seaworthycode 1.1.2 → 1.1.4

package/rules/internal/taint/java.yaml

@@ -0,0 +1,318 @@
+# Prototype-pollution is N/A — Java has no prototype chain.
+# attribution: CWE-79
+attribution: CWE-79
+language: java
+applies-to: []
+
+sources:
+  - id: servlet.request.getParameter
+    class: http-params
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#match? @method "^(getParameter|getParameterValues|getQueryString)$")
+        arguments: (argument_list)) @source
+
+  - id: servlet.request.getHeader
+    class: header
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#match? @method "^(getHeader|getHeaders)$")
+        arguments: (argument_list)) @source
+
+  - id: servlet.request.body
+    class: http-body
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#match? @method "^(getInputStream|getReader)$")
+        arguments: (argument_list)) @source
+
+  - id: servlet.request.getCookies
+    class: cookie
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#eq? @method "getCookies")
+        arguments: (argument_list)) @source
+
+  - id: spring.requestParam
+    class: http-params
+    query: |
+      (formal_parameter
+        (modifiers
+          [
+            (marker_annotation name: (identifier) @ann)
+            (annotation name: (identifier) @ann)
+          ]
+          (#match? @ann "^(RequestParam|PathVariable)$"))
+        name: (identifier) @source)
+
+  - id: spring.requestBody
+    class: http-body
+    query: |
+      (formal_parameter
+        (modifiers
+          [
+            (marker_annotation name: (identifier) @ann)
+            (annotation name: (identifier) @ann)
+          ]
+          (#eq? @ann "RequestBody"))
+        name: (identifier) @source)
+
+  - id: spring.requestHeader
+    class: header
+    query: |
+      (formal_parameter
+        (modifiers
+          [
+            (marker_annotation name: (identifier) @ann)
+            (annotation name: (identifier) @ann)
+          ]
+          (#eq? @ann "RequestHeader"))
+        name: (identifier) @source)
+
+  - id: spring.cookieValue
+    class: cookie
+    query: |
+      (formal_parameter
+        (modifiers
+          [
+            (marker_annotation name: (identifier) @ann)
+            (annotation name: (identifier) @ann)
+          ]
+          (#eq? @ann "CookieValue"))
+        name: (identifier) @source)
+
+  - id: java.System.getenv
+    class: env-var
+    query: |
+      (method_invocation
+        object: (identifier) @obj
+        name: (identifier) @method
+        (#eq? @obj "System")
+        (#eq? @method "getenv")
+        arguments: (argument_list)) @source
+
+  - id: java.System.getProperty
+    class: env-var
+    query: |
+      (method_invocation
+        object: (identifier) @obj
+        name: (identifier) @method
+        (#eq? @obj "System")
+        (#eq? @method "getProperty")
+        arguments: (argument_list)) @source
+
+  - id: java.main.args
+    class: process-argv
+    query: |
+      (formal_parameter
+        type: (array_type (type_identifier) @t (#eq? @t "String"))
+        name: (identifier) @source
+        (#eq? @source "args"))
+
+  - id: spring.value
+    class: env-var
+    query: |
+      (formal_parameter
+        (modifiers
+          [
+            (marker_annotation name: (identifier) @ann)
+            (annotation name: (identifier) @ann)
+          ]
+          (#eq? @ann "Value"))
+        name: (identifier) @source)
+
+  - id: spring.multipartFile
+    class: http-body
+    query: |
+      (formal_parameter
+        type: (type_identifier) @t
+        name: (identifier) @source
+        (#eq? @t "MultipartFile"))
+
+sinks:
+  - id: java.Statement.execute
+    sink-class: sql-injection
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#match? @method "^execute.*$")
+        arguments: (argument_list) @sink) @match
+
+  - id: java.Connection.prepareStatement
+    sink-class: sql-injection
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#eq? @method "prepareStatement")
+        arguments: (argument_list) @sink) @match
+
+  - id: java.JdbcTemplate.query
