secure-scan 1.2.2

package/src/rules/vulnerabilities/rules/pathTraversal.ts

@@ -0,0 +1,358 @@
+/**
+ * @fileoverview Path Traversal Detection Rules
+ * @module rules/vulnerabilities/rules/pathTraversal
+ */
+
+import {
+  VulnerabilityRule,
+  VulnerabilityType,
+  VulnerabilityCategory,
+  VulnerabilitySeverity,
+  ConfidenceLevel,
+  SupportedLanguage,
+  PatternType
+} from '../types';
+import { OWASP_TOP_10_2021, CWE_REFERENCES } from '../constants';
+
+export const pathTraversalRules: VulnerabilityRule[] = [
+  {
+    id: 'VUL-PATH-001',
+    name: 'Path Traversal - Node.js fs with User Input',
+    description: 'Detects file system operations using unsanitized user input.',
+    version: '1.0.0',
+    vulnerabilityType: VulnerabilityType.PATH_TRAVERSAL,
+    category: VulnerabilityCategory.INJECTION,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: VulnerabilitySeverity.HIGH,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 80,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'path-fs-req',
+        pattern: '(?:fs\\.(?:readFile|writeFile|unlink|readdir|mkdir|rmdir|stat|access)|require\\s*\\()\\s*(?:Sync)?\\s*\\([^)]*(?:req\\.|params\\.|query\\.)',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'fs operation with request data'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'path-join-req',
+        pattern: 'path\\.(?:join|resolve)\\s*\\([^)]*(?:req\\.|params\\.|query\\.)',
+        flags: 'gi',
+        weight: 0.85,
+        description: 'path.join with user input'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'path-traversal-pattern',
+        pattern: '(?:\\.\\.\\/|\\.\\.\\.\\\\)',
+        flags: 'g',
+        weight: 0.70,
+        description: 'Literal path traversal pattern'
+      }
+    ],
+    taintAnalysis: {
+      sources: ['req.params', 'req.query', 'req.body', 'process.argv'],
+      sinks: ['fs.readFile', 'fs.writeFile', 'fs.createReadStream', 'fs.createWriteStream', 'require'],
+      sanitizers: ['path.basename', 'path.normalize', '.includes("..")', '.startsWith(allowedDir)']
+    },
+    impact: {
+      confidentiality: 'high',
+      integrity: 'medium',
+      availability: 'low',
+      technicalImpact: 'Read or write arbitrary files on the server.',
+      businessImpact: 'Sensitive data exposure, configuration disclosure, code execution via file overwrite.'
+    },
+    exploitability: {
+      attackVector: 'network',
+      attackComplexity: 'low',
+      privilegesRequired: 'none',
+      userInteraction: 'none'
+    },
+    remediation: {
+      summary: 'Validate file paths against allowed directories. Use path.basename() and verify the resolved path.',
+      steps: [
+        'Use path.basename() to extract filename only',
+        'Resolve the full path and verify it starts with allowed directory',
+        'Reject paths containing ".." or null bytes',
+        'Use chroot or sandboxed file access'
+      ],
+      secureCodeExample: `const path = require('path');
+const fs = require('fs');
+
+const ALLOWED_DIR = '/app/uploads';
+
+function readSafeFile(userPath) {
+  const filename = path.basename(userPath);
+  const fullPath = path.resolve(ALLOWED_DIR, filename);
+  
+  // Ensure path is within allowed directory
+  if (!fullPath.startsWith(ALLOWED_DIR)) {
+    throw new Error('Invalid path');
+  }
+  
+  return fs.readFileSync(fullPath);
+}`,
+      effort: 'medium',
+      priority: 'high'
+    },
+    standards: {
+      owasp: [OWASP_TOP_10_2021.A01],
+      cwe: [CWE_REFERENCES.CWE_22]
+    },
+    tags: ['path-traversal', 'lfi', 'file-access', 'nodejs'],
+    enabled: true
+  },
+  {
+    id: 'VUL-PATH-002',
+    name: 'Path Traversal - Python open() with User Input',
+    description: 'Detects Python file operations with user-controlled paths.',
+    version: '1.0.0',
+    vulnerabilityType: VulnerabilityType.PATH_TRAVERSAL,
+    category: VulnerabilityCategory.INJECTION,
+    languages: [SupportedLanguage.PYTHON],
+    severity: VulnerabilitySeverity.HIGH,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 80,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'path-python-open',
+        pattern: 'open\\s*\\([^)]*(?:request\\.|input\\(|sys\\.argv|f[\'"])',
+        flags: 'gi',
+        weight: 0.95,
+        description: 'open() with user input'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'path-python-pathlib',
+        pattern: 'Path\\s*\\([^)]*(?:request\\.|input\\()',
+        flags: 'gi',
+        weight: 0.90,
+        description: 'pathlib.Path with user input'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'path-python-send-file',
+        pattern: 'send_file\\s*\\([^)]*(?:request\\.|\\+)',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'Flask send_file with user input'
+      }
+    ],
+    taintAnalysis: {
+      sources: ['request.args', 'request.form', 'request.files', 'sys.argv', 'input()'],
+      sinks: ['open(', 'Path(', 'send_file(', 'send_from_directory('],
+      sanitizers: ['os.path.basename', 'secure_filename', 'Path.resolve().is_relative_to']
+    },
+    impact: {
+      confidentiality: 'high',
+      integrity: 'medium',
+      availability: 'low',
+      technicalImpact: 'Arbitrary file read/write access.',
+      businessImpact: 'Data breach, source code disclosure.'
