seaworthycode 1.1.2 → 1.2.3

package/rules/external/data-exposure/hardcoded-ip.test.yaml

@@ -0,0 +1,131 @@
+rule-id: data-exposure.hardcoded-ip
+
+cases:
+  - name: triggers on hardcoded IP in javascript
+    language: javascript
+    code: |
+      const host = "192.168.1.1"
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on hardcoded IP in typescript
+    language: typescript
+    code: |
+      const host = "10.0.0.1"
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on hardcoded IP in tsx
+    language: tsx
+    code: |
+      const server = "172.16.0.1"
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on hardcoded IP in python
+    language: python
+    code: |
+      host = "10.0.0.1"
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on hardcoded IP in bash
+    language: bash
+    code: |
+      curl http://10.0.0.1:8080/health
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores non-IP string
+    language: javascript
+    code: |
+      const version = "1.2.3"
+    expect:
+      count: 0
+
+  - name: ignores non-IP string in typescript
+    language: typescript
+    code: |
+      const version = "1.2.3"
+    expect:
+      count: 0
+
+  - name: ignores safe code
+    language: python
+    code: |
+      host = "localhost"
+    expect:
+      count: 0
+
+  - name: ignores hostname in bash
+    language: bash
+    code: |
+      curl https://api.example.com
+    expect:
+      count: 0
+
+  - name: triggers on hardcoded IP in rust
+    language: rust
+    code: |
+      let host = "192.168.1.1"
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores hostname in rust
+    language: rust
+    code: |
+      let host = "localhost"
+    expect:
+      count: 0
+
+  - name: triggers on hardcoded IP in html attribute
+    language: html
+    code: |
+      <a href="http://192.168.1.1/api">Link</a>
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on hardcoded IP in css url
+    language: css
+    code: |
+      @import url("http://10.0.0.1/style.css");
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores html attribute without IP
+    language: html
+    code: |
+      <a href="https://example.com">Link</a>
+    expect:
+      count: 0
+
+  - name: ignores css url without IP
+    language: css
+    code: |
+      @import url("https://example.com/style.css");
+    expect:
+      count: 0
+
+  - name: triggers on hardcoded IP in java
+    language: java
+    code: |
+      class T { String host = "192.168.1.1"; }
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on hardcoded IP in ruby
+    language: ruby
+    code: |
+      host = "10.0.0.1"
+    expect:
+      count: 1
+      severity: low

package/rules/external/data-exposure/hardcoded-ip.yaml

@@ -0,0 +1,67 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-200
+id: data-exposure.hardcoded-ip
+severity: low
+category: data-exposure
+min-tier: pro
+languages: [javascript, typescript, tsx, python, bash, rust, java, html, css, ruby]
+
+copy:
+  name-key: checks.hardcoded-ip.name
+  description-key: checks.hardcoded-ip.description
+  message-key: checks.hardcoded-ip.message
+  degraded-key: checks.hardcoded-ip.degraded
+  remediation-key: remediation.data-exposure.hardcoded-ip
+
+confidence: low
+
+queries:
+  javascript: |
+    (string
+      (string_fragment) @ip
+      (#match? @ip "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}")) @match
+  typescript: |
+    (string
+      (string_fragment) @ip
+      (#match? @ip "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}")) @match
+  tsx: |
+    (string
+      (string_fragment) @ip
+      (#match? @ip "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}")) @match
+  python: |
+    (string
+      (string_content) @ip
+      (#match? @ip "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}")) @match
+  bash: |
+    [
+      ((word) @match
+        (#match? @match "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"))
+      (string
+        (string_content) @match
+        (#match? @match "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"))
+    ]
+  rust: |
+    (string_literal) @match
+    (#match? @match "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}")
+  html: |
+    (attribute
+      (quoted_attribute_value
+        (attribute_value) @match)
+      (#match? @match "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"))
+  css: |
+    (string_value) @match
+    (#match? @match "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}")
+  java: |
+    (string_literal
+      (string_fragment) @ip
+      (#match? @ip "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}")) @match
+
+  ruby: |
+    (string
+      (string_content) @ip
+      (#match? @ip "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}")) @match
+
+message-captures: [match]

