seaworthycode 1.1.1 → 1.1.4

package/rules/external/ops/insecure-file-permissions.test.yaml

@@ -0,0 +1,111 @@
+rule-id: ops.insecure-file-permissions
+
+cases:
+  - name: triggers on fs.chmod with insecure mode in javascript
+    language: javascript
+    code: |
+      const fs = require('fs')
+      fs.chmod('file.txt', 0o777)
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on fs.chmod with insecure mode in typescript
+    language: typescript
+    code: |
+      import fs from 'fs'
+      fs.chmod('/etc/shadow', 0o666)
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on fs.chmod with insecure mode in tsx
+    language: tsx
+    code: |
+      import fs from 'fs'
+      fs.chmod('config.json', 0o777)
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores fs.chmod with secure mode in typescript
+    language: typescript
+    code: |
+      import fs from 'fs'
+      fs.chmod('/etc/shadow', 0o644)
+    expect:
+      count: 0
+
+  - name: ignores fs.chmod with secure mode in tsx
+    language: tsx
+    code: |
+      import fs from 'fs'
+      fs.chmod('config.json', 0o600)
+    expect:
+      count: 0
+
+  - name: ignores unrelated fs operation
+    language: javascript
+    code: |
+      const fs = require('fs')
+      fs.readFile('file.txt', callback)
+    expect:
+      count: 0
+  - name: triggers on os.chmod with insecure mode in python
+    language: python
+    code: |
+      import os
+      os.chmod("config.json", 0o777)
+    expect:
+      count: 1
+      severity: low
+  - name: triggers on chmod 777 in bash
+    language: bash
+    code: |
+      chmod 777 ./config
+    expect:
+      count: 1
+      severity: low
+  - name: ignores os.chmod with secure mode in python
+    language: python
+    code: |
+      import os
+      os.chmod("config.json", 0o644)
+    expect:
+      count: 0
+  - name: ignores unrelated python os call
+    language: python
+    code: |
+      import os
+      os.remove("file.txt")
+    expect:
+      count: 0
+  - name: ignores chmod 600 in bash
+    language: bash
+    code: |
+      chmod 600 ./config
+    expect:
+      count: 0
+
+  - name: triggers on insecure permissions in rust
+    language: rust
+    code: |
+      Permissions::from_mode(0o777)
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores secure permissions in rust
+    language: rust
+    code: |
+      Permissions::from_mode(0o644)
+    expect:
+      count: 0
+
+  - name: triggers on chmod 777 in ruby
+    language: ruby
+    code: |
+      File.chmod(0777, "config.yml")
+    expect:
+      count: 1
+      severity: low

package/rules/external/ops/insecure-file-permissions.yaml

@@ -0,0 +1,91 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-276
+id: ops.insecure-file-permissions
+severity: low
+category: ops
+min-tier: pro
+languages: [javascript, typescript, tsx, python, bash, rust, ruby]
+
+copy:
+  name-key: checks.insecure-file-permissions.name
+  description-key: checks.insecure-file-permissions.description
+  message-key: checks.insecure-file-permissions.message
+  degraded-key: checks.insecure-file-permissions.degraded
+  remediation-key: remediation.ops.insecure-file-permissions
+
+confidence: low
+
+queries:
+  javascript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        (number) @perm)
+      (#eq? @obj "fs")
+      (#eq? @method "chmod")
+      (#match? @perm "0o?[0-7][2367][0-7]|0o?[0-7][0-7][2367]")) @match
+  typescript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        (number) @perm)
+      (#eq? @obj "fs")
+      (#eq? @method "chmod")
+      (#match? @perm "0o?[0-7][2367][0-7]|0o?[0-7][0-7][2367]")) @match
+  tsx: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        (number) @perm)
+      (#eq? @obj "fs")
+      (#eq? @method "chmod")
+      (#match? @perm "0o?[0-7][2367][0-7]|0o?[0-7][0-7][2367]")) @match
+  python: |
+    (call
+      function: (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @method)
+      arguments: (argument_list
+        (integer) @perm)
+      (#eq? @obj "os")
+      (#eq? @method "chmod")
+      (#match? @perm "0o?[0-7][2367][0-7]|0o?[0-7][0-7][2367]")) @match
+  bash: |
+    (command
+      name: (command_name (word) @cmd)
+      argument: (_) @perm
+      (#eq? @cmd "chmod")
+      (#match? @perm "^(777|666|a\\+wx|a\\+w)$")) @match
+  rust: |
+    (call_expression
+      function: [
+        (field_expression
+          field: (field_identifier) @func
+          (#eq? @func "from_mode"))
+        (scoped_identifier
+          name: (identifier) @func
+          (#eq? @func "from_mode"))
+      ]
+      arguments: (arguments
+        (integer_literal) @perm
+        (#match? @perm "0o?[0-7][2367][0-7]|0o?[0-7][0-7][2367]"))) @match
+
+  ruby: |
+    (call
+      receiver: (constant) @recv (#eq? @recv "File")
+      method: (identifier) @method
+      (#eq? @method "chmod")
+      arguments: (argument_list
+        (integer) @perm
+        (#match? @perm "0o?[0-7][2367][0-7]|0o?[0-7][0-7][2367]"))) @match
+
+message-captures: [match]

