seaworthycode 1.1.1 → 1.1.4

package/rules/external/security/weak-hash-algorithm.test.yaml

@@ -0,0 +1,121 @@
+rule-id: security.weak-hash-algorithm
+
+cases:
+  - name: triggers on crypto.createHash in javascript
+    language: javascript
+    code: |
+      const crypto = require('crypto')
+      crypto.createHash('md5')
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on crypto.createHash in typescript
+    language: typescript
+    code: |
+      import crypto from 'crypto'
+      crypto.createHash('sha1')
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on crypto.createHash in tsx
+    language: tsx
+    code: |
+      import crypto from 'crypto'
+      crypto.createHash('md5')
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on hashlib.md5 in python
+    language: python
+    code: |
+      import hashlib
+      hashlib.md5(b"data")
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on md5sum in bash
+    language: bash
+    code: |
+      md5sum release.tar.gz
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores safe crypto usage in javascript
+    language: javascript
+    code: |
+      const crypto = require('crypto')
+      crypto.createHash('sha256')
+    expect:
+      count: 0
+
+  - name: ignores safe crypto usage in typescript
+    language: typescript
+    code: |
+      import crypto from 'crypto'
+      crypto.createHash('sha256')
+    expect:
+      count: 0
+
+  - name: ignores unrelated code in javascript
+    language: javascript
+    code: |
+      console.log("hello")
+    expect:
+      count: 0
+
+  - name: ignores unrelated code in typescript
+    language: typescript
+    code: |
+      console.log("hello")
+    expect:
+      count: 0
+
+  - name: ignores sha256sum in bash
+    language: bash
+    code: |
+      sha256sum release.tar.gz
+    expect:
+      count: 0
+
+  - name: triggers on md5 in rust
+    language: rust
+    code: |
+      hasher.md5()
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores safe hash in rust
+    language: rust
+    code: |
+      hasher.sha256()
+    expect:
+      count: 0
+
+  - name: triggers on MessageDigest MD5 in java
+    language: java
+    code: |
+      MessageDigest.getInstance("MD5");
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores SHA-256 MessageDigest in java
+    language: java
+    code: |
+      MessageDigest.getInstance("SHA-256");
+    expect:
+      count: 0
+
+  - name: triggers on Digest::MD5 in ruby
+    language: ruby
+    code: |
+      Digest::MD5.hexdigest("data")
+    expect:
+      count: 1
+      severity: medium

package/rules/external/security/weak-hash-algorithm.yaml

@@ -0,0 +1,87 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-328
+id: security.weak-hash-algorithm
+severity: medium
+category: security
+min-tier: pro
+languages: [javascript, typescript, tsx, python, bash, rust, java, ruby]
+
+copy:
+  name-key: checks.weak-hash-algorithm.name
+  description-key: checks.weak-hash-algorithm.description
+  message-key: checks.weak-hash-algorithm.message
+  degraded-key: checks.weak-hash-algorithm.degraded
+  remediation-key: remediation.security.weak-hash-algorithm
+
+confidence: high
+
+queries:
+  javascript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        (string (string_fragment) @alg))
+      (#eq? @obj "crypto")
+      (#eq? @method "createHash")
+      (#match? @alg "^(md5|sha1)$")) @match
+  typescript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        (string (string_fragment) @alg))
+      (#eq? @obj "crypto")
+      (#eq? @method "createHash")
+      (#match? @alg "^(md5|sha1)$")) @match
+  tsx: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        (string (string_fragment) @alg))
+      (#eq? @obj "crypto")
+      (#eq? @method "createHash")
+      (#match? @alg "^(md5|sha1)$")) @match
+  python: |
+    (call
+      function: (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @method)
+      (#eq? @obj "hashlib")
+      (#match? @method "^(md5|sha1)$")) @match
+  bash: |
+    (command
+      name: (command_name (word) @cmd)
+      (#match? @cmd "^(md5sum|sha1sum)$")) @match
+  rust: |
+    (call_expression
+      function: (field_expression
+        field: (field_identifier) @func
+        (#match? @func "^(md5|sha1)$"))) @match
+
+  java: |
+    (method_invocation
+      object: (identifier) @obj
+      name: (identifier) @method
+      (#eq? @obj "MessageDigest")
+      (#eq? @method "getInstance")
+      arguments: (argument_list
+        (string_literal
+          (string_fragment) @alg)
+        (#match? @alg "^(MD5|SHA-1|SHA1|md5|sha1)$"))) @match
+
+  ruby: |
+    (call
+      receiver: (scope_resolution
+        scope: (constant) @scope (#eq? @scope "Digest")
+        name: (constant) @algo (#match? @algo "^(MD5|SHA1)$"))
+      method: (identifier) @method (#match? @method "^(hexdigest|digest|new)$")) @match
+
+message-captures: [match]