+    },
+    exploitability: {
+      attackVector: 'network',
+      attackComplexity: 'low',
+      privilegesRequired: 'none',
+      userInteraction: 'none'
+    },
+    remediation: {
+      summary: 'Use os.path.basename() or werkzeug.secure_filename(). Validate resolved paths.',
+      steps: [
+        'Extract basename from user input',
+        'Use secure_filename() for uploads',
+        'Verify resolved path is within allowed directory',
+        'Use pathlib for safer path operations'
+      ],
+      secureCodeExample: `from pathlib import Path
+from werkzeug.utils import secure_filename
+
+UPLOAD_DIR = Path('/app/uploads')
+
+def read_safe_file(user_path: str) -> bytes:
+    filename = secure_filename(user_path)
+    full_path = (UPLOAD_DIR / filename).resolve()
+    
+    if not full_path.is_relative_to(UPLOAD_DIR):
+        raise ValueError('Invalid path')
+    
+    return full_path.read_bytes()`,
+      effort: 'low',
+      priority: 'high'
+    },
+    standards: {
+      owasp: [OWASP_TOP_10_2021.A01],
+      cwe: [CWE_REFERENCES.CWE_22]
+    },
+    tags: ['path-traversal', 'python', 'file-access'],
+    enabled: true
+  },
+  {
+    id: 'VUL-PATH-003',
+    name: 'Path Traversal - PHP file_get_contents/include',
+    description: 'Detects PHP file operations with user-controlled paths (LFI/RFI).',
+    version: '1.0.0',
+    vulnerabilityType: VulnerabilityType.PATH_TRAVERSAL,
+    category: VulnerabilityCategory.INJECTION,
+    languages: [SupportedLanguage.PHP],
+    severity: VulnerabilitySeverity.CRITICAL,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 90,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'path-php-include',
+        pattern: '(?:include|require)(?:_once)?\\s*\\(?\\s*\\$_(?:GET|POST|REQUEST)',
+        flags: 'gi',
+        weight: 1.0,
+        description: 'include/require with superglobal'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'path-php-file-get',
+        pattern: 'file_get_contents\\s*\\([^)]*\\$_(?:GET|POST|REQUEST)',
+        flags: 'gi',
+        weight: 0.95,
+        description: 'file_get_contents with user input'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'path-php-fopen',
+        pattern: 'fopen\\s*\\([^)]*\\$_(?:GET|POST|REQUEST)',
+        flags: 'gi',
+        weight: 0.95,
+        description: 'fopen with user input'
+      }
+    ],
+    impact: {
+      confidentiality: 'high',
+      integrity: 'high',
+      availability: 'medium',
+      technicalImpact: 'LFI can lead to RCE via log poisoning or wrapper exploitation. RFI allows direct code execution.',
+      businessImpact: 'Complete server compromise.'
