seaworthycode 1.1.1 → 1.1.4

package/rules/internal/taint/bash.test.yaml

@@ -0,0 +1,84 @@
+language: bash
+cases:
+  - name: "SQL injection from positional argument to psql"
+    language: bash
+    code: |
+      QUERY="$1"
+      psql -c "$QUERY"
+    expect:
+      count: 1
+      flows:
+        - sourceId: bash.argv
+          sinkId: bash.psql
+
+  - name: "XSS from interactive read to CGI echo"
+    language: bash
+    code: |
+      read INPUT
+      echo "$INPUT"
+    expect:
+      count: 1
+      flows:
+        - sourceId: bash.read
+          sinkId: bash.cgi_echo
+
+  - name: "Path traversal from positional argument to rm"
+    language: bash
+    code: |
+      DIR="$1"
+      rm -rf "$DIR/"
+    expect:
+      count: 1
+      flows:
+        - sourceId: bash.argv
+          sinkId: bash.path
+
+  - name: "Command injection from positional argument to eval"
+    language: bash
+    code: |
+      CMD="$1"
+      eval "$CMD"
+    expect:
+      count: 1
+      flows:
+        - sourceId: bash.argv
+          sinkId: bash.eval
+
+  - name: "Code execution direct positional argument to eval"
+    language: bash
+    code: |
+      eval "$1"
+    expect:
+      count: 1
+      flows:
+        - sourceId: bash.argv
+          sinkId: bash.eval
+
+  - name: "URL injection from positional argument to curl"
+    language: bash
+    code: |
+      URL="$1"
+      curl "$URL"
+    expect:
+      count: 1
+      flows:
+        - sourceId: bash.argv
+          sinkId: bash.url
+
+  - name: "SQL injection sanitised by regex validation"
+    language: bash
+    code: |
+      [[ "$1" =~ ^[0-9]+$ ]] && psql -c "$1"
+    expect:
+      count: 0
+
+  - name: "Command injection sanitised by quoted expansion"
+    language: bash
+    code: |
+      MODE="$1"
+      exec "$MODE"
+    expect:
+      count: 1
+      flows:
+        - sourceId: bash.argv
+          sinkId: bash.exec

package/rules/internal/taint/bash.yaml

@@ -0,0 +1,166 @@
+# attribution: CWE-78
+attribution: CWE-78
+language: bash
+applies-to: []
+
+sources:
+  - id: bash.argv
+    class: cli-arg
+    query: |
+      ((simple_expansion (variable_name) @name) @source
+        (#match? @name "^[0-9]+$"))
+
+  - id: bash.argv.all
+    class: cli-arg
+    query: |
+      ((simple_expansion (special_variable_name) @name) @source
+        (#match? @name "^[@*]$"))
+
+  - id: bash.read
+    class: interactive-input
+    query: |
+      (command
+        name: (command_name (word) @cmd)
+        argument: (word) @source
+        (#eq? @cmd "read"))
+
+  - id: bash.env
+    class: env
+    query: |
+      ((simple_expansion (variable_name) @name) @source
+        (#match? @name "^(HOME|PATH|USER|SHELL|PWD|TMPDIR|QUERY_STRING|REQUEST_METHOD|CONTENT_TYPE|CONTENT_LENGTH)$"))
+
+  - id: bash.command_substitution
+    class: external-input
+    query: |
+      (command_substitution) @source
+
+  - id: bash.stdin
+    class: stdin
+    query: |
+      (pipeline) @source
+
+sinks:
+  - id: bash.eval
+    sink-class: code-execution
