seaworthycode 1.1.2 → 1.2.3

package/package.json

@@ -1,9 +1,11 @@
 {
   "name": "seaworthycode",
-  "version": "1.1.2",
+  "version": "1.2.3",
   "type": "module",
   "files": [
-    "dist"
+    "dist",
+    "rules",
+    "wasm"
   ],
   "bin": {
     "seaworthy": "./dist/index.js"
@@ -14,15 +16,7 @@
       "import": "./dist/index.js"
     }
   },
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "lint": "eslint src/",
-    "check-types": "tsc --noEmit",
-    "test": "vitest run"
-  },
   "dependencies": {
-    "@seaworthy/core": "workspace:*",
     "@anthropic-ai/sdk": "^0.91.1",
     "@clack/prompts": "1.5.1",
     "acorn": "^8.16.0",
@@ -43,6 +37,14 @@
     "eslint": "^9.39.4",
     "tsup": "^8.3.6",
     "typescript": "^5.7.3",
-    "vitest": "^4.1.0"
+    "vitest": "^4.1.0",
+    "@seaworthy/core": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "lint": "eslint src/",
+    "check-types": "tsc --noEmit",
+    "test": "vitest run"
   }
-}
+}

package/rules/external/configuration/insecure-cookie-flags.test.yaml

@@ -0,0 +1,114 @@
+rule-id: configuration.insecure-cookie-flags
+
+cases:
+  - name: triggers on res.cookie in javascript
+    language: javascript
+    code: |
+      res.cookie("session", "abc123")
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on res.cookie in typescript
+    language: typescript
+    code: |
+      res.cookie("token", jwtToken)
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on res.cookie in tsx
+    language: tsx
+    code: |
+      res.cookie("auth", "token123")
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores fully secured res.cookie in javascript
+    language: javascript
+    code: |
+      res.cookie("session", "abc123", { secure: true, httpOnly: true, sameSite: "Strict" })
+    expect:
+      count: 0
+
+  - name: ignores fully secured res.cookie in typescript
+    language: typescript
+    code: |
+      res.cookie("session", "abc123", { secure: true, httpOnly: true, sameSite: "Strict" })
+    expect:
+      count: 0
+
+  - name: triggers when some cookie flags are still missing
+    language: javascript
+    code: |
+      res.cookie("session", "abc123", { secure: true })
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on set_cookie in python
+    language: python
+    code: |
+      response.set_cookie("auth", "value")
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores fully secured set_cookie in python
+    language: python
+    code: |
+      response.set_cookie("auth", "value", secure=True, httponly=True, samesite="Lax")
+    expect:
+      count: 0
+
+  - name: ignores unrelated response method
+    language: javascript
+    code: |
+      res.send("ok")
+    expect:
+      count: 0
+
+  - name: ignores unrelated response method in typescript
+    language: typescript
+    code: |
+      res.send("ok")
+    expect:
+      count: 0
+
+  - name: ignores unrelated python code
+    language: python
+    code: |
+      x = 1 + 2
+    expect:
+      count: 0
+
+  - name: triggers on setSecure false in java
+    language: java
+    code: |
+      cookie.setSecure(false);
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on addCookie with new Cookie in java
+    language: java
+    code: |
+      response.addCookie(new Cookie("session", token));
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores unrelated java code
+    language: java
+    code: |
+      System.out.println("ok");
+    expect:
+      count: 0
+
+  - name: triggers on cookies assignment without secure flags in ruby
+    language: ruby
+    code: |
+      cookies[:session_id] = user.id
+    expect:
+      count: 1