package/rules/external/security/xxe-parsing.test.yaml

@@ -0,0 +1,76 @@
+rule-id: security.xxe-parsing
+
+cases:
+  - name: triggers on parseXml in javascript
+    language: javascript
+    code: |
+      parseXml(userInput)
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on parseXml in typescript
+    language: typescript
+    code: |
+      parseXml(request.body)
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on parseXml in tsx
+    language: tsx
+    code: |
+      parseXml(props.data)
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on etree.parse in python
+    language: python
+    code: |
+      import xml.etree.ElementTree as etree
+      tree = etree.parse("data.xml")
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores safe parse call
+    language: javascript
+    code: |
+      const result = JSON.parse(data)
+    expect:
+      count: 0
+
+  - name: ignores safe parse call in typescript
+    language: typescript
+    code: |
+      const result = JSON.parse(data)
+    expect:
+      count: 0
+
+  - name: ignores safe code
+    language: javascript
+    code: |
+      console.log("hello")
+    expect:
+      count: 0
+
+  - name: ignores safe code in typescript
+    language: typescript
+    code: |
+      console.log("hello")
+    expect:
+      count: 0
+
+  - name: triggers on DocumentBuilderFactory in java
+    language: java
+    code: |
+      class T {
+        void f() {
+          javax.xml.parsers.DocumentBuilderFactory dbf =
+              javax.xml.parsers.DocumentBuilderFactory.newInstance();
+        }
+      }
+    expect:
+      count: 1
+      severity: high

package/rules/external/security/xxe-parsing.yaml

@@ -0,0 +1,63 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-611
+id: security.xxe-parsing
+severity: high
+category: security
+min-tier: pro
+languages: [javascript, typescript, tsx, python, java]
+
+copy:
+  name-key: checks.xxe-parsing.name
+  description-key: checks.xxe-parsing.description
+  message-key: checks.xxe-parsing.message
+  degraded-key: checks.xxe-parsing.degraded
+  remediation-key: remediation.security.xxe-parsing
+
+confidence: high
+
+queries:
+  javascript: |
+    (call_expression
+      function: (identifier) @func
+      (#eq? @func "parseXml")) @match
+  typescript: |
+    (call_expression
+      function: (identifier) @func
+      (#eq? @func "parseXml")) @match
+  tsx: |
+    (call_expression
+      function: (identifier) @func
+      (#eq? @func "parseXml")) @match
+  python: |
+    (call
+      function: (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @method)
+      (#eq? @obj "etree")
+      (#eq? @method "parse")) @match
+  java: |
+    (method_invocation
+      object: (identifier) @obj
+      name: (identifier) @method
+      (#match? @obj "^(DocumentBuilderFactory|SAXParserFactory|XMLInputFactory|TransformerFactory)$")
+      (#eq? @method "newInstance")) @match
+
+    (method_invocation
+      object: (field_access
+        field: (identifier) @obj)
+      name: (identifier) @method
+      (#match? @obj "^(DocumentBuilderFactory|SAXParserFactory|XMLInputFactory|TransformerFactory)$")
+      (#eq? @method "newInstance")) @match
+
+    (object_creation_expression
+      type: (type_identifier) @t
+      (#eq? @t "SAXParserFactory")) @match
+
+    (object_creation_expression
+      type: (scoped_type_identifier) @type
+      (#match? @type "SAXParserFactory$")) @match
+
+message-captures: [match]

