seaworthycode 1.1.1 → 1.1.4

package/rules/external/security/broken-crypto-algorithm.test.yaml

@@ -0,0 +1,104 @@
+rule-id: security.broken-crypto-algorithm
+
+cases:
+  - name: triggers on crypto.createCipher in javascript
+    language: javascript
+    code: |
+      const crypto = require('crypto')
+      const cipher = crypto.createCipher('aes192', key)
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on crypto.createCipher in typescript
+    language: typescript
+    code: |
+      import crypto from 'crypto'
+      const cipher = crypto.createCipher('aes192', key)
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on crypto.createCipher in tsx
+    language: tsx
+    code: |
+      import crypto from 'crypto'
+      const cipher = crypto.createCipher('aes', key)
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on DES.new in python
+    language: python
+    code: |
+      from Crypto.Cipher import DES
+      cipher = DES.new(key, DES.MODE_ECB)
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on base64 in bash
+    language: bash
+    code: |
+      base64 secret.txt > secret.enc
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores safe API
+    language: javascript
+    code: |
+      const crypto = require('crypto')
+      const hash = crypto.createHash('sha256')
+    expect:
+      count: 0
+
+  - name: ignores safe API in typescript
+    language: typescript
+    code: |
+      import crypto from 'crypto'
+      const hash = crypto.createHash('sha256')
+    expect:
+      count: 0
+
+  - name: ignores unrelated code
+    language: python
+    code: |
+      result = 1 + 2
+    expect:
+      count: 0
+
+  - name: ignores sha256sum in bash
+    language: bash
+    code: |
+      sha256sum secret.txt
+    expect:
+      count: 0
+
+  - name: triggers on des in rust
+    language: rust
+    code: |
+      cipher.des()
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on Cipher DES in java
+    language: java
+    code: |
+      class T {
+        void f() throws Exception {
+          javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("DES");
+        }
+      }
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on OpenSSL Cipher RC4 in ruby
+    language: ruby
+    code: |
+      OpenSSL::Cipher.new('RC4')
+    expect:
+      count: 1
+      severity: medium

package/rules/external/security/broken-crypto-algorithm.yaml

@@ -0,0 +1,79 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-327
+id: security.broken-crypto-algorithm
+severity: medium
+category: security
+min-tier: pro
+languages: [javascript, typescript, tsx, python, bash, rust, java, ruby]
+
+copy:
+  name-key: checks.broken-crypto-algorithm.name
+  description-key: checks.broken-crypto-algorithm.description
+  message-key: checks.broken-crypto-algorithm.message
+  degraded-key: checks.broken-crypto-algorithm.degraded
+  remediation-key: remediation.security.broken-crypto-algorithm
+
+confidence: high
+
+queries:
+  javascript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      (#eq? @obj "crypto")
+      (#eq? @method "createCipher")) @match
+  typescript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      (#eq? @obj "crypto")
+      (#eq? @method "createCipher")) @match
+  tsx: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      (#eq? @obj "crypto")
+      (#eq? @method "createCipher")) @match
+  python: |
+    (call
+      function: (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @method)
+      (#eq? @obj "DES")
+      (#eq? @method "new")) @match
+  bash: |
+    (command
+      name: (command_name (word) @cmd)
+      (#match? @cmd "^(base64|rot13)$")) @match
+  rust: |
+    (call_expression
+      function: (field_expression
+        field: (field_identifier) @func
+        (#match? @func "^(des|rc4)$"))) @match
+  java: |
+    (method_invocation
+      name: (identifier) @method
+      (#eq? @method "getInstance")
+      arguments: (argument_list
+        (string_literal
+          (string_fragment) @algo)
+        (#match? @algo "^(DES|des|RC4|rc4|Blowfish|blowfish)$"))) @match
+
+  ruby: |
+    (call
+      receiver: (scope_resolution
+        scope: (constant) @scope (#eq? @scope "OpenSSL")
+        name: (constant) @name (#eq? @name "Cipher"))
+      method: (identifier) @method (#eq? @method "new")
+      arguments: (argument_list
+        (string
+          (string_content) @algo
+          (#match? @algo "^(DES|des|RC4|rc4|Blowfish|blowfish)$")))) @match
+
+message-captures: [match]

