secure-scan 1.2.2

package/src/types/index.ts

@@ -0,0 +1,391 @@
+/**
+ * Tipos principales para Secure-Scan SAST
+ * Definiciones de tipos para análisis de seguridad
+ */
+
+/**
+ * Lenguajes de programación soportados para análisis
+ */
+export type SupportedLanguage = 
+  | 'javascript'
+  | 'typescript'
+  | 'python'
+  | 'php'
+  | 'java'
+  | 'c'
+  | 'cpp'
+  | 'csharp'
+  | 'dockerfile'
+  | 'yaml'
+  | 'terraform';
+
+/**
+ * Severity levels for findings
+ */
+export enum Severity {
+  INFO = 'info',
+  LOW = 'low',
+  MEDIUM = 'medium',
+  HIGH = 'high',
+  CRITICAL = 'critical'
+}
+
+/**
+ * Security standard references
+ */
+export interface SecurityStandard {
+  /** Standard name (OWASP, CWE, MITRE, SANS) */
+  name: 'OWASP' | 'CWE' | 'MITRE' | 'SANS';
+  /** Standard ID (e.g., CWE-79, A01:2021) */
+  id: string;
+  /** Standard title */
+  title: string;
+  /** Standard description */
+  description: string;
+  /** URL to standard documentation */
+  url?: string;
+}
+
+/**
+ * Type of threat detected
+ */
+export enum ThreatType {
+  // Vulnerabilities
+  SQL_INJECTION = 'sql_injection',
+  COMMAND_INJECTION = 'command_injection',
+  XSS = 'xss',
+  CSRF = 'csrf',
+  INSECURE_DESERIALIZATION = 'insecure_deserialization',
+  HARDCODED_CREDENTIALS = 'hardcoded_credentials',
+  PATH_TRAVERSAL = 'path_traversal',
+  LDAP_INJECTION = 'ldap_injection',
+  INSECURE_CRYPTO = 'insecure_crypto',
+  WEAK_RANDOM = 'weak_random',
+  DANGEROUS_FUNCTION = 'dangerous_function',
+  VULNERABLE_DEPENDENCY = 'vulnerable_dependency',
+  INFORMATION_DISCLOSURE = 'information_disclosure',
+  BROKEN_ACCESS_CONTROL = 'broken_access_control',
+  SECURITY_MISCONFIGURATION = 'security_misconfiguration',
+  
+  // Malware
+  BACKDOOR = 'backdoor',
+  KEYLOGGER = 'keylogger',
+  CRYPTOMINER = 'cryptominer',
+  OBFUSCATED_CODE = 'obfuscated_code',
+  EMBEDDED_PAYLOAD = 'embedded_payload',
+  REVERSE_SHELL = 'reverse_shell',
+  DATA_EXFILTRATION = 'data_exfiltration',
+  SUSPICIOUS_NETWORK = 'suspicious_network',
+  MALICIOUS_LOADER = 'malicious_loader'
+}
+
+/**
+ * Category of finding
+ */
+export enum FindingCategory {
+  VULNERABILITY = 'vulnerability',
+  MALWARE = 'malware',
+  CODE_SMELL = 'code_smell',
+  BEST_PRACTICE = 'best_practice'
+}
+
+/**
+ * Source location in code
+ */
+export interface SourceLocation {
+  /** File path relative to project root */
+  file: string;
+  /** Start line number (1-indexed) */
+  startLine: number;
+  /** End line number (1-indexed) */
+  endLine: number;
+  /** Start column (optional) */
+  startColumn?: number;
+  /** End column (optional) */
+  endColumn?: number;
+}
+
+/**
+ * Code snippet with context
+ */
+export interface CodeSnippet {
+  /** The vulnerable/malicious code */
+  code: string;
+  /** Lines before for context */
+  contextBefore?: string;
+  /** Lines after for context */
+  contextAfter?: string;
+  /** Highlighted portion */
+  highlight?: {
+    start: number;
+    end: number;
+  };
+}
+
+/**
+ * Security finding from analysis
+ */
+export interface Finding {
+  /** Unique finding ID */
+  id: string;
+  /** Finding title */
+  title: string;
+  /** Detailed description */
+  description: string;
+  /** Severity level */
+  severity: Severity;
+  /** Type of threat */
+  threatType: ThreatType;
+  /** Category of finding */
+  category: FindingCategory;
+  /** Source location */
+  location: SourceLocation;
+  /** Code snippet */
+  snippet: CodeSnippet;
+  /** Related security standards */
+  standards: SecurityStandard[];
+  /** Remediation advice */
+  remediation: string;
+  /** Confidence level (0-100) */
+  confidence: number;
+  /** Detected by which analyzer */
+  analyzer: string;
+  /** Detection timestamp */
+  timestamp: Date;
+  /** Tags for categorization */
+  tags: string[];
+  /** AI-generated explanation (if available) */
+  aiExplanation?: string;