package/rules/external/resilience/missing-memory-limit.test.yaml

@@ -0,0 +1,54 @@
+rule-id: resilience.missing-memory-limit
+
+cases:
+  - name: triggers on Buffer.alloc with variable size in javascript
+    language: javascript
+    code: |
+      Buffer.alloc(userInput.length)
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on Buffer.alloc with expression size in typescript
+    language: typescript
+    code: |
+      Buffer.alloc(size * 2)
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on Buffer.alloc with identifier size in tsx
+    language: tsx
+    code: |
+      Buffer.alloc(bufSize)
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores fixed-size Buffer.alloc
+    language: javascript
+    code: |
+      Buffer.alloc(1024)
+    expect:
+      count: 0
+
+  - name: ignores fixed-size Buffer.alloc in typescript
+    language: typescript
+    code: |
+      Buffer.alloc(1024)
+    expect:
+      count: 0
+
+  - name: ignores unrelated buffer usage
+    language: javascript
+    code: |
+      const buf = Buffer.from("hello")
+    expect:
+      count: 0
+
+  - name: ignores unrelated buffer usage in typescript
+    language: typescript
+    code: |
+      const buf = Buffer.from("hello")
+    expect:
+      count: 0

package/rules/external/resilience/missing-memory-limit.yaml

@@ -0,0 +1,59 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-770
+id: resilience.missing-memory-limit
+severity: low
+category: resilience
+min-tier: pro
+languages: [javascript, typescript, tsx]
+
+copy:
+  name-key: checks.missing-memory-limit.name
+  description-key: checks.missing-memory-limit.description
+  message-key: checks.missing-memory-limit.message
+  degraded-key: checks.missing-memory-limit.degraded
+  remediation-key: remediation.resilience.missing-memory-limit
+
+confidence: low
+
+queries:
+  javascript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        [(identifier) @size
+         (member_expression) @size
+         (call_expression) @size
+         (binary_expression) @size])
+      (#eq? @obj "Buffer")
+      (#eq? @method "alloc")) @match
+  typescript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        [(identifier) @size
+         (member_expression) @size
+         (call_expression) @size
+         (binary_expression) @size])
+      (#eq? @obj "Buffer")
+      (#eq? @method "alloc")) @match
+  tsx: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        [(identifier) @size
+         (member_expression) @size
+         (call_expression) @size
+         (binary_expression) @size])
+      (#eq? @obj "Buffer")
+      (#eq? @method "alloc")) @match
+
+message-captures: [match]