+    },
+    exploitability: {
+      attackVector: 'network',
+      attackComplexity: 'low',
+      privilegesRequired: 'none',
+      userInteraction: 'none',
+      knownExploits: true
+    },
+    remediation: {
+      summary: 'Never include files based on user input. Use allowlist and basename().',
+      steps: [
+        'Use allowlist of permitted files',
+        'Use basename() to strip directory components',
+        'Disable allow_url_include in php.ini',
+        'Use realpath() and verify prefix'
+      ],
+      secureCodeExample: `<?php
+$allowed_pages = ['home', 'about', 'contact'];
+$page = basename($_GET['page'] ?? 'home');
+
+if (!in_array($page, $allowed_pages, true)) {
+    $page = 'home';
+}
+
+include __DIR__ . '/pages/' . $page . '.php';
+?>`,
+      effort: 'medium',
+      priority: 'immediate'
+    },
+    standards: {
+      owasp: [OWASP_TOP_10_2021.A01, OWASP_TOP_10_2021.A03],
+      cwe: [CWE_REFERENCES.CWE_22, CWE_REFERENCES.CWE_98]
+    },
+    tags: ['path-traversal', 'lfi', 'rfi', 'php', 'critical'],
+    enabled: true
+  },
+  {
+    id: 'VUL-PATH-004',
+    name: 'Path Traversal - Java File/Path with User Input',
+    description: 'Detects Java file operations with user-controlled paths.',
+    version: '1.0.0',
+    vulnerabilityType: VulnerabilityType.PATH_TRAVERSAL,
+    category: VulnerabilityCategory.INJECTION,
+    languages: [SupportedLanguage.JAVA],
+    severity: VulnerabilitySeverity.HIGH,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 80,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'path-java-new-file',
+        pattern: 'new\\s+File\\s*\\([^)]*(?:request\\.getParameter|\\+)',
+        flags: 'gi',
+        weight: 0.95,
+        description: 'new File with user input'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'path-java-paths-get',
+        pattern: 'Paths\\.get\\s*\\([^)]*(?:request\\.getParameter|\\+)',
+        flags: 'gi',
+        weight: 0.95,
+        description: 'Paths.get with user input'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'path-java-fileinputstream',
+        pattern: 'new\\s+FileInputStream\\s*\\([^)]*(?:request|\\+)',
+        flags: 'gi',
+        weight: 0.90,
+        description: 'FileInputStream with dynamic path'
+      }
+    ],
+    impact: {
+      confidentiality: 'high',
+      integrity: 'medium',
+      availability: 'low',
+      technicalImpact: 'Read or write files outside intended directory.',
+      businessImpact: 'Data disclosure, configuration exposure.'
+    },
+    exploitability: {
+      attackVector: 'network',
+      attackComplexity: 'low',
+      privilegesRequired: 'none',
+      userInteraction: 'none'
+    },
+    remediation: {
+      summary: 'Use Path.normalize() and verify canonical path starts with allowed directory.',
+      steps: [
+        'Normalize the path using Path.normalize()',
+        'Get canonical path and verify it starts with base directory',
+        'Use FilenameUtils.getName() for basename extraction',
+        'Implement file access through a secure abstraction layer'
+      ],
+      secureCodeExample: `import java.nio.file.Path;
+import java.nio.file.Paths;
+
+public class SecureFileAccess {
+    private static final Path BASE_DIR = Paths.get("/app/uploads").toAbsolutePath();
+    
+    public Path resolvePath(String userInput) throws SecurityException {
+        Path resolved = BASE_DIR.resolve(userInput).normalize().toAbsolutePath();
+        
+        if (!resolved.startsWith(BASE_DIR)) {
+            throw new SecurityException("Path traversal attempt detected");
+        }
+        
+        return resolved;
+    }
+}`,
+      effort: 'medium',
+      priority: 'high'
+    },
+    standards: {
+      owasp: [OWASP_TOP_10_2021.A01],
+      cwe: [CWE_REFERENCES.CWE_22]
+    },
+    tags: ['path-traversal', 'java', 'file-access'],
+    enabled: true
+  }
+];
+
+export default pathTraversalRules;

package/src/rules/vulnerabilities/rules/prototypePollution.ts

@@ -0,0 +1,279 @@
+/**
+ * @fileoverview Prototype Pollution Detection Rules
+ * @module rules/vulnerabilities/rules/prototypePollution
+ */
+
+import {
+  VulnerabilityRule,
+  VulnerabilityType,
+  VulnerabilityCategory,
+  VulnerabilitySeverity,
+  ConfidenceLevel,
+  SupportedLanguage,
+  PatternType
+} from '../types';
+import { OWASP_TOP_10_2021, CWE_REFERENCES } from '../constants';
+
+export const prototypePollutionRules: VulnerabilityRule[] = [
+  {
+    id: 'VUL-PROTO-001',
+    name: 'Prototype Pollution - Unsafe Object Merge',