+  /** Suggested fix (if available) */
+  suggestedFix?: string;
+}
+
+/**
+ * File information for scanning
+ */
+export interface ScannedFile {
+  /** Absolute file path */
+  absolutePath: string;
+  /** Relative path from project root */
+  relativePath: string;
+  /** File extension */
+  extension: string;
+  /** Detected language */
+  language: SupportedLanguage | null;
+  /** File size in bytes */
+  size: number;
+  /** File content */
+  content: string;
+  /** Line count */
+  lineCount: number;
+  /** SHA256 hash of content */
+  hash: string;
+}
+
+/**
+ * Scan statistics
+ */
+export interface ScanStats {
+  /** Total files scanned */
+  totalFiles: number;
+  /** Total lines of code */
+  totalLines: number;
+  /** Files by language */
+  filesByLanguage: Record<string, number>;
+  /** Findings by severity */
+  findingsBySeverity: Record<Severity, number>;
+  /** Findings by category */
+  findingsByCategory: Record<FindingCategory, number>;
+  /** Scan duration in milliseconds */
+  duration: number;
+  /** Scan start time */
+  startTime: Date;
+  /** Scan end time */
+  endTime: Date;
+}
+
+/**
+ * Complete scan result
+ */
+export interface ScanResult {
+  /** Project path */
+  projectPath: string;
+  /** Project name */
+  projectName: string;
+  /** Scan ID */
+  scanId: string;
+  /** All findings */
+  findings: Finding[];
+  /** Scan statistics */
+  stats: ScanStats;
+  /** Risk score (0-100) */
+  riskScore: number;
+  /** Risk level */
+  riskLevel: 'safe' | 'low' | 'medium' | 'high' | 'critical';
+  /** Scanned files */
+  scannedFiles: ScannedFile[];
+  /** Configuration used */
+  config: ScanConfig;
+}
+
+/**
+ * Scan configuration
+ */
+export interface ScanConfig {
+  /** Project path to scan */
+  projectPath: string;
+  /** Output file path */
+  outputPath?: string;
+  /** Languages to analyze */
+  languages?: SupportedLanguage[];
+  /** Patterns to exclude */
+  exclude?: string[];
+  /** Minimum severity to report */
+  minSeverity?: Severity;
+  /** Enable AI analysis */
+  useAI?: boolean;
+  /** AI provider configuration */
+  aiConfig?: AIConfig;
+  /** Verbose output */
+  verbose?: boolean;
+  /** Custom rules */
+  customRules?: string[];
+  /** Disabled rules */
+  disabledRules?: string[];
+  /** Maximum file size to scan (bytes) */
+  maxFileSize?: number;
+  /** Timeout per file (ms) */
+  fileTimeout?: number;
+  /** Report language (es = Spanish, en = English) */
+  language?: 'es' | 'en';
+}
+
+/**
+ * AI configuration
+ */
+export interface AIConfig {
+  /** AI provider (auto-detected if not specified) */
+  provider: 'openai' | 'anthropic' | 'google' | 'gemini' | 'local' | 'auto';
+  /** API key */
+  apiKey?: string;
+  /** Model to use */
+  model?: string;
+  /** API endpoint (for local models) */
+  endpoint?: string;
+  /** Max tokens per request */
+  maxTokens?: number;
+  /** Temperature for generation */
+  temperature?: number;
+  /** Performance options for local models */
+  performance?: LocalAIPerformanceConfig;
+}
+
+/**
+ * Performance configuration for local AI models
+ */
+export interface LocalAIPerformanceConfig {
+  /** Number of parallel requests (default: 1) */
+  parallelRequests?: number;
+  /** Number of GPU layers to use (-1 for all, 0 for CPU only) */
+  numGpuLayers?: number;
+  /** Number of threads to use (default: auto) */
+  numThreads?: number;
+  /** Context size in tokens (default: 4096) */
+  contextSize?: number;
+  /** Batch size for processing (default: 512) */
+  batchSize?: number;
+  /** Enable result caching */
+  enableCache?: boolean;
+  /** Use mmap for model loading */
+  useMmap?: boolean;
+  /** Use mlock to keep model in memory */
+  useMlock?: boolean;
+  /** Timeout per request in milliseconds (default: 120000) */
+  timeout?: number;
+}
+
+/**
+ * Rule definition for detection
+ */
+export interface Rule {