package/rules/internal/security/dangerous-eval.test.yaml

@@ -0,0 +1,126 @@
+rule-id: security.dangerous-eval
+
+cases:
+  - name: triggers on eval in javascript
+    language: javascript
+    code: |
+      eval("1+1")
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores new Function with static string body only in javascript
+    language: javascript
+    code: |
+      new Function("return 1")
+    expect:
+      count: 0
+
+  - name: triggers on new Function with template body in javascript
+    language: javascript
+    code: |
+      new Function(`return ${x}`)
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on new Function with identifier body in javascript
+    language: javascript
+    code: |
+      new Function(userSrc)
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on eval in typescript
+    language: typescript
+    code: |
+      eval("1+1")
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on new Function with template body in typescript
+    language: typescript
+    code: |
+      new Function(`return ${x}`)
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on new Function with identifier body in typescript
+    language: typescript
+    code: |
+      new Function(userSrc)
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores new Function with static string body only in typescript
+    language: typescript
+    code: |
+      new Function("return 1")
+    expect:
+      count: 0
+
+  - name: triggers on eval in tsx
+    language: tsx
+    code: |
+      eval("1+1")
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on eval in python
+    language: python
+    code: |
+      eval("1+1")
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on exec in python
+    language: python
+    code: |
+      exec("print(1)")
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores safe javascript code
+    language: javascript
+    code: |
+      console.log("hello")
+    expect:
+      count: 0
+
+  - name: triggers on ScriptEngine eval in java
+    language: java
+    code: |
+      engine.eval(userInput);
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores safe java code
+    language: java
+    code: |
+      System.out.println("hello");
+    expect:
+      count: 0
+
+  - name: triggers on eval in ruby
+    language: ruby
+    code: |
+      eval(user_code)
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on instance_eval in ruby
+    language: ruby
+    code: |
+      obj.instance_eval(payload)
+    expect:
+      count: 1
+      severity: high

package/rules/internal/security/dangerous-eval.yaml

@@ -0,0 +1,134 @@
+# attribution: CWE-95
+id: security.dangerous-eval
+severity: high
+category: security
+min-tier: free
+languages: [javascript, typescript, tsx, python, java, ruby]
+
+copy:
+  name-key: checks.dangerous-eval.name
+  description-key: checks.dangerous-eval.description
+  message-key: checks.dangerous-eval.message
+  degraded-key: checks.dangerous-eval.degraded
+  remediation-key: remediation.security.dangerous-eval
+
+confidence: high
+
+queries:
+  javascript: |
+    (call_expression
+      function: (identifier) @func
+      (#eq? @func "eval")) @match
+
+    (new_expression
+      constructor: (identifier) @func
+      arguments: (arguments
+        [
+          (template_string)
+          (identifier)
+          (member_expression)
+          (call_expression)
+          (subscript_expression)
+          (binary_expression)
+          (parenthesized_expression)
+        ])
+      (#eq? @func "Function")) @match
+
+    (call_expression
+      function: (identifier) @func
+      arguments: (arguments
+        [
+          (template_string)
+          (identifier)
+          (member_expression)
+          (call_expression)
+          (subscript_expression)
+          (binary_expression)
+          (parenthesized_expression)
+        ])
+      (#eq? @func "Function")) @match
+  typescript: |
+    (call_expression
+      function: (identifier) @func
+      (#eq? @func "eval")) @match
+
+    (new_expression
+      constructor: (identifier) @func
+      arguments: (arguments
+        [
+          (template_string)
+          (identifier)
+          (member_expression)
+          (call_expression)
+          (subscript_expression)
+          (binary_expression)
+          (parenthesized_expression)
+        ])
+      (#eq? @func "Function")) @match
+
+    (call_expression
+      function: (identifier) @func
+      arguments: (arguments
+        [
+          (template_string)
+          (identifier)
+          (member_expression)
+          (call_expression)
+          (subscript_expression)
+          (binary_expression)
+          (parenthesized_expression)
+        ])
+      (#eq? @func "Function")) @match
+  tsx: |
+    (call_expression
+      function: (identifier) @func
+      (#eq? @func "eval")) @match
+
+    (new_expression
+      constructor: (identifier) @func
+      arguments: (arguments
+        [
+          (template_string)
+          (identifier)
+          (member_expression)
+          (call_expression)
+          (subscript_expression)
+          (binary_expression)
+          (parenthesized_expression)
+        ])
+      (#eq? @func "Function")) @match
+
+    (call_expression
+      function: (identifier) @func
+      arguments: (arguments
+        [
+          (template_string)
+          (identifier)
+          (member_expression)
+          (call_expression)
+          (subscript_expression)
+          (binary_expression)
+          (parenthesized_expression)
+        ])
+      (#eq? @func "Function")) @match
+  python: |
+    (call
+      function: (identifier) @func
+      (#match? @func "^(eval|exec)$")) @match
+  java: |
+    (method_invocation
+      name: (identifier) @method
+      (#eq? @method "eval")
+      arguments: (argument_list)) @match
+  ruby: |
+    (call
+      method: (identifier) @func
+      (#match? @func "^(eval|instance_eval|class_eval)$")
+      arguments: (argument_list)) @match
+
+    (call
+      receiver: (call
+        method: (identifier) @recv (#eq? @recv "binding"))
+      method: (identifier) @func
+      (#eq? @func "eval")
+      arguments: (argument_list)) @match

