+          (call_expression
+            function: (identifier) @dec
+            (#eq? @dec "Headers")))
+        (identifier) @source)
+
+  - id: graphql.args
+    class: http-params
+    query: |
+      (required_parameter
+        (decorator
+          (call_expression
+            function: (identifier) @dec
+            (#eq? @dec "Args")))
+        (identifier) @source)
+
+  - id: websocket.message
+    class: http-body
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @method
+          (#eq? @method "on"))
+        arguments: (arguments
+          (string (string_fragment) @event)
+          (#eq? @event "message")
+          [
+            (arrow_function
+              parameters: (formal_parameters
+                (required_parameter (identifier) @source)))
+            (function_expression
+              parameters: (formal_parameters
+                (required_parameter (identifier) @source)))
+          ]))
+
+  - id: req.file.path
+    class: http-body
+    query: |
+      (member_expression
+        object: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @fileProp
+          (#eq? @obj "req")
+          (#eq? @fileProp "file"))
+        property: (property_identifier) @prop
+        (#match? @prop "^(path|filename|originalname)$")) @source
+
+  - id: process.argv
+    class: process-argv
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "process")
+        (#eq? @prop "argv")) @source
+
+  - id: process.env
+    class: env-var
+    query: |
+      (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop
+        (#eq? @obj "process")
+        (#eq? @prop "env")) @source
+
+  - id: fs.readFileSync
+    class: fs-read
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "fs")
+          (#eq? @prop "readFileSync"))
+        arguments: (arguments (_) @source))
+
+  - id: fs.createReadStream
+    class: fs-read
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "fs")
+          (#eq? @prop "createReadStream"))
+        arguments: (arguments (_) @source)) @match
+
+  - id: fetch-response-text
+    class: network-response
+    query: |
+      (call_expression
+        function: (identifier) @fetchFn
+        (#eq? @fetchFn "fetch")
+        arguments: (arguments (_) @source)) @match
+
+  - id: axios-get-response
+    class: network-response
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @method
+          (#eq? @obj "axios")
+          (#eq? @method "get"))
+        arguments: (arguments (_) @source)) @match
+
+sinks:
+  - id: eval
+    sink-class: code-execution
+    query: |
+      (call_expression
+        function: (identifier) @func
+        (#eq? @func "eval")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: Function
+    sink-class: code-execution
+    query: |
+      (new_expression
+        constructor: (identifier) @func
+        (#eq? @func "Function")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: vm.runInNewContext
+    sink-class: code-execution
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "vm")
+          (#eq? @prop "runInNewContext"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: res.send
+    sink-class: xss
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "res")
+          (#eq? @prop "send"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: res.write
+    sink-class: xss
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "res")
+          (#eq? @prop "write"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: res.json
+    sink-class: xss
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "res")
+          (#eq? @prop "json"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: innerHTML
+    sink-class: xss
+    query: |
+      (assignment_expression
+        left: (member_expression
+          property: (property_identifier) @prop
+          (#eq? @prop "innerHTML"))
+        right: (_) @sink) @match
+
+  - id: db.query
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "db")
+          (#eq? @prop "query"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: connection.execute
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "connection")
+          (#eq? @prop "execute"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: sequelize.query
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (member_expression)
+          property: (property_identifier) @prop
+          (#eq? @prop "query"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: Model.find-$where
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @method
+          (#eq? @method "find"))
+        arguments: (arguments (object (pair
+          key: (property_identifier) @key
+          (#eq? @key "$where")
+          value: (_) @sink)))) @match
+
+  - id: template-literal-sql
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @method
+          (#match? @method "^(query|execute|raw)$"))
+        arguments: (arguments (template_string) @sink (#match? @sink "SELECT|INSERT|UPDATE|DELETE|UNION")))
+
+  - id: child_process.exec
+    sink-class: command-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "child_process")
+          (#eq? @prop "exec"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: child_process.execSync
+    sink-class: command-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "child_process")
+          (#eq? @prop "execSync"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: child_process.spawn
+    sink-class: command-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "child_process")
+          (#match? @prop "^(spawn|execFile)$"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: prisma.queryRaw
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "prisma")
+          (#match? @prop "^\\$queryRaw$|^\\$executeRaw$"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: exec
+    sink-class: command-injection