package/rules/external/security/http-method-override.test.yaml

@@ -0,0 +1,40 @@
+rule-id: security.http-method-override
+
+cases:
+  - name: triggers on methodOverride in javascript
+    language: javascript
+    code: |
+      app.use(methodOverride('_method'))
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on methodOverride in typescript
+    language: typescript
+    code: |
+      app.use(methodOverride())
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on methodOverride in tsx
+    language: tsx
+    code: |
+      app.use(methodOverride('X-HTTP-Method-Override'))
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores unrelated middleware
+    language: javascript
+    code: |
+      app.use(helmet())
+    expect:
+      count: 0
+
+  - name: ignores unrelated middleware in typescript
+    language: typescript
+    code: |
+      app.use(helmet())
+    expect:
+      count: 0

package/rules/external/security/http-method-override.yaml

@@ -0,0 +1,35 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-444
+id: security.http-method-override
+severity: medium
+category: security
+min-tier: pro
+languages: [javascript, typescript, tsx]
+
+copy:
+  name-key: checks.http-method-override.name
+  description-key: checks.http-method-override.description
+  message-key: checks.http-method-override.message
+  degraded-key: checks.http-method-override.degraded
+  remediation-key: remediation.security.http-method-override
+
+confidence: medium
+
+queries:
+  javascript: |
+    (call_expression
+      function: (identifier) @func
+      (#eq? @func "methodOverride")) @match
+  typescript: |
+    (call_expression
+      function: (identifier) @func
+      (#eq? @func "methodOverride")) @match
+  tsx: |
+    (call_expression
+      function: (identifier) @func
+      (#eq? @func "methodOverride")) @match
+
+message-captures: [match]

package/rules/external/security/http-no-tls.test.yaml

@@ -0,0 +1,115 @@
+rule-id: security.http-no-tls
+
+cases:
+  - name: triggers on http URL in javascript
+    language: javascript
+    code: |
+      const url = "http://api.example.com"
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on http URL in typescript
+    language: typescript
+    code: |
+      const url = "http://insecure.example.org/data"
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on http URL in tsx
+    language: tsx
+    code: |
+      const endpoint = "http://legacy.api.com"
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on http URL in python
+    language: python
+    code: |
+      url = "http://insecure.example.org/data"
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on http URL in bash
+    language: bash
+    code: |
+      curl http://api.example.com
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores https URL in javascript
+    language: javascript
+    code: |
+      const url = "https://secure.example.com"
+    expect:
+      count: 0
+
+  - name: ignores https URL in typescript
+    language: typescript
+    code: |
+      const url = "https://secure.example.com"
+    expect:
+      count: 0
+
+  - name: ignores unrelated string in javascript
+    language: javascript
+    code: |
+      const name = "hello world"
+    expect:
+      count: 0
+
+  - name: ignores unrelated string in typescript
+    language: typescript
+    code: |
+      const name = "hello world"
+    expect:
+      count: 0
+
+  - name: ignores https URL in bash
+    language: bash
+    code: |
+      curl https://secure.example.com
+    expect:
+      count: 0
+
+  - name: triggers on http URL in rust
+    language: rust
+    code: |
+      let url = "http://api.example.com";
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores https URL in rust
+    language: rust
+    code: |
+      let url = "https://secure.example.com";
+    expect:
+      count: 0
+
+  - name: triggers on http URL in java
+    language: java
+    code: |
+      class T { String u = "http://api.example.com"; }
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores https URL in java
+    language: java
+    code: |
+      class T { String u = "https://secure.example.com"; }
+    expect:
+      count: 0
+
+  - name: triggers on http URL in ruby
+    language: ruby
+    code: |
+      url = "http://api.example.com/data"
+    expect:
+      count: 1
+      severity: medium

package/rules/external/security/http-no-tls.yaml

@@ -0,0 +1,59 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-319
+id: security.http-no-tls
+severity: medium
+category: security
+min-tier: pro
+languages: [javascript, typescript, tsx, python, bash, rust, java, ruby]
+
+copy:
+  name-key: checks.http-no-tls.name
+  description-key: checks.http-no-tls.description
+  message-key: checks.http-no-tls.message
+  degraded-key: checks.http-no-tls.degraded
+  remediation-key: remediation.security.http-no-tls
+
+confidence: medium
+
+queries:
+  javascript: |
+    (string
+      (string_fragment) @url
+      (#match? @url "^http://")) @match
+  typescript: |
+    (string
+      (string_fragment) @url
+      (#match? @url "^http://")) @match
+  tsx: |
+    (string
+      (string_fragment) @url
+      (#match? @url "^http://")) @match
+  python: |
+    (string
+      (string_content) @url
+      (#match? @url "^http://")) @match
+  bash: |
+    [
+      ((word) @match
+        (#match? @match "^http://"))
+      (string
+        (string_content) @match
+        (#match? @match "^http://"))
+    ]
+  rust: |
+    (string_literal) @match
+    (#match? @match "^\"http://")
+  java: |
+    (string_literal
+      (string_fragment) @url
+      (#match? @url "^http://")) @match
+
+  ruby: |
+    (string
+      (string_content) @url
+      (#match? @url "^http://")) @match
+
+message-captures: [match]