+    query: |
+      (command
+        name: (command_name (word) @cmd)
+        argument: (_) @sink
+        (#match? @cmd "^(eval|source|\\.)$"))
+
+  - id: bash.bash_c
+    sink-class: code-execution
+    query: |
+      (command
+        name: (command_name (word) @cmd)
+        argument: (word) @flag
+        argument: (_) @sink
+        (#match? @cmd "^(bash|sh|zsh)$")
+        (#eq? @flag "-c"))
+
+  - id: bash.dynamic_command
+    sink-class: command-injection
+    query: |
+      (command
+        name: (command_name (simple_expansion) @sink))
+
+  - id: bash.exec
+    sink-class: command-injection
+    query: |
+      (command
+        name: (command_name (word) @cmd)
+        argument: (_) @sink
+        (#eq? @cmd "exec"))
+
+  - id: bash.path
+    sink-class: path-traversal
+    query: |
+      (command
+        name: (command_name (word) @cmd)
+        argument: (_) @sink
+        (#match? @cmd "^(rm|cat|mv|cp|mkdir|touch|chmod|chown)$"))
+
+  - id: bash.redirect_path
+    sink-class: path-traversal
+    query: |
+      (redirected_statement
+        redirect: (_ (_) @sink))
+
+  - id: bash.url
+    sink-class: url-injection
+    query: |
+      (command
+        name: (command_name (word) @cmd)
+        argument: (_) @sink
+        (#match? @cmd "^(curl|wget|lynx)$"))
+
+  - id: bash.psql
+    sink-class: sql-injection
+    query: |
+      (command
+        name: (command_name (word) @cmd)
+        argument: (word) @flag
+        argument: (_) @sink
+        (#eq? @cmd "psql")
+        (#eq? @flag "-c"))
+
+  - id: bash.mysql
+    sink-class: sql-injection
+    query: |
+      (command
+        name: (command_name (word) @cmd)
+        argument: (word) @flag
+        argument: (_) @sink
+        (#eq? @cmd "mysql")
+        (#eq? @flag "-e"))
+
+  - id: bash.sqlite3
+    sink-class: sql-injection
+    query: |
+      (command
+        name: (command_name (word) @cmd)
+        argument: (_) @db
+        argument: (_) @sink
+        (#eq? @cmd "sqlite3"))
+
+  - id: bash.cgi_echo
+    sink-class: xss
+    query: |
+      (command
+        name: (command_name (word) @cmd)
+        argument: (_) @sink
+        (#match? @cmd "^(echo|printf)$"))
+
+  # prototype-pollution is intentionally excluded: shell has no prototype chain.
+
+sanitisers:
+  - id: bash.regex_validation
+    sanitises:
+      - command-injection
+      - path-traversal
+      - sql-injection
+    query: |
+      (test_command
+        (binary_expression
+          left: (string (simple_expansion (variable_name) @sanitiser))
+          right: (regex)))
+
+  - id: bash.case_validation
+    sanitises:
+      - command-injection
+      - path-traversal
+      - url-injection
+    query: |
+      (case_statement
+        value: (string (simple_expansion (variable_name) @sanitiser)))
+
+  - id: bash.printf_string
+    sanitises:
+      - xss
+    query: |
+      (command
+        name: (command_name (word) @cmd)
+        argument: (raw_string) @fmt
+        (#eq? @cmd "printf")
+        (#eq? @fmt "'%s'")) @sanitiser