+    description: 'Detects unsafe object merging that may lead to prototype pollution.',
+    version: '1.0.0',
+    vulnerabilityType: VulnerabilityType.PROTOTYPE_POLLUTION,
+    category: VulnerabilityCategory.INJECTION,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: VulnerabilitySeverity.HIGH,
+    confidence: ConfidenceLevel.MEDIUM,
+    baseScore: 75,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'proto-object-assign-req',
+        pattern: 'Object\\.assign\\s*\\([^,]*,\\s*(?:req\\.|body|params|query)',
+        flags: 'gi',
+        weight: 0.90,
+        description: 'Object.assign with user input'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'proto-spread-req',
+        pattern: '\\{\\s*\\.\\.\\.(?:req\\.|body|params)',
+        flags: 'gi',
+        weight: 0.85,
+        description: 'Spread operator with user input'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'proto-lodash-merge',
+        pattern: '(?:_|lodash)\\.(?:merge|defaultsDeep|set)\\s*\\([^)]*(?:req\\.|body)',
+        flags: 'gi',
+        weight: 0.95,
+        description: 'lodash merge/set with user input'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'proto-bracket-proto',
+        pattern: '\\[[\'"]__proto__[\'"]\\]|\\[[\'"]constructor[\'"]\\]\\s*\\[[\'"]prototype[\'"]\\]',
+        flags: 'g',
+        weight: 1.0,
+        description: 'Direct __proto__ or constructor.prototype access'
+      }
+    ],
+    taintAnalysis: {
+      sources: ['req.body', 'req.query', 'req.params', 'JSON.parse'],
+      sinks: ['Object.assign', 'Object.defineProperty', '_.merge', '_.set', '_.defaultsDeep'],
+      sanitizers: ['Object.create(null)', 'Object.freeze', 'hasOwnProperty']
+    },
+    impact: {
+      confidentiality: 'medium',
+      integrity: 'high',
+      availability: 'medium',
+      technicalImpact: 'Modify Object.prototype properties affecting all objects. May lead to RCE.',
+      businessImpact: 'Denial of service, authentication bypass, RCE in some cases.'
+    },
+    exploitability: {
+      attackVector: 'network',
+      attackComplexity: 'medium',
+      privilegesRequired: 'none',
+      userInteraction: 'none',
+      knownExploits: true
+    },
+    remediation: {
+      summary: 'Validate object keys. Use Object.create(null) for dictionaries. Block __proto__ keys.',
+      steps: [
+        'Filter __proto__, constructor, prototype from user input',
+        'Use Object.create(null) for user-controlled objects',
+        'Freeze prototypes if possible',
+        'Update vulnerable libraries (lodash < 4.17.12)',
+        'Use Map instead of plain objects for dictionaries'
+      ],
+      secureCodeExample: `// Filter dangerous keys
+function safeMerge(target, source) {
+  const dangerous = ['__proto__', 'constructor', 'prototype'];
+  
+  for (const key of Object.keys(source)) {
+    if (dangerous.includes(key)) continue;
+    if (typeof source[key] === 'object' && source[key] !== null) {
+      target[key] = safeMerge(target[key] || {}, source[key]);
+    } else {
+      target[key] = source[key];
+    }
+  }
+  return target;
+}
+
+// Use Map for user-controlled data
+const userSettings = new Map();
+userSettings.set(req.body.key, req.body.value);
+
+// Use Object.create(null)
+const dict = Object.create(null);
+dict[userKey] = userValue;`,
+      effort: 'medium',
+      priority: 'high'
+    },
+    standards: {
+      owasp: [OWASP_TOP_10_2021.A03],
+      cwe: [CWE_REFERENCES.CWE_1321]
+    },
+    tags: ['prototype-pollution', 'javascript', 'injection'],
+    enabled: true
+  },
+  {
+    id: 'VUL-PROTO-002',
+    name: 'Prototype Pollution - JSON.parse with Reviver',
+    description: 'Detects potentially unsafe JSON parsing patterns.',
+    version: '1.0.0',
+    vulnerabilityType: VulnerabilityType.PROTOTYPE_POLLUTION,
+    category: VulnerabilityCategory.INJECTION,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: VulnerabilitySeverity.MEDIUM,
+    confidence: ConfidenceLevel.LOW,
+    baseScore: 50,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'proto-json-parse-body',
+        pattern: 'JSON\\.parse\\s*\\([^)]*(?:req\\.body|body|data)',
+        flags: 'gi',
+        weight: 0.70,
+        description: 'JSON.parse on user data'
+      }
+    ],
+    impact: {
+      confidentiality: 'low',
+      integrity: 'medium',
+      availability: 'low',
+      technicalImpact: 'Parsed JSON with __proto__ key can pollute prototypes.',
+      businessImpact: 'Application behavior modification.'