+  /** Unique rule ID */
+  id: string;
+  /** Rule name */
+  name: string;
+  /** Rule description */
+  description: string;
+  /** Languages this rule applies to */
+  languages: SupportedLanguage[];
+  /** Threat type this rule detects */
+  threatType: ThreatType;
+  /** Category */
+  category: FindingCategory;
+  /** Default severity */
+  severity: Severity;
+  /** Related standards */
+  standards: SecurityStandard[];
+  /** Detection patterns */
+  patterns: RulePattern[];
+  /** Remediation template */
+  remediation: string;
+  /** Is rule enabled by default */
+  enabled: boolean;
+  /** Tags */
+  tags: string[];
+}
+
+/**
+ * Pattern for rule matching
+ */
+export interface RulePattern {
+  /** Pattern type */
+  type: 'regex' | 'ast' | 'semantic';
+  /** Pattern value */
+  pattern: string;
+  /** Pattern flags */
+  flags?: string;
+  /** Additional conditions */
+  conditions?: PatternCondition[];
+}
+
+/**
+ * Condition for pattern matching
+ */
+export interface PatternCondition {
+  /** Condition type */
+  type: 'context' | 'scope' | 'dataflow';
+  /** Condition value */
+  value: string;
+  /** Is negated */
+  negated?: boolean;
+}
+
+/**
+ * Analyzer plugin interface
+ */
+export interface Analyzer {
+  /** Analyzer name */
+  name: string;
+  /** Supported languages */
+  languages: SupportedLanguage[];
+  /** Analyzer version */
+  version: string;
+  /** Initialize analyzer */
+  initialize(): Promise<void>;
+  /** Analyze a file */
+  analyze(file: ScannedFile, rules: Rule[]): Promise<Finding[]>;
+  /** Cleanup resources */
+  cleanup(): Promise<void>;
+}
+
+/**
+ * Report generator interface
+ */
+export interface ReportGenerator {
+  /** Generator name */
+  name: string;
+  /** Output format */
+  format: 'html' | 'json' | 'pdf' | 'sarif';
+  /** Generate report */
+  generate(result: ScanResult): Promise<string>;
+}

package/src/utils/index.ts

@@ -0,0 +1,306 @@
+/**
+ * Utility Functions for Secure-Scan
+ */
+
+import * as crypto from 'crypto';
+import * as path from 'path';
+import { SupportedLanguage, Severity } from '../types';
+
+/**
+ * Generate a unique ID
+ */
+export function generateId(): string {
+  return `SS-${Date.now().toString(36)}-${crypto.randomBytes(4).toString('hex')}`;
+}
+
+/**
+ * Calculate SHA256 hash of content
+ */
+export function calculateHash(content: string): string {
+  return crypto.createHash('sha256').update(content).digest('hex');
+}
+
+/**
+ * Get language from file extension
+ */
+export function getLanguageFromExtension(filePath: string): SupportedLanguage | null {
+  const ext = path.extname(filePath).toLowerCase();
+  
+  const extensionMap: Record<string, SupportedLanguage> = {
+    '.js': 'javascript',
+    '.jsx': 'javascript',
+    '.mjs': 'javascript',
+    '.cjs': 'javascript',
+    '.ts': 'typescript',
+    '.tsx': 'typescript',
+    '.py': 'python',
+    '.pyw': 'python',
+    '.php': 'php',
+    '.phtml': 'php',
+    '.php3': 'php',
+    '.php4': 'php',
+    '.php5': 'php',
+    '.java': 'java',
+    '.c': 'c',
+    '.h': 'c',
+    '.cpp': 'cpp',
+    '.cc': 'cpp',
+    '.cxx': 'cpp',
+    '.hpp': 'cpp',
+    '.hxx': 'cpp',
+    '.cs': 'csharp',
+    '.dockerfile': 'dockerfile',
+    '.yaml': 'yaml',
+    '.yml': 'yaml',
+    '.tf': 'terraform',
+    '.tfvars': 'terraform'
+  };
+
+  // Check for Dockerfile without extension
+  if (path.basename(filePath).toLowerCase() === 'dockerfile') {
+    return 'dockerfile';
+  }
+
+  return extensionMap[ext] || null;
+}
+
+/**
+ * Check if file should be excluded
+ */
+export function shouldExclude(filePath: string, excludePatterns: string[]): boolean {
+  const normalizedPath = filePath.replace(/\\/g, '/');
+  
+  const defaultExcludes = [
+    'node_modules',
+    'vendor',
+    '.git',
+    'dist',
+    'build',
+    'out',
+    '__pycache__',
+    '.venv',
+    'venv',
+    '.env',