package/rules/external/data-exposure/localstorage-sensitive-data.test.yaml

@@ -0,0 +1,58 @@
+rule-id: data-exposure.localstorage-sensitive-data
+
+cases:
+  - name: triggers on password in localStorage in javascript
+    language: javascript
+    code: |
+      localStorage.setItem('password', userPassword);
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on token in localStorage in typescript
+    language: typescript
+    code: |
+      localStorage.setItem('auth_token', token);
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on password in localStorage in tsx
+    language: tsx
+    code: |
+      export default function Settings() {
+        localStorage.setItem("password", key);
+        return <div />;
+      }
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores safe keys
+    language: javascript
+    code: |
+      localStorage.setItem('theme', 'dark');
+    expect:
+      count: 0
+
+  - name: ignores safe keys in typescript
+    language: typescript
+    code: |
+      localStorage.setItem('theme', 'dark');
+    expect:
+      count: 0
+
+  - name: triggers on password in localStorage in html script
+    language: html
+    code: |
+      <script>localStorage.setItem('password', userPassword);</script>
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores safe keys in html script
+    language: html
+    code: |
+      <script>localStorage.setItem('theme', 'dark');</script>
+    expect:
+      count: 0

package/rules/external/data-exposure/localstorage-sensitive-data.yaml

@@ -0,0 +1,60 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: andy
+# attribution: CWE-312
+id: data-exposure.localstorage-sensitive-data
+severity: medium
+category: data-exposure
+min-tier: pro
+languages: [javascript, typescript, tsx, html]
+
+copy:
+  name-key: checks.localstorage-sensitive-data.name
+  description-key: checks.localstorage-sensitive-data.description
+  message-key: checks.localstorage-sensitive-data.message
+  degraded-key: checks.localstorage-sensitive-data.degraded
+  remediation-key: remediation.data-exposure.localstorage-sensitive-data
+
+confidence: high
+
+queries:
+  javascript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        (string
+          (string_fragment) @key))
+      (#eq? @obj "localStorage")
+      (#eq? @method "setItem")
+      (#match? @key "(password|token|secret|api[_-]?key|auth)")) @match
+  typescript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        (string
+          (string_fragment) @key))
+      (#eq? @obj "localStorage")
+      (#eq? @method "setItem")
+      (#match? @key "(password|token|secret|api[_-]?key|auth)")) @match
+  tsx: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        (string
+          (string_fragment) @key))
+      (#eq? @obj "localStorage")
+      (#eq? @method "setItem")
+      (#match? @key "(password|token|secret|api[_-]?key|auth)")) @match
+  html: |
+    (script_element
+      (raw_text) @match
+      (#match? @match "localStorage\\.setItem.*(password|token|secret|api[_-]?key|auth)"))
+
+message-captures: [match]