+    },
+    exploitability: {
+      attackVector: 'network',
+      attackComplexity: 'medium',
+      privilegesRequired: 'none',
+      userInteraction: 'none'
+    },
+    remediation: {
+      summary: 'Use JSON.parse with a reviver that filters dangerous keys.',
+      steps: [
+        'Use reviver function to filter dangerous keys',
+        'Validate parsed object structure',
+        'Consider using schema validation libraries'
+      ],
+      secureCodeExample: `// Safe JSON parsing with reviver
+function safeJsonParse(str) {
+  return JSON.parse(str, (key, value) => {
+    if (key === '__proto__' || key === 'constructor') {
+      return undefined;
+    }
+    return value;
+  });
+}
+
+// With schema validation (e.g., Zod)
+import { z } from 'zod';
+const UserSchema = z.object({
+  name: z.string(),
+  email: z.string().email()
+});
+
+const userData = UserSchema.parse(JSON.parse(req.body));`,
+      effort: 'low',
+      priority: 'medium'
+    },
+    standards: {
+      owasp: [OWASP_TOP_10_2021.A03],
+      cwe: [CWE_REFERENCES.CWE_1321]
+    },
+    tags: ['prototype-pollution', 'json', 'javascript'],
+    enabled: true
+  },
+  {
+    id: 'VUL-PROTO-003',
+    name: 'Prototype Pollution - Vulnerable Package Usage',
+    description: 'Detects usage of packages known to have prototype pollution vulnerabilities.',
+    version: '1.0.0',
+    vulnerabilityType: VulnerabilityType.PROTOTYPE_POLLUTION,
+    category: VulnerabilityCategory.KNOWN_VULNERABLE_COMPONENT,
+    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
+    severity: VulnerabilitySeverity.HIGH,
+    confidence: ConfidenceLevel.HIGH,
+    baseScore: 70,
+    patterns: [
+      {
+        type: PatternType.REGEX,
+        patternId: 'proto-vulnerable-qs',
+        pattern: 'require\\s*\\([\'"]qs[\'"]\\)',
+        flags: 'g',
+        weight: 0.70,
+        description: 'qs package (check version for CVE-2022-24999)'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'proto-vulnerable-flat',
+        pattern: 'require\\s*\\([\'"]flat[\'"]\\)',
+        flags: 'g',
+        weight: 0.80,
+        description: 'flat package (vulnerable < 5.0.1)'
+      },
+      {
+        type: PatternType.REGEX,
+        patternId: 'proto-vulnerable-merge',
+        pattern: 'require\\s*\\([\'"](?:deepmerge|deep-extend|merge-deep)[\'"]\\)',
+        flags: 'g',
+        weight: 0.75,
+        description: 'Deep merge packages (verify versions)'
+      }
+    ],
+    impact: {
+      confidentiality: 'medium',
+      integrity: 'high',
+      availability: 'medium',
+      technicalImpact: 'Known vulnerabilities in dependencies allow prototype pollution.',
+      businessImpact: 'Exploitation via known CVEs.'
+    },
+    exploitability: {
+      attackVector: 'network',
+      attackComplexity: 'low',
+      privilegesRequired: 'none',
+      userInteraction: 'none',
+      knownExploits: true
+    },
+    remediation: {
+      summary: 'Update vulnerable packages to patched versions.',
+      steps: [
+        'Run npm audit or yarn audit',
+        'Update lodash to >= 4.17.21',
+        'Update qs to >= 6.10.3',
+        'Update flat to >= 5.0.1',
+        'Consider alternative packages without vulnerabilities'
+      ],
+      secureCodeExample: `// Update packages in package.json
+{
+  "dependencies": {
+    "lodash": "^4.17.21",
+    "qs": "^6.11.0",
+    "flat": "^5.0.2"
+  }
+}
+
+// Or use native alternatives
+// Instead of lodash.merge:
+const merged = { ...defaults, ...userOptions };
+
+// Instead of qs:
+const params = new URLSearchParams(queryString);`,
+      effort: 'low',
+      priority: 'high'
+    },
+    standards: {
+      owasp: [OWASP_TOP_10_2021.A06],
+      cwe: [CWE_REFERENCES.CWE_1321]
+    },
+    tags: ['prototype-pollution', 'dependencies', 'npm'],
+    enabled: true
+  }
+];
+
+export default prototypePollutionRules;