package/rules/internal/security/no-document-write.test.yaml

@@ -0,0 +1,33 @@
+rule-id: security.no-document-write
+
+cases:
+  - name: triggers on document.write in javascript
+    language: javascript
+    code: |
+      document.write("<h1>hi</h1>")
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on document.write in typescript
+    language: typescript
+    code: |
+      document.write("<h1>hi</h1>")
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on document.write in tsx
+    language: tsx
+    code: |
+      document.write("<h1>hi</h1>")
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores safe javascript code
+    language: javascript
+    code: |
+      console.log("hello")
+    expect:
+      count: 0

package/rules/internal/security/no-document-write.yaml

@@ -0,0 +1,40 @@
+# attribution: CWE-79
+id: security.no-document-write
+severity: medium
+category: security
+min-tier: pro
+languages: [javascript, typescript, tsx]
+
+copy:
+  name-key: checks.no-document-write.name
+  description-key: checks.no-document-write.description
+  message-key: checks.no-document-write.message
+  degraded-key: checks.no-document-write.degraded
+  remediation-key: remediation.security.no-document-write
+
+confidence: high
+
+queries:
+  javascript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop)
+      (#eq? @obj "document")
+      (#eq? @prop "write")) @match
+  typescript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop)
+      (#eq? @obj "document")
+      (#eq? @prop "write")) @match
+  tsx: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop)
+      (#eq? @obj "document")
+      (#eq? @prop "write")) @match
+
+message-captures: [match]

package/rules/internal/taint/MATRIX.md

@@ -0,0 +1,16 @@
+# Taint rule matrix
+
+One-line pointer: which sink-classes each yaml file implements.
+
+| File | Sink classes |
+|------|-------------|
+| `javascript.yaml` | code-execution, xss, sql-injection, command-injection, path-traversal, url-injection, prototype-pollution |
+| `typescript.yaml` | code-execution, xss, sql-injection, command-injection, path-traversal, url-injection, prototype-pollution |
+| `php.yaml` | code-execution, xss, sql-injection, command-injection, path-traversal, url-injection, prototype-pollution |
+| `python.yaml` | code-execution, xss, sql-injection, command-injection, path-traversal, url-injection, prototype-pollution |
+| `go.yaml` | code-execution, xss, sql-injection, command-injection, path-traversal, url-injection, prototype-pollution |
+| `ruby.yaml` | code-execution, xss, sql-injection, command-injection, path-traversal, url-injection (prototype-pollution N/A) |
+| `rust.yaml` | code-execution, xss, sql-injection, command-injection, path-traversal, url-injection (prototype-pollution N/A) |
+| `java.yaml` | code-execution, xss, sql-injection, command-injection, path-traversal, url-injection (prototype-pollution N/A) |
+
+See `docs/benchmarks/sink-class-matrix.md` for the full language × sink-class coverage status.