package/rules/external/dependencies/deprecated-functions.test.yaml

@@ -0,0 +1,92 @@
+rule-id: dependencies.deprecated-functions
+
+cases:
+  - name: triggers on assert.equal in javascript
+    language: javascript
+    code: |
+      assert.equal(1, 2)
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on assert.equal in typescript
+    language: typescript
+    code: |
+      assert.equal(x, y)
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on assert.equal in tsx
+    language: tsx
+    code: |
+      assert.equal(data, expected)
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores assert.strictEqual
+    language: javascript
+    code: |
+      assert.strictEqual(1, 1)
+    expect:
+      count: 0
+
+  - name: ignores assert.strictEqual in typescript
+    language: typescript
+    code: |
+      assert.strictEqual(1, 1)
+    expect:
+      count: 0
+
+  - name: triggers on import of deprecated imp module in python
+    language: python
+    code: |
+      import imp
+    expect:
+      count: 1
+      severity: low
+  - name: triggers on import of deprecated cgi module in python
+    language: python
+    code: |
+      from cgi import parse_header
+    expect:
+      count: 1
+      severity: low
+  - name: ignores import of non-deprecated module in python
+    language: python
+    code: |
+      import json
+    expect:
+      count: 0
+
+  - name: triggers on deprecated try macro in rust
+    language: rust
+    code: |
+      let x = try!(foo());
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores normal function in rust
+    language: rust
+    code: |
+      fn new() {}
+    expect:
+      count: 0
+
+  - name: triggers on Thread.stop in java
+    language: java
+    code: |
+      class T { void f(Thread t) { t.stop(); } }
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on URI.escape in ruby
+    language: ruby
+    code: |
+      URI.escape("a b")
+    expect:
+      count: 1
+      severity: low

package/rules/external/dependencies/deprecated-functions.yaml

@@ -0,0 +1,66 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-477
+id: dependencies.deprecated-functions
+severity: low
+category: dependencies
+min-tier: pro
+languages: [javascript, typescript, tsx, python, rust, java, ruby]
+
+copy:
+  name-key: checks.deprecated-functions.name
+  description-key: checks.deprecated-functions.description
+  message-key: checks.deprecated-functions.message
+  degraded-key: checks.deprecated-functions.degraded
+  remediation-key: remediation.dependencies.deprecated-functions
+
+confidence: medium
+
+queries:
+  javascript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      (#eq? @obj "assert")
+      (#eq? @method "equal")) @match
+  typescript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      (#eq? @obj "assert")
+      (#eq? @method "equal")) @match
+  tsx: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      (#eq? @obj "assert")
+      (#eq? @method "equal")) @match
+  python: |
+    [
+      (import_statement
+        name: (dotted_name) @mod
+        (#match? @mod "^(imp|cgi)$"))
+      (import_from_statement
+        module_name: (dotted_name) @mod
+        (#match? @mod "^(imp|cgi)$"))
+    ] @match
+  rust: |
+    (macro_invocation
+      (identifier) @name
+      (#eq? @name "try")) @match
+  java: |
+    (method_invocation
+      name: (identifier) @method
+      (#eq? @method "stop")) @match
+
+  ruby: |
+    (call
+      receiver: (constant) @recv (#eq? @recv "URI")
+      method: (identifier) @method (#eq? @method "escape")) @match
+
+message-captures: [match]