package/rules/external/resilience/missing-timeout-config.test.yaml

@@ -0,0 +1,179 @@
+rule-id: resilience.missing-timeout-config
+
+cases:
+  - name: triggers on fetch in javascript
+    language: javascript
+    code: |
+      fetch("/api/data")
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on fetch in typescript
+    language: typescript
+    code: |
+      fetch("/api/users")
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on fetch in tsx
+    language: tsx
+    code: |
+      fetch("/api/items")
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores fetch with explicit signal timeout
+    language: javascript
+    code: |
+      const controller = AbortSignal.timeout(5000)
+      fetch("/api/data", { signal: controller })
+    expect:
+      count: 0
+
+  - name: ignores fetch with explicit signal timeout in typescript
+    language: typescript
+    code: |
+      const controller = AbortSignal.timeout(5000)
+      fetch("/api/data", { signal: controller })
+    expect:
+      count: 0
+
+  - name: ignores fetch with signal shorthand
+    language: javascript
+    code: |
+      const signal = AbortSignal.timeout(5000)
+      fetch("/api/data", { signal })
+    expect:
+      count: 0
+
+  - name: ignores fetch with signal shorthand in typescript
+    language: typescript
+    code: |
+      const signal = AbortSignal.timeout(5000)
+      fetch("/api/data", { signal })
+    expect:
+      count: 0
+
+  - name: ignores unrelated method
+    language: javascript
+    code: |
+      axios.post("/api", data)
+    expect:
+      count: 0
+
+  - name: ignores unrelated method in typescript
+    language: typescript
+    code: |
+      axios.post("/api", data)
+    expect:
+      count: 0
+
+  - name: triggers on requests.get without timeout in python
+    language: python
+    code: |
+      requests.get("https://example.com")
+    expect:
+      count: 1
+      severity: low
+  - name: triggers on httpx.post without timeout in python
+    language: python
+    code: |
+      httpx.post("https://api.example.com", json=data)
+    expect:
+      count: 1
+      severity: low
+  - name: triggers on curl without timeout in bash
+    language: bash
+    code: |
+      curl https://example.com
+    expect:
+      count: 1
+      severity: low
+  - name: ignores requests.get with timeout in python
+    language: python
+    code: |
+      requests.get("https://example.com", timeout=30)
+    expect:
+      count: 0
+  - name: ignores unrelated python call
+    language: python
+    code: |
+      print("hello")
+    expect:
+      count: 0
+  - name: ignores curl with max time in bash
+    language: bash
+    code: |
+      curl --max-time 5 https://example.com
+    expect:
+      count: 0
+
+  - name: triggers on reqwest get without timeout in rust
+    language: rust
+    code: |
+      reqwest::get("https://example.com")
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on TcpStream connect without timeout in rust
+    language: rust
+    code: |
+      std::net::TcpStream::connect("127.0.0.1:8080")
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores unrelated rust call
+    language: rust
+    code: |
+      println!("hello")
+    expect:
+      count: 0
+
+  - name: triggers on RestTemplate getForObject in java
+    language: java
+    code: |
+      class T {
+        void f(org.springframework.web.client.RestTemplate rt) {
+          rt.getForObject("https://example.com", String.class);
+        }
+      }
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores RestTemplate with timeouts configured via builder in java
+    language: java
+    code: |
+      class T {
+        void f() {
+          org.springframework.web.client.RestTemplate rt = new org.springframework.boot.web.client.RestTemplateBuilder()
+            .setConnectTimeout(java.time.Duration.ofSeconds(5))
+            .setReadTimeout(java.time.Duration.ofSeconds(5))
+            .build();
+          rt.getForObject("https://example.com", String.class);
+        }
+      }
+    expect:
+      count: 0
+
+  - name: triggers on Net::HTTP.get without timeout in ruby
+    language: ruby
+    code: |
+      Net::HTTP.get(URI("https://api.example.com"))
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores Net::HTTP with timeouts in ruby
+    language: ruby
+    code: |
+      Net::HTTP.start("example.com", open_timeout: 10, read_timeout: 10) do |http|
+        http.get("/")
+      end
+    expect:
+      count: 0