package/rules/external/security/path-traversal.test.yaml

@@ -0,0 +1,188 @@
+rule-id: security.path-traversal
+
+cases:
+  - name: triggers on fs.readFile with concat in javascript
+    language: javascript
+    code: |
+      const fs = require('fs')
+      fs.readFile("/data/" + fileName)
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on fs.writeFile with concat in typescript
+    language: typescript
+    code: |
+      const fs = require('fs')
+      fs.writeFile("/tmp/" + userPath, data)
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores fs.readFile with plain identifier path in tsx
+    language: tsx
+    code: |
+      import fs from 'fs'
+      fs.readFile(userPath)
+    expect:
+      count: 0
+
+  - name: triggers on res.sendFile with member expression path
+    language: typescript
+    code: |
+      res.sendFile(req.params.file)
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores fs.readFile with CONFIG_PATH constant
+    language: typescript
+    code: |
+      import fs from 'fs'
+      const CONFIG_PATH = './data/app-config.json'
+      fs.readFileSync(CONFIG_PATH, 'utf8')
+    expect:
+      count: 0
+
+  - name: triggers on fs.readFile with template path in tsx
+    language: tsx
+    code: |
+      import fs from 'fs'
+      fs.readFile(`/uploads/${name}`)
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on open with concat in python
+    language: python
+    code: |
+      open("/tmp/" + filename)
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores open with identifier in python
+    language: python
+    code: |
+      open(user_path)
+    expect:
+      count: 0
+
+  - name: triggers on File.read interpolation in ruby
+    language: ruby
+    code: |
+      File.read("/tmp/#{name}")
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores safe file read with literal path
+    language: javascript
+    code: |
+      const fs = require('fs')
+      fs.readFile("/etc/config.json")
+    expect:
+      count: 0
+
+  - name: triggers on unquoted shell file command
+    language: bash
+    code: |
+      cat $USER_PATH
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores quoted shell file command
+    language: bash
+    code: |
+      cat "$USER_PATH"
+    expect:
+      count: 0
+
+  - name: ignores unrelated code
+    language: javascript
+    code: |
+      const x = "a" + "b"
+    expect:
+      count: 0
+
+  - name: triggers on fs.readFile with template path in javascript
+    language: javascript
+    code: |
+      const fs = require('fs')
+      fs.readFile(`/tmp/${name}`)
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores fs.readFile with path.join in typescript
+    language: typescript
+    code: |
+      import fs from 'fs'
+      import * as path from 'path'
+      fs.readFile(path.join(baseDir, userFile))
+    expect:
+      count: 0
+
+  - name: Juice Shop-style safe fs.writeFile with literal path
+    language: javascript
+    code: |
+      const fs = require('fs')
+      fs.writeFile('./data/app-config.json', payload)
+    expect:
+      count: 0
+
+  - name: Juice Shop-style codingChallenges read with constant path
+    language: typescript
+    code: |
+      import fs from 'fs'
+      export function loadReadme() {
+        return fs.readFile('./data/codingchallenges/readme.md')
+      }
+    expect:
+      count: 0
+
+  - name: triggers on fs File open with field expression in rust
+    language: rust
+    code: |
+      std::fs::File::open(params.filename)
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on fs read_to_string with format macro in rust
+    language: rust
+    code: |
+      std::fs::read_to_string(format!("/tmp/{}", path))
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores fs read_to_string with safe identifier in rust
+    language: rust
+    code: |
+      std::fs::read_to_string(canonical)
+    expect:
+      count: 0
+
+  - name: ignores fs File open with literal path in rust
+    language: rust
+    code: |
+      std::fs::File::open("/etc/passwd")
+    expect:
+      count: 0
+
+  - name: triggers on File concat path in java
+    language: java
+    code: |
+      new File("/data/" + fileName);
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores File with identifier only in java
+    language: java
+    code: |
+      new File(userPath);
+    expect:
+      count: 0