package/rules/external/ops/hardcoded-port.test.yaml

@@ -0,0 +1,141 @@
+rule-id: ops.hardcoded-port
+
+cases:
+  - name: triggers on app.listen with literal port in javascript
+    language: javascript
+    code: |
+      app.listen(3000)
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on app.listen with literal port in typescript
+    language: typescript
+    code: |
+      app.listen(8080)
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on app.listen with literal port in tsx
+    language: tsx
+    code: |
+      app.listen(9000)
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores app.listen with environment variable
+    language: tsx
+    code: |
+      app.listen(process.env.PORT)
+    expect:
+      count: 0
+
+  - name: ignores unrelated listen
+    language: javascript
+    code: |
+      server.listen(3000)
+    expect:
+      count: 0
+
+  - name: ignores unrelated listen in typescript
+    language: typescript
+    code: |
+      server.listen(3000)
+    expect:
+      count: 0
+
+  - name: triggers on app.run with literal port in python
+    language: python
+    code: |
+      app.run(port=5000)
+    expect:
+      count: 1
+      severity: low
+  - name: triggers on hardcoded port in bash URL
+    language: bash
+    code: |
+      curl http://localhost:8080/health
+    expect:
+      count: 1
+      severity: low
+  - name: ignores app.run with env variable port in python
+    language: python
+    code: |
+      app.run(port=os.environ.get("PORT"))
+    expect:
+      count: 0
+  - name: ignores unrelated python call
+    language: python
+    code: |
+      print("hello")
+    expect:
+      count: 0
+  - name: ignores bash URL without explicit port
+    language: bash
+    code: |
+      curl https://example.com/health
+    expect:
+      count: 0
+
+  - name: triggers on hardcoded port in rust
+    language: rust
+    code: |
+      server.bind("127.0.0.1:8080")
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores bind without explicit port in rust
+    language: rust
+    code: |
+      server.bind("127.0.0.1")
+    expect:
+      count: 0
+
+  - name: triggers on hardcoded port in html attribute
+    language: html
+    code: |
+      <a href="http://localhost:8080/api">Link</a>
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on hardcoded port in css url
+    language: css
+    code: |
+      @import url("http://localhost:3000/style.css");
+    expect:
+      count: 1
+      severity: low
+
+  - name: ignores html attribute without explicit port
+    language: html
+    code: |
+      <a href="https://example.com">Link</a>
+    expect:
+      count: 0
+
+  - name: ignores css url without explicit port
+    language: css
+    code: |
+      @import url("https://example.com/style.css");
+    expect:
+      count: 0
+
+  - name: triggers on server.port in java properties string
+    language: java
+    code: |
+      class T { String p = "server.port=8080"; }
+    expect:
+      count: 1
+      severity: low
+
+  - name: triggers on hardcoded port in ruby URL string
+    language: ruby
+    code: |
+      url = "http://localhost:3000/api"
+    expect:
+      count: 1
+      severity: low

package/rules/external/ops/hardcoded-port.yaml

@@ -0,0 +1,91 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-779
+id: ops.hardcoded-port
+severity: low
+category: ops
+min-tier: pro
+languages: [javascript, typescript, tsx, python, bash, rust, java, html, css, ruby]
+
+copy:
+  name-key: checks.hardcoded-port.name
+  description-key: checks.hardcoded-port.description
+  message-key: checks.hardcoded-port.message
+  degraded-key: checks.hardcoded-port.degraded
+  remediation-key: remediation.ops.hardcoded-port
+
+confidence: low
+
+queries:
+  javascript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments (number))
+      (#eq? @obj "app")
+      (#eq? @method "listen")) @match
+  typescript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments (number))
+      (#eq? @obj "app")
+      (#eq? @method "listen")) @match
+  tsx: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments (number))
+      (#eq? @obj "app")
+      (#eq? @method "listen")) @match
+  python: |
+    (call
+      function: (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @method)
+      arguments: (argument_list
+        (keyword_argument
+          name: (identifier) @key
+          value: (integer) @val))
+      (#eq? @method "run")
+      (#eq? @key "port")) @match
+  bash: |
+    [
+      ((word) @match
+        (#match? @match ":(3000|5000|8000|8080|9000)(/|$)"))
+      (string
+        (string_content) @match
+        (#match? @match ":(3000|5000|8000|8080|9000)(/|$)"))
+    ]
+  rust: |
+    (call_expression
+      function: (field_expression
+        field: (field_identifier) @func
+        (#eq? @func "bind"))
+      arguments: (arguments
+        (string_literal) @addr
+        (#match? @addr ":[0-9]+"))) @match
+  html: |
+    (attribute
+      (quoted_attribute_value
+        (attribute_value) @match)
+      (#match? @match ":(3000|5000|8000|8080|9000)(/|$)"))
+  css: |
+    (string_value) @match
+    (#match? @match ":(3000|5000|8000|8080|9000)(/|$)")
+  java: |
+    (string_literal
+      (string_fragment) @match
+      (#match? @match "server\\.port=(3000|5000|8000|8080|9000)"))
+
+  ruby: |
+    (string
+      (string_content) @match
+      (#match? @match ":(3000|5000|8000|8080|9000)(/|$)"))
+
+message-captures: [match]