package/rules/external/configuration/insecure-cookie-flags.yaml

@@ -0,0 +1,77 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-614
+id: configuration.insecure-cookie-flags
+severity: medium
+category: configuration
+min-tier: pro
+languages: [javascript, typescript, tsx, python, java, ruby]
+
+copy:
+  name-key: checks.insecure-cookie-flags.name
+  description-key: checks.insecure-cookie-flags.description
+  message-key: checks.insecure-cookie-flags.message
+  degraded-key: checks.insecure-cookie-flags.degraded
+  remediation-key: remediation.configuration.insecure-cookie-flags
+
+confidence: high
+
+queries:
+  javascript: |
+    ((call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      (#eq? @obj "res")
+      (#eq? @method "cookie")) @match
+      (#not-match? @match "(?=.*secure\\s*:\\s*true)(?=.*httpOnly\\s*:\\s*true)(?=.*sameSite\\s*:\\s*(\"Strict\"|\"Lax\"|'Strict'|'Lax'))"))
+  typescript: |
+    ((call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      (#eq? @obj "res")
+      (#eq? @method "cookie")) @match
+      (#not-match? @match "(?=.*secure\\s*:\\s*true)(?=.*httpOnly\\s*:\\s*true)(?=.*sameSite\\s*:\\s*(\"Strict\"|\"Lax\"|'Strict'|'Lax'))"))
+  tsx: |
+    ((call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      (#eq? @obj "res")
+      (#eq? @method "cookie")) @match
+      (#not-match? @match "(?=.*secure\\s*:\\s*true)(?=.*httpOnly\\s*:\\s*true)(?=.*sameSite\\s*:\\s*(\"Strict\"|\"Lax\"|'Strict'|'Lax'))"))
+  python: |
+    ((call
+      function: (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @method)
+      (#eq? @obj "response")
+      (#eq? @method "set_cookie")) @match
+      (#not-match? @match "(?=.*secure\\s*=\\s*True)(?=.*httponly\\s*=\\s*True)(?=.*samesite\\s*=\\s*(\"Strict\"|\"Lax\"|'Strict'|'Lax'))"))
+  java: |
+    (method_invocation
+      name: (identifier) @method
+      (#match? @method "^(setSecure|setHttpOnly)$")
+      arguments: (argument_list
+        (false))) @match
+
+    (method_invocation
+      name: (identifier) @method
+      (#eq? @method "addCookie")
+      arguments: (argument_list
+        (object_creation_expression
+          type: (type_identifier) @t
+          (#eq? @t "Cookie")))) @match
+
+  ruby: |
+    ((assignment
+      left: (element_reference
+        object: (identifier) @obj (#eq? @obj "cookies")
+        [(_)])
+      right: (_)) @match
+      (#not-match? @match "(secure|httponly|same_site)"))
+
+message-captures: [match]

package/rules/external/configuration/missing-ssl-verification.test.yaml

@@ -0,0 +1,130 @@
+rule-id: configuration.missing-ssl-verification
+
+cases:
+  - name: triggers on rejectUnauthorized false in javascript
+    language: javascript
+    code: |
+      const https = require('https');
+      https.createServer({ rejectUnauthorized: false }, app);
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on rejectUnauthorized false in typescript
+    language: typescript
+    code: |
+      import https from 'https';
+      https.createServer({ rejectUnauthorized: false }, app);
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on rejectUnauthorized false in tsx
+    language: tsx
+    code: |
+      import https from 'https';
+      https.createServer({ rejectUnauthorized: false }, app);
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores safe value
+    language: javascript
+    code: |
+      https.createServer({ rejectUnauthorized: true }, app);
+    expect:
+      count: 0
+
+  - name: ignores safe value in typescript
+    language: typescript
+    code: |
+      import https from 'https';
+      https.createServer({ rejectUnauthorized: true }, app);
+    expect:
+      count: 0
+
+  - name: triggers on requests.get with verify=False in python
+    language: python
+    code: |
+      requests.get("https://example.com", verify=False)
+    expect:
+      count: 1
+      severity: high
+  - name: triggers on httpx.post with verify=False in python
+    language: python
+    code: |
+      httpx.post("https://api.example.com", verify=False)
+    expect:
+      count: 1
+      severity: high
+  - name: triggers on curl insecure flag in bash
+    language: bash
+    code: |
+      curl -k https://example.com
+    expect:
+      count: 1
+      severity: high
+  - name: ignores requests.get without verify in python
+    language: python
+    code: |
+      requests.get("https://example.com")
+    expect:
+      count: 0
+  - name: ignores requests.get with verify=True in python
+    language: python
+    code: |
+      requests.get("https://example.com", verify=True)
+    expect:
+      count: 0
+  - name: ignores curl without insecure flag in bash
+    language: bash
+    code: |
+      curl https://example.com
+    expect:
+      count: 0
+
+  - name: triggers on danger_accept_invalid_certs in rust
+    language: rust
+    code: |
+      client.danger_accept_invalid_certs(true)
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores safe client in rust
+    language: rust
+    code: |
+      client.get("https://example.com")
+    expect:
+      count: 0
+
+  - name: triggers on setDefaultHostnameVerifier in java
+    language: java
+    code: |
+      HttpsURLConnection.setDefaultHostnameVerifier((host, session) -> true);
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores unrelated java code
+    language: java
+    code: |
+      System.out.println("ok");
+    expect:
+      count: 0
+
+  - name: ignores safe hostname verifier in java
+    language: java
+    code: |
+      HttpsURLConnection.setDefaultHostnameVerifier((host, session) -> host.equals("secure.com"));
+    expect:
+      count: 0
+
+  - name: triggers on VERIFY_NONE in ruby
+    language: ruby
+    code: |
+      http = Net::HTTP.new("example.com", 443)
+      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+    expect:
+      count: 1
+      severity: high