+    sink-class: sql-injection
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#match? @method "^(query|update|execute)$")
+        arguments: (argument_list) @sink) @match
+
+  - id: java.hibernate.createQuery
+    sink-class: sql-injection
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#match? @method "^(createQuery|createNativeQuery)$")
+        arguments: (argument_list) @sink) @match
+
+  - id: java.Runtime.exec
+    sink-class: command-injection
+    query: |
+      (method_invocation
+        object: (method_invocation
+          object: (identifier) @rt
+          name: (identifier) @gr
+          (#eq? @rt "Runtime")
+          (#eq? @gr "getRuntime"))
+        name: (identifier) @method
+        (#eq? @method "exec")
+        arguments: (argument_list) @sink) @match
+
+  - id: java.ProcessBuilder
+    sink-class: command-injection
+    query: |
+      [
+        (object_creation_expression
+          type: (type_identifier) @t
+          (#eq? @t "ProcessBuilder")
+          arguments: (argument_list) @sink)
+        (object_creation_expression
+          type: (scoped_type_identifier) @type
+          (#match? @type "ProcessBuilder$")
+          arguments: (argument_list) @sink)
+        (method_invocation
+          object: (identifier) @obj
+          name: (identifier) @method
+          (#eq? @obj "ProcessBuilder")
+          (#eq? @method "command")
+          arguments: (argument_list) @sink)
+      ] @match
+
+  - id: java.ScriptEngine.eval
+    sink-class: code-execution
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#eq? @method "eval")
+        arguments: (argument_list) @sink) @match
+
+  - id: java.response.print
+    sink-class: xss
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#match? @method "^(print|println|printf|write|append)$")
+        arguments: (argument_list) @sink) @match
+
+  - id: java.File.constructor
+    sink-class: path-traversal
+    query: |
+      (object_creation_expression
+        type: (type_identifier) @t
+        (#match? @t "^(File|FileInputStream)$")
+        arguments: (argument_list) @sink) @match
+
+  - id: java.File.constructorScoped
+    sink-class: path-traversal
+    query: |
+      (object_creation_expression
+        type: (scoped_type_identifier) @type
+        (#match? @type "(File|FileInputStream)$")
+        arguments: (argument_list) @sink) @match
+
+  - id: java.Paths.get
+    sink-class: path-traversal
+    query: |
+      (method_invocation
+        object: (identifier) @obj
+        name: (identifier) @method
+        (#eq? @obj "Paths")
+        (#eq? @method "get")
+        arguments: (argument_list) @sink) @match
+
+  - id: java.Files.read
+    sink-class: path-traversal
+    query: |
+      (method_invocation
+        object: (identifier) @obj
+        name: (identifier) @method
+        (#eq? @obj "Files")
+        (#match? @method "^(readAllBytes|readString|readAllLines|newInputStream|newBufferedReader)$")
+        arguments: (argument_list) @sink) @match
+
+  - id: java.response.sendRedirect
+    sink-class: url-injection
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#eq? @method "sendRedirect")
+        arguments: (argument_list) @sink) @match
+
+  - id: java.response.locationHeader
+    sink-class: url-injection
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#eq? @method "setHeader")
+        arguments: (argument_list
+          (string_literal (string_fragment) @h)
+          (#eq? @h "Location")
+          (_) @sink)) @match
+
+sanitisers:
+  - id: java.PreparedStatement.bind
+    sanitises: [sql-injection]
+    # Note: A full parameter binding dataflow (from conn.prepareStatement(tainted)
+    # to ps.setXxx(receiver, index, value) to ps.execute()) is not tracked at a variable
+    # level in this simple pattern matcher. We assume setXxx/setObject/setNull calls
+    # are safe and don't propagate taint to sinks. This sanitiser is intentionally
+    # matching Statement-style execute calls where the query is a string literal,
+    # as execute(string_literal) is safe from SQL injection.