package/rules/external/resilience/missing-timeout-config.yaml

@@ -0,0 +1,124 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-400
+id: resilience.missing-timeout-config
+severity: low
+category: resilience
+min-tier: pro
+languages: [javascript, typescript, tsx, python, bash, rust, java, ruby]
+
+copy:
+  name-key: checks.missing-timeout-config.name
+  description-key: checks.missing-timeout-config.description
+  message-key: checks.missing-timeout-config.message
+  degraded-key: checks.missing-timeout-config.degraded
+  remediation-key: remediation.resilience.missing-timeout-config
+
+confidence: medium
+
+queries:
+  javascript: |
+    ((call_expression
+      function: (identifier) @func
+      (#eq? @func "fetch")) @match
+      (#not-match? @match "signal(\\s*:|(?=\\s*[,}]))"))
+  typescript: |
+    ((call_expression
+      function: (identifier) @func
+      (#eq? @func "fetch")) @match
+      (#not-match? @match "signal(\\s*:|(?=\\s*[,}]))"))
+  tsx: |
+    ((call_expression
+      function: (identifier) @func
+      (#eq? @func "fetch")) @match
+      (#not-match? @match "signal(\\s*:|(?=\\s*[,}]))"))
+  python: |
+    ((call
+      function: (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @method)
+      arguments: (argument_list
+        (string) @url)
+      (#match? @obj "^(requests|httpx|aiohttp)$")
+      (#match? @method "^(get|post|put|patch|delete|head|options)$")) @match
+      (#not-match? @match "timeout\\s*="))
+  bash: |
+    ((command
+      name: (command_name (word) @cmd)
+      (#match? @cmd "^(curl|wget)$")) @match
+      (#not-match? @match "(--max-time|--connect-timeout|--timeout|timeout\s+)"))
+
+  rust: |
+    (call_expression
+      function: (scoped_identifier
+        path: (identifier) @reqwest_path
+        name: (identifier) @reqwest_func)
+      (#eq? @reqwest_path "reqwest")
+      (#match? @reqwest_func "^(get|post|put|patch|delete|head|options)$")) @match
+    (call_expression
+      function: (scoped_identifier
+        path: (scoped_identifier) @tcp_path
+        name: (identifier) @tcp_func)
+      (#match? @tcp_path "TcpStream$")
+      (#eq? @tcp_func "connect")) @match
+  java: |
+    ((method_declaration
+      parameters: (formal_parameters
+        (formal_parameter
+          type: [
+            (type_identifier) @type
+            (scoped_type_identifier) @type
+          ]
+          name: (identifier) @obj))
+      body: (block
+        (expression_statement
+          (method_invocation
+            object: (identifier) @recv
+            name: (identifier) @method (#match? @method "^(getForObject|postForObject|exchange|execute)$")
+            (#match? @type "(RestTemplate|AsyncRestTemplate|WebClient|HttpClient|HttpComponentsClient)$")
+            ) @match))) @scope
+     (#not-match? @scope "[tT][iI][mM][eE][oO][uU][tT]"))
+
+    ((block
+      (local_variable_declaration
+        type: [
+          (type_identifier) @type
+          (scoped_type_identifier) @type
+        ]
+        declarator: (variable_declarator
+          name: (identifier) @obj))
+      (expression_statement
+        (method_invocation
+          object: (identifier) @recv
+          name: (identifier) @method (#match? @method "^(getForObject|postForObject|exchange|execute)$")
+          (#match? @type "(RestTemplate|AsyncRestTemplate|WebClient|HttpClient|HttpComponentsClient)$")) @match)) @scope
+     (#not-match? @scope "[tT][iI][mM][eE][oO][uU][tT]"))
+
+    ((class_body
+      (field_declaration
+        type: [
+          (type_identifier) @type
+          (scoped_type_identifier) @type
+        ]
+        declarator: (variable_declarator
+          name: (identifier) @obj))
+      (method_declaration
+        body: (block
+          (expression_statement
+            (method_invocation
+              object: (identifier) @recv
+              name: (identifier) @method (#match? @method "^(getForObject|postForObject|exchange|execute)$")
+              (#match? @type "(RestTemplate|AsyncRestTemplate|WebClient|HttpClient|HttpComponentsClient)$")) @match)))) @scope
+     (#not-match? @scope "[tT][iI][mM][eE][oO][uU][tT]"))
+
+  ruby: |
+    ((call
+      receiver: (scope_resolution
+        scope: (constant) @scope (#eq? @scope "Net")
+        name: (constant) @name (#eq? @name "HTTP"))
+      method: (identifier) @method (#match? @method "^(get|get_response|post|start)$")) @match
+     (#not-match? @match "timeout"))
+
+message-captures: [match]