package/rules/external/configuration/missing-ssl-verification.yaml

@@ -0,0 +1,123 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-295
+id: configuration.missing-ssl-verification
+severity: high
+category: configuration
+min-tier: pro
+languages: [javascript, typescript, tsx, python, bash, rust, java, ruby]
+
+copy:
+  name-key: checks.missing-ssl-verification.name
+  description-key: checks.missing-ssl-verification.description
+  message-key: checks.missing-ssl-verification.message
+  degraded-key: checks.missing-ssl-verification.degraded
+  remediation-key: remediation.configuration.missing-ssl-verification
+
+confidence: high
+
+queries:
+  javascript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop)
+      arguments: (arguments
+        (object
+          (pair
+            key: (property_identifier) @key
+            value: (false) @val)))
+      (#eq? @prop "createServer")
+      (#eq? @key "rejectUnauthorized")) @match
+  typescript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop)
+      arguments: (arguments
+        (object
+          (pair
+            key: (property_identifier) @key
+            value: (false) @val)))
+      (#eq? @prop "createServer")
+      (#eq? @key "rejectUnauthorized")) @match
+  tsx: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @prop)
+      arguments: (arguments
+        (object
+          (pair
+            key: (property_identifier) @key
+            value: (false) @val)))
+      (#eq? @prop "createServer")
+      (#eq? @key "rejectUnauthorized")) @match
+  python: |
+    (call
+      function: (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @method)
+      arguments: (argument_list
+        (keyword_argument
+          name: (identifier) @key
+          value: (false) @val))
+      (#match? @obj "^(requests|httpx)$")
+      (#match? @method "^(get|post|put|patch|delete|head|options)$")
+      (#eq? @key "verify")) @match
+  bash: |
+    (command
+      name: (command_name (word) @cmd)
+      argument: (word) @flag
+      (#match? @cmd "^(curl|wget)$")
+      (#match? @flag "^(-k|--insecure|--no-check-certificate)$")) @match
+  rust: |
+    (call_expression
+      function: (field_expression
+        field: (field_identifier) @func
+        (#eq? @func "danger_accept_invalid_certs"))) @match
+
+  java: |
+    (method_invocation
+      name: (identifier) @method
+      (#match? @method "^(setDefaultHostnameVerifier|setHostnameVerifier|setSSLHostnameVerifier)$")
+      arguments: (argument_list
+        (field_access
+          object: (identifier) @obj
+          field: (identifier) @field
+          (#eq? @obj "NoopHostnameVerifier")
+          (#eq? @field "INSTANCE")))) @match
+
+    (method_invocation
+      name: (identifier) @method
+      (#match? @method "^(setDefaultHostnameVerifier|setHostnameVerifier|setSSLHostnameVerifier)$")
+      arguments: (argument_list
+        (identifier) @id
+        (#eq? @id "ALLOW_ALL_HOSTNAME_VERIFIER"))) @match
+
+    (method_invocation
+      name: (identifier) @method
+      (#match? @method "^(setDefaultHostnameVerifier|setHostnameVerifier|setSSLHostnameVerifier)$")
+      arguments: (argument_list
+        (lambda_expression
+          (true)))) @match
+
+    (method_invocation
+      name: (identifier) @method
+      (#match? @method "^(setDefaultHostnameVerifier|setHostnameVerifier|setSSLHostnameVerifier)$")
+      arguments: (argument_list
+        (lambda_expression
+          (block
+            (return_statement
+              (true)))))) @match
+
+  ruby: |
+    (scope_resolution
+      scope: (scope_resolution
+        scope: (constant) @o (#eq? @o "OpenSSL")
+        name: (constant) @s (#eq? @s "SSL"))
+      name: (constant) @v (#eq? @v "VERIFY_NONE")) @match
+
+message-captures: [match]