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#match? @method "^execute.*$")
+        arguments: (argument_list
+          (string_literal)
+          (_))) @sanitiser
+
+  - id: java.HtmlUtils.escape
+    sanitises: [xss]
+    autofix-safety: requires-import
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#match? @method "^(htmlEscape|escapeHtml)$")
+        arguments: (argument_list (_) @arg)) @sanitiser
+
+  - id: java.Integer.parseInt
+    sanitises: [xss, sql-injection, command-injection, path-traversal, url-injection]
+    query: |
+      (method_invocation
+        object: (identifier) @obj
+        name: (identifier) @method
+        (#match? @obj "^(Integer|Long)$")
+        (#match? @method "^(parseInt|parseLong)$")
+        arguments: (argument_list (_) @arg)) @sanitiser
+
+
+
+  - id: java.UriUtils.encode
+    sanitises: [url-injection]
+    autofix-safety: requires-import
+    query: |
+      (method_invocation
+        name: (identifier) @method
+        (#match? @method "^(encode|encodePath|encodePathSegment)$")
+        arguments: (argument_list (_) @arg)) @sanitiser

package/rules/internal/taint/javascript.test.yaml

@@ -0,0 +1,374 @@
+language: javascript
+cases:
+  - name: "AC-4.6: direct XSS flow from req.body to res.send"
+    language: javascript
+    code: |
+      const x = req.body;
+      res.send(x);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: res.send
+
+  - name: "AC-4.7: XSS sanitised by encodeURIComponent — no finding"
+    language: javascript
+    code: |
+      res.send(encodeURIComponent(req.body));
+    expect:
+      count: 0
+
+  - name: "AC-4.8: encodeURIComponent sanitiser does not cover sql-injection"
+    language: javascript
+    code: |
+      db.query(encodeURIComponent(req.body));
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: db.query
+
+  - name: "SQL injection from req.query to db.query"
+    language: javascript
+    code: |
+      const q = req.query.id;
+      db.query("SELECT * FROM users WHERE id = " + q);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: db.query
+
+  - name: "SQL injection sanitised by parameterised query"
+    language: javascript
+    code: |
+      db.query("SELECT * FROM users WHERE id = ?", [req.query.id]);
+    expect:
+      count: 0
+
+  - name: "Sequelize query with req.query criteria"
+    language: javascript
+    code: |
+      const criteria = req.query.q;
+      models.sequelize.query(`SELECT * FROM Products WHERE name LIKE '%${criteria}%'`);
+    expect:
+      count: 2
+      flows:
+        - sourceId: req.query
+          sinkId: sequelize.query
+        - sourceId: req.query
+          sinkId: template-literal-sql
+
+  - name: "Safe parameterised Sequelize-style query"
+    language: javascript
+    code: |
+      models.sequelize.query("SELECT * FROM Products WHERE id = ?", [req.query.id]);
+    expect:
+      count: 0
+
+  - name: "URL injection from req.query to res.redirect"
+    language: javascript
+    code: |
+      res.redirect(req.query.next);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: res.redirect
+
+  - name: "Command injection from process.argv to child_process.exec"
+    language: javascript
+    code: |
+      child_process.exec(process.argv[2]);
+    expect:
+      count: 1
+      flows:
+        - sourceId: process.argv
+          sinkId: child_process.exec
+
+  - name: "Path traversal from req.params to fs.readFile"
+    language: javascript
+    code: |
+      fs.readFile(req.params.file);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.params
+          sinkId: fs.readFile-path
+
+  - name: "Path traversal sanitised by path.resolve"
+    language: javascript
+    code: |
+      fs.readFile(path.resolve("/safe/root", req.params.file));
+    expect:
+      count: 0
+
+  - name: "Safe fs.writeFile with literal path — zero flows"
+    language: javascript
+    code: |
+      fs.writeFile('./data/app-config.json', 'static');
+    expect:
+      count: 0
+
+  - name: "Juice Shop-style codingChallenges read — zero flows"
+    language: javascript
+    code: |
+      const fs = require('fs');
+      fs.readFile('./data/codingchallenges/readme.md');
+    expect:
+      count: 0
+
+  - name: "Path traversal from req.params to res.sendFile"
+    language: javascript
+    code: |
+      res.sendFile(req.params.file);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.params
+          sinkId: res.sendFile
+
+  - name: "No source match — zero flows"
+    language: javascript
+    code: |
+      console.log("hello world");
+    expect:
+      count: 0
+
+  - name: "Function call stops propagation"
+    language: javascript
+    code: |
+      const x = req.body;
+      helper(x);
+      eval(x);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: eval
+
+  - name: "Template literal propagation to eval"
+    language: javascript
+    code: |