+    'coverage',
+    '.nyc_output',
+    '.next',
+    '.nuxt'
+  ];
+
+  const allExcludes = [...defaultExcludes, ...excludePatterns];
+
+  return allExcludes.some(pattern => {
+    // Simple pattern matching
+    if (normalizedPath.includes(`/${pattern}/`) || 
+        normalizedPath.includes(`/${pattern}`) ||
+        normalizedPath.startsWith(`${pattern}/`)) {
+      return true;
+    }
+    return false;
+  });
+}
+
+/**
+ * Get file extension for syntax highlighting
+ */
+export function getHighlightLanguage(language: SupportedLanguage | null): string {
+  const highlightMap: Record<SupportedLanguage, string> = {
+    'javascript': 'javascript',
+    'typescript': 'typescript',
+    'python': 'python',
+    'php': 'php',
+    'java': 'java',
+    'c': 'c',
+    'cpp': 'cpp',
+    'csharp': 'csharp',
+    'dockerfile': 'dockerfile',
+    'yaml': 'yaml',
+    'terraform': 'hcl'
+  };
+
+  return language ? highlightMap[language] : 'plaintext';
+}
+
+/**
+ * Extract code context around a line
+ */
+export function extractCodeContext(
+  content: string,
+  lineNumber: number,
+  contextLines: number = 3
+): { code: string; contextBefore: string; contextAfter: string } {
+  const lines = content.split('\n');
+  const targetLine = lineNumber - 1; // Convert to 0-indexed
+
+  const startBefore = Math.max(0, targetLine - contextLines);
+  const endAfter = Math.min(lines.length, targetLine + contextLines + 1);
+
+  const contextBefore = lines.slice(startBefore, targetLine).join('\n');
+  const code = lines[targetLine] || '';
+  const contextAfter = lines.slice(targetLine + 1, endAfter).join('\n');
+
+  return { code, contextBefore, contextAfter };
+}
+
+/**
+ * Count lines in content
+ */
+export function countLines(content: string): number {
+  return content.split('\n').length;
+}
+
+/**
+ * Severity to numeric value for comparison
+ */
+export function severityToNumber(severity: Severity): number {
+  const map: Record<Severity, number> = {
+    [Severity.INFO]: 0,
+    [Severity.LOW]: 1,
+    [Severity.MEDIUM]: 2,
+    [Severity.HIGH]: 3,
+    [Severity.CRITICAL]: 4
+  };
+  return map[severity];
+}
+
+/**
+ * Compare severities
+ */
+export function isHigherOrEqualSeverity(a: Severity, b: Severity): boolean {
+  return severityToNumber(a) >= severityToNumber(b);
+}
+
+/**
+ * Get severity color for reporting
+ */
+export function getSeverityColor(severity: Severity): string {
+  const colors: Record<Severity, string> = {
+    [Severity.INFO]: '#17a2b8',
+    [Severity.LOW]: '#28a745',
+    [Severity.MEDIUM]: '#ffc107',
+    [Severity.HIGH]: '#fd7e14',
+    [Severity.CRITICAL]: '#dc3545'
+  };
+  return colors[severity];
+}
+
+/**
+ * Get severity badge class
+ */
+export function getSeverityBadge(severity: Severity): string {
+  const badges: Record<Severity, string> = {
+    [Severity.INFO]: 'badge-info',
+    [Severity.LOW]: 'badge-success',
+    [Severity.MEDIUM]: 'badge-warning',
+    [Severity.HIGH]: 'badge-orange',
+    [Severity.CRITICAL]: 'badge-danger'
+  };
+  return badges[severity];
+}
+
+/**
+ * Format duration for display
+ */
+export function formatDuration(ms: number): string {
+  if (ms < 1000) {
+    return `${ms}ms`;
+  }
+  if (ms < 60000) {
+    return `${(ms / 1000).toFixed(2)}s`;
+  }
+  const minutes = Math.floor(ms / 60000);
+  const seconds = ((ms % 60000) / 1000).toFixed(0);
+  return `${minutes}m ${seconds}s`;
+}
+
+/**
+ * Escape HTML for safe display
+ */
+export function escapeHtml(text: string): string {
+  const escapeMap: Record<string, string> = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#039;'
+  };
+  return text.replace(/[&<>"']/g, char => escapeMap[char]);
+}
+
+/**
+ * Truncate text with ellipsis
+ */
+export function truncate(text: string, maxLength: number): string {
+  if (text.length <= maxLength) return text;
+  return text.substring(0, maxLength - 3) + '