package/rules/external/data-exposure/debug-artifacts.test.yaml

@@ -0,0 +1,143 @@
+rule-id: data-exposure.debug-artifacts
+
+cases:
+  - name: triggers on debugger statement in javascript
+    language: javascript
+    code: |
+      debugger;
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on debugger in typescript
+    language: typescript
+    code: |
+      function foo() {
+        debugger;
+      }
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on debugger in tsx
+    language: tsx
+    code: |
+      debugger;
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on pdb import in python
+    language: python
+    code: |
+      from pdb import set_trace
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on xtrace in bash
+    language: bash
+    code: |
+      set -x
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores normal code
+    language: javascript
+    code: |
+      console.log("ok")
+    expect:
+      count: 0
+
+  - name: ignores normal code in typescript
+    language: typescript
+    code: |
+      console.log("ok")
+    expect:
+      count: 0
+
+  - name: ignores normal python code
+    language: python
+    code: |
+      import json
+    expect:
+      count: 0
+
+  - name: triggers on binding.pry in ruby
+    language: ruby
+    code: |
+      binding.pry
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores errexit in bash
+    language: bash
+    code: |
+      set -e
+    expect:
+      count: 0
+
+  - name: triggers on dbg macro in rust
+    language: rust
+    code: |
+      dbg!(x)
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores println macro in rust
+    language: rust
+    code: |
+      println!("ok")
+    expect:
+      count: 0
+
+  - name: triggers on debug comment in html
+    language: html
+    code: |
+      <!-- DEBUG: fix this -->
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on todo comment in css
+    language: css
+    code: |
+      /* TODO: fix this */
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores normal html comment
+    language: html
+    code: |
+      <!-- normal comment -->
+    expect:
+      count: 0
+
+  - name: ignores normal css comment
+    language: css
+    code: |
+      /* normal comment */
+    expect:
+      count: 0
+
+  - name: triggers on TODO line comment in java
+    language: java
+    code: |
+      // TODO: remove before release
+      class App {}
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores java source without debug markers
+    language: java
+    code: |
+      class App {
+        int x = 1;
+      }
+    expect:
+      count: 0

package/rules/external/data-exposure/debug-artifacts.yaml

@@ -0,0 +1,57 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-489
+id: data-exposure.debug-artifacts
+severity: low
+category: data-exposure
+min-tier: pro
+languages: [javascript, typescript, tsx, python, bash, rust, java, ruby, html, css]
+
+copy:
+  name-key: checks.debug-artifacts.name
+  description-key: checks.debug-artifacts.description
+  message-key: checks.debug-artifacts.message
+  degraded-key: checks.debug-artifacts.degraded
+  remediation-key: remediation.data-exposure.debug-artifacts
+
+confidence: medium
+
+queries:
+  javascript: |
+    (debugger_statement) @match
+  typescript: |
+    (debugger_statement) @match
+  tsx: |
+    (debugger_statement) @match
+  python: |
+    (import_from_statement
+      module_name: (dotted_name) @mod
+      name: (dotted_name) @name
+      (#eq? @mod "pdb")) @match
+  bash: |
+    (command
+      name: (command_name (word) @cmd)
+      argument: (word) @arg
+      (#eq? @cmd "set")
+      (#match? @arg "^-(x|o\\s+xtrace)$")) @match
+  rust: |
+    (macro_invocation
+      macro: (identifier) @name
+      (#eq? @name "dbg")) @match
+  java: |
+    (line_comment) @match
+    (#match? @match "(TODO|FIXME|HACK|DEBUG)")
+  html: |
+    (comment) @match
+    (#match? @match "DEBUG|TODO|HACK|FIXME")
+  css: |
+    (comment) @match
+    (#match? @match "DEBUG|TODO|HACK|FIXME")
+  ruby: |
+    (call
+      method: (identifier) @method
+      (#match? @method "^(pry|debugger|byebug)$")) @match
+
+message-captures: [match]