package/rules/internal/taint/dvwa.test.yaml

@@ -0,0 +1,217 @@
+language: php
+cases:
+  # Benchmark: DVWA sqli module (low difficulty).
+  # Vulnerability class: CWE-89 (SQL Injection).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: baseline
+  - name: "DVWA/sqli/low: GET id concatenated into mysqli query"
+    language: php
+    code: |
+      <?php
+      $userId = $_GET['uid'];
+      $sqlText = "SELECT profile FROM accounts WHERE user_id = '" . $userId . "'";
+      mysqli_query($dbLink, $sqlText);
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.GET
+          sinkId: mysqli_query
+
+  # Benchmark: DVWA sqli module (medium difficulty).
+  # Vulnerability class: CWE-89 (SQL Injection).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: stretch
+  - name: "DVWA/sqli/medium: escaped id still concatenated into query"
+    language: php
+    code: |
+      <?php
+      $rawId = $_POST['record_id'];
+      $safeId = mysqli_real_escape_string($dbLink, $rawId);
+      $sqlText = "SELECT name FROM records WHERE id = " . $safeId;
+      mysqli_query($dbLink, $sqlText);
+    expect:
+      count: 0
+
+  # Benchmark: DVWA sqli module (impossible difficulty).
+  # Vulnerability class: CWE-89 (SQL Injection).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: anti
+  - name: "DVWA/sqli/impossible: prepared statement"
+    language: php
+    code: |
+      <?php
+      $stmt = $pdo->prepare("SELECT name FROM records WHERE id = ?");
+      $stmt->execute([$_GET['record_id']]);
+    expect:
+      count: 0
+
+  # Benchmark: DVWA sqli_blind module (low difficulty).
+  # Vulnerability class: CWE-89 (SQL Injection).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: baseline
+  - name: "DVWA/sqli_blind/low: blind boolean SQL concat"
+    language: php
+    code: |
+      <?php
+      $guess = $_GET['char'];
+      $query = "SELECT 1 FROM secrets WHERE SUBSTRING(flag, 1, 1) = '" . $guess . "'";
+      mysqli_query($dbLink, $query);
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.GET
+          sinkId: mysqli_query
+
+  # Benchmark: DVWA exec module (low difficulty).
+  # Vulnerability class: CWE-78 (OS Command Injection).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: baseline
+  - name: "DVWA/exec/low: shell_exec with user ping target"
+    language: php
+    code: |
+      <?php
+      $hostTarget = $_POST['host'];
+      shell_exec('ping -c 2 ' . $hostTarget);
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.POST
+          sinkId: shell_exec
+
+  # Benchmark: DVWA exec module (impossible difficulty).
+  # Vulnerability class: CWE-78 (OS Command Injection).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: anti
+  - name: "DVWA/exec/impossible: escapeshellarg on command arg"
+    language: php
+    code: |
+      <?php
+      shell_exec(escapeshellarg($_POST['host']));
+    expect:
+      count: 0
+
+  # Benchmark: DVWA fi module (low difficulty).
+  # Vulnerability class: CWE-98 (PHP File Inclusion).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: stretch
+  - name: "DVWA/fi/low: GET page passed to include"
+    language: php
+    code: |
+      <?php
+      $pagePath = $_GET['doc'];
+      include($pagePath);
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.GET
+          sinkId: include
+
+  # Benchmark: DVWA fi module (high difficulty).
+  # Vulnerability class: CWE-98 (PHP File Inclusion).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: baseline
+  - name: "DVWA/fi/high: GET page with weak fnmatch guard"
+    language: php
+    code: |
+      <?php
+      $pagePath = $_GET['doc'];
+      if (!fnmatch('docs/*', $pagePath)) {
+        exit('blocked');
+      }
+      include($pagePath);
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.GET
+          sinkId: include
+
+  # Benchmark: DVWA xss_r module (low difficulty).
+  # Vulnerability class: CWE-79 (Cross-site Scripting).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: stretch
+  - name: "DVWA/xss_r/low: GET name appended to html buffer"
+    language: php
+    code: |
+      <?php
+      $outputHtml .= '<section>' . $_GET['label'] . '</section>';
+      echo $outputHtml;
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.GET
+          sinkId: echo
+
+  # Benchmark: DVWA xss_r module (impossible difficulty).
+  # Vulnerability class: CWE-79 (Cross-site Scripting).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: anti
+  - name: "DVWA/xss_r/impossible: htmlspecialchars on input"
+    language: php
+    code: |
+      <?php
+      $safeLabel = htmlspecialchars($_GET['label']);
+      echo $safeLabel;
+    expect:
+      count: 0
+
+  # Benchmark: DVWA xss_s module (low difficulty).
+  # Vulnerability class: CWE-79 (Cross-site Scripting — stored).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: stretch
+  - name: "DVWA/xss_s/low: POST message echoed later"
+    language: php
+    code: |
+      <?php
+      $storedMessage = $_POST['message'];
+      echo $storedMessage;
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.POST
+          sinkId: echo
+
+  # Benchmark: DVWA open_redirect module (low difficulty).
+  # Vulnerability class: CWE-601 (URL Redirection to Untrusted Site).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: baseline
+  - name: "DVWA/open_redirect/low: Location header with GET redirect"
+    language: php
+    code: |
+      <?php
+      header('Location: ' . $_GET['next']);
+    expect:
+      count: 1
+      flows:
+        - sourceId: superglobal.GET
+          sinkId: header
+
+  # Benchmark: DVWA-style Bash exec module (low difficulty).
+  # Vulnerability class: CWE-78 (OS Command Injection).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: baseline
+  - name: "DVWA_BASH/exec/low: positional command executed directly"
+    language: bash
+    code: |
+      #!/usr/bin/env bash
+      CMD="$1"
+      $CMD
+    expect:
+      count: 1
+      flows:
+        - sourceId: bash.argv
+          sinkId: bash.dynamic_command
+
+  # Benchmark: DVWA-style Bash code execution module (low difficulty).
+  # Vulnerability class: CWE-94 (Code Injection).
+  # Clean-room snippet authored for Seaworthy calibration; no DVWA source copied.
+  # Recall tier: baseline
+  - name: "DVWA_BASH/code_exec/low: positional argument passed to eval"
+    language: bash
+    code: |
+      #!/usr/bin/env bash
+      eval "$1"
+    expect:
+      count: 1
+      flows:
+        - sourceId: bash.argv
+          sinkId: bash.eval

package/rules/internal/taint/go.test.yaml

@@ -0,0 +1,207 @@
+language: go
+cases:
+  - name: "AC-4.6: XSS flow — FormValue to fmt.Fprintf"
+    language: go
+    code: |
+      fmt.Fprintf(w, r.FormValue("name"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: net/http.FormValue
+          sinkId: fmt.Fprintf
+
+  - name: "AC-4.7: XSS sanitised by html.EscapeString — no finding"
+    language: go
+    code: |
+      fmt.Fprintf(w, html.EscapeString(r.FormValue("name")))
+    expect:
+      count: 0
+
+  - name: "AC-4.8: html.EscapeString does not cover sql-injection"
+    language: go
+    code: |
+      db.Query(html.EscapeString(r.FormValue("id")))
+    expect:
+      count: 1
+      flows:
+        - sourceId: net/http.FormValue
+          sinkId: db.Query
+
+  - name: "SQL injection — FormValue to db.Query concat"
+    language: go
+    code: |
+      db.Query("SELECT * FROM users WHERE id = " + r.FormValue("id"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: net/http.FormValue
+          sinkId: db.Query
+
+  - name: "SQL injection via short var declaration"
+    language: go
+    code: |
+      id := r.FormValue("id")
+      db.Query("SELECT * FROM users WHERE id = " + id)
+    expect:
+      count: 1
+      flows:
+        - sourceId: net/http.FormValue
+          sinkId: db.Query
+
+  - name: "SQL injection sanitised by parameterised query"
+    language: go
+    code: |
+      db.Query("SELECT * FROM users WHERE id = ?", r.FormValue("id"))
+    expect:
+      count: 0
+
+  - name: "Command injection — os.Args to exec.Command"
+    language: go
+    code: |
+      exec.Command("sh", "-c", os.Args[1])
+    expect:
+      count: 1
+      flows:
+        - sourceId: os.Args
+          sinkId: exec.Command
+
+  - name: "Path traversal — FormValue to os.Open"
+    language: go
+    code: |
+      os.Open(r.FormValue("file"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: net/http.FormValue
+          sinkId: os.Open
+
+  - name: "Path traversal sanitised by filepath.Clean"
+    language: go
+    code: |
+      os.Open(filepath.Clean(r.FormValue("file")))
+    expect:
+      count: 0
+
+  - name: "URL injection — FormValue to http.Redirect"
+    language: go
+    code: |
+      http.Redirect(w, r, r.FormValue("next"), 302)
+    expect:
+      count: 1
+      flows:
+        - sourceId: net/http.FormValue
+          sinkId: http.Redirect
+
+  - name: "URL injection sanitised by url.QueryEscape"
+    language: go
+    code: |
+      http.Redirect(w, r, url.QueryEscape(r.FormValue("next")), 302)
+    expect:
+      count: 0
+
+  - name: "Gin: c.Query to fmt.Fprintf"
+    language: go
+    code: |
+      fmt.Fprintf(w, c.Query("name"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: gin.Context.Query
+          sinkId: fmt.Fprintf
+
+  - name: "Echo: c.QueryParam to io.WriteString"
+    language: go
+    code: |
+      io.WriteString(w, c.QueryParam("label"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: echo.Context.Query
+          sinkId: io.WriteString
+
+  - name: "Prototype pollution via maps.Copy"
+    language: go
+    code: |
+      maps.Copy(dst, r.FormValue("payload"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: net/http.FormValue
+          sinkId: maps.Copy
+
+  - name: "Environment variable to os.Open"
+    language: go
+    code: |
+      os.Open(os.Getenv("USER_PATH"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: os.Getenv
+          sinkId: os.Open
+
+  - name: "Request body via io.ReadAll to template.HTML"
+    language: go
+    code: |
+      body, _ := io.ReadAll(r.Body)
+      template.HTML(string(body))
+    expect:
+      count: 1
+      flows:
+        - sourceId: net/http.Request.Body
+          sinkId: template.HTML
+
+  - name: "URL query param via r.URL.Query().Get"
+    language: go
+    code: |
+      db.Query("SELECT * FROM t WHERE id = " + r.URL.Query().Get("id"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: net/http.URL.Query
+          sinkId: db.Query
+
+  - name: "Code execution via plugin.Open"
+    language: go
+    code: |
+      plugin.Open(os.Getenv("PLUGIN"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: os.Getenv
+          sinkId: plugin.Open
+
+  - name: "Gin redirect with c.Redirect"
+    language: go
+    code: |
+      c.Redirect(http.StatusFound, c.Query("next"))
+    expect:
+      count: 1
+      flows:
+        - sourceId: gin.Context.Query
+          sinkId: gin.Context.Redirect
+
+  - name: "fmt.Sprintf SQL sink"
+    language: go
+    code: |
+      db.Query(fmt.Sprintf("SELECT * FROM users WHERE id = %s", r.FormValue("id")))
+    expect:
+      count: 1
+      flows:
+        - sourceId: net/http.FormValue
+          sinkId: db.Query
+
+  - name: "Go — no source match returns zero flows"
+    language: go
+    code: |
+      fmt.Println("hello world")
+    expect:
+      count: 0
+
+  - name: "Go safe anti-fixture: escape and parameterised query"
+    language: go
+    code: |
+      safe := html.EscapeString(r.FormValue("name"))
+      db.Query("SELECT * FROM users WHERE name = ?", r.FormValue("name"))
+      fmt.Fprintf(w, safe)
+    expect:
+      count: 0