+      eval(`const data = ${req.body}; process(data)`);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: eval
+
+  - name: "Array mutation propagation"
+    language: javascript
+    code: |
+      const arr = [];
+      arr.push(req.body);
+      eval(arr[0]);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: eval
+
+  - name: "Object mutation propagation"
+    language: javascript
+    code: |
+      const obj = {};
+      obj.data = req.body;
+      eval(obj.data);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: eval
+
+  - name: "InnerHTML XSS from env var"
+    language: javascript
+    code: |
+      document.getElementById("output").innerHTML = process.env.USER_INPUT;
+    expect:
+      count: 1
+      flows:
+        - sourceId: process.env
+          sinkId: innerHTML
+
+  - name: "JSON.stringify sanitises XSS"
+    language: javascript
+    code: |
+      res.send(JSON.stringify(req.body));
+    expect:
+      count: 0
+
+  - name: "Multiple flows from same source to different sinks"
+    language: javascript
+    code: |
+      const x = req.body;
+      res.send(x);
+      db.query(x);
+    expect:
+      count: 2
+      flows:
+        - sourceId: req.body
+          sinkId: res.send
+        - sourceId: req.body
+          sinkId: db.query
+
+  - name: "URL injection from process.env to res.redirect"
+    language: javascript
+    code: |
+      res.redirect(process.env.REDIRECT_URL);
+    expect:
+      count: 1
+      flows:
+        - sourceId: process.env
+          sinkId: res.redirect
+
+  - name: "URL injection sanitised by encodeURIComponent"
+    language: javascript
+    code: |
+      res.redirect(encodeURIComponent(req.query.redirect));
+    expect:
+      count: 0
+
+  - name: "Prototype pollution with Object.assign"
+    language: javascript
+    code: |
+      const target = {};
+      Object.assign(target, req.body);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: Object.assign-pollution
+
+  - name: "Prototype pollution sanitised by Object.freeze"
+    language: javascript
+    code: |
+      const target = {};
+      Object.assign(target, Object.freeze(req.body));
+    expect:
+      count: 0
+
+  - name: "Branch join — taint on one branch"
+    language: javascript
+    code: |
+      let y;
+      if (cond) { y = req.body; } else { y = "safe"; }
+      eval(y);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: eval
+
+  - name: "Loop handling — assignment inside loop"
+    language: javascript
+    code: |
+      let x;
+      for (let i = 0; i < 10; i++) { x = req.body; }
+      eval(x);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: eval
+
+  - name: "AC-10.5: inter-function taint — helper with sink"
+    language: javascript
+    code: |
+      let x = req.body;
+      helper(x);
+      function helper(data) { eval(data); }
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: eval
+
+  - name: "AC-10.5: inter-function taint — return value propagation"
+    language: javascript
+    code: |
+      let x = req.body;
+      let y = wrapper(x);
+      eval(y);
+      function wrapper(data) { return data; }
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: eval
+
+  - name: "API XSS from req.body to res.json"
+    language: javascript
+    code: |
+      res.json(req.body.label);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: res.json
+
+  - name: "API XSS safe — res.json with literal object"
+    language: javascript
+    code: |
+      res.json({ ok: true });
+    expect:
+      count: 0
+
+  - name: "Destructuring SQLi from req.query to db.query"
+    language: javascript
+    code: |
+      const { id } = req.query;
+      db.query("SELECT * FROM users WHERE id = " + id);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: db.query
+
+  - name: "MongoDB $where injection from req.query"
+    language: javascript
+    code: |
+      Product.find({ $where: req.query.q });
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.query
+          sinkId: Model.find-$where
+
+  - name: "Upload path traversal from req.body to fs.writeFile"
+    language: javascript
+    code: |
+      fs.writeFile(req.body.path, req.body.data);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: fs.writeFile-path
+
+  - name: "DOMPurify sanitises API XSS via res.json"
+    language: javascript
+    code: |
+      res.json(DOMPurify.sanitize(req.body.x));
+    expect:
+      count: 0
+
+  - name: "Optional chaining propagates req?.body to res.send"
+    language: javascript
+    code: |
+      const x = req?.body;
+      res.send(x);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.body
+          sinkId: res.send
+
+  - name: "Multer upload path from req.file.path to fs.writeFile"
+    language: javascript
+    code: |
+      fs.writeFile(req.file.path, buf);
+    expect:
+      count: 1
+      flows:
+        - sourceId: req.file.path
+          sinkId: fs.writeFile-path