+    query: |
+      (call_expression
+        function: (identifier) @func
+        (#eq? @func "exec")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: fs.readFile-path
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "fs")
+          (#eq? @prop "readFile"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: fs.writeFile-path
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "fs")
+          (#eq? @prop "writeFile"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: res.sendFile
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "res")
+          (#eq? @prop "sendFile"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: res.download
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "res")
+          (#eq? @prop "download"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: express.static
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "express")
+          (#eq? @prop "static"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: res.redirect
+    sink-class: url-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "res")
+          (#eq? @prop "redirect"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: location.href
+    sink-class: url-injection
+    query: |
+      (assignment_expression
+        left: (member_expression
+          object: (member_expression
+            property: (property_identifier) @locProp
+            (#eq? @locProp "location"))
+          property: (property_identifier) @hrefProp
+          (#eq? @hrefProp "href"))
+        right: (_) @sink) @match
+
+  - id: Object.assign-pollution
+    sink-class: prototype-pollution
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "Object")
+          (#eq? @prop "assign"))
+        arguments: (arguments (_) @first (_) @sink)) @match
+
+  - id: merge-deep
+    sink-class: prototype-pollution
+    query: |
+      (call_expression
+        function: (identifier) @func
+        (#match? @func "^(merge|extend|mergeDeep)$")
+        arguments: (arguments (_) @first (_) @sink)) @match
+
+  - id: fs.promises.readFile
+    sink-class: path-traversal
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (member_expression
+            object: (identifier) @fs
+            property: (property_identifier) @prom
+            (#eq? @fs "fs")
+            (#eq? @prom "promises"))
+          property: (property_identifier) @method
+          (#match? @method "^(readFile|writeFile|open)$"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: next.redirect
+    sink-class: url-injection
+    query: |
+      (call_expression
+        function: (identifier) @fn
+        (#eq? @fn "redirect")
+        arguments: (arguments (_) @sink)) @match
+
+  - id: NextResponse.redirect
+    sink-class: url-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "NextResponse")
+          (#eq? @prop "redirect"))
+        arguments: (arguments (_) @sink)) @match
+
+  - id: drizzle-sql
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (identifier) @fn
+        (#eq? @fn "sql")
+        arguments: (arguments (template_string (template_substitution (_) @sink)))) @match
+
+  - id: kysely-sql
+    sink-class: sql-injection
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @prop
+          (#eq? @prop "sql"))
+        arguments: (arguments (template_string) @sink)) @match
+
+sanitisers:
+  - id: encodeURIComponent
+    sanitises: [xss, url-injection]
+    autofix-safety: global
+    query: |
+      (call_expression
+        function: (identifier) @func
+        (#eq? @func "encodeURIComponent")) @sanitiser
+
+  - id: JSON.stringify
+    sanitises: [xss]
+    autofix-safety: global
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "JSON")
+          (#eq? @prop "stringify"))) @sanitiser
+
+  - id: parameterised-query
+    sanitises: [sql-injection]
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @prop
+          (#match? @prop "^(query|execute|run)$"))
+        arguments: (arguments . (_) @first . (template_string) @params)) @sanitiser
+
+  - id: parameterised-query-placeholder
+    sanitises: [sql-injection]
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @prop
+          (#match? @prop "^(query|execute|run)$"))
+        arguments: (arguments . (_) @first . (array) @params)) @sanitiser
+
+  - id: escape-shell-arg
+    sanitises: [command-injection]
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @prop
+          (#match? @prop "^(escapeShellArg|shellEscape|quote)$"))) @sanitiser
+
+  - id: Object.freeze-pollution
+    sanitises: [prototype-pollution]
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "Object")
+          (#eq? @prop "freeze"))) @sanitiser
+
+  - id: DOMPurify.sanitize
+    sanitises: [xss]
+    autofix-safety: requires-import
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "DOMPurify")
+          (#eq? @prop "sanitize"))) @sanitiser
+
+  - id: path.resolve
+    sanitises: [path-traversal]
+    query: |
+      (call_expression
+        function: (member_expression
+          object: (identifier) @obj
+          property: (property_identifier) @prop
+          (#eq? @obj "path")
+          (#eq? @prop "resolve"))) @sanitiser
+
+  - id: zod.parse
+    sanitises: [xss, sql-injection, command-injection, path-traversal, url-injection, prototype-pollution, code-execution]
+    autofix-safety: manual
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @prop
+          (#match? @prop "^(parse|safeParse)$"))) @sanitiser
+
+  - id: valibot.parse
+    sanitises: [xss, sql-injection, command-injection, path-traversal, url-injection, prototype-pollution, code-execution]
+    autofix-safety: manual
+    query: |
+      (call_expression
+        function: (member_expression
+          property: (property_identifier) @prop
+          (#match? @prop "^(parse|safeParse)$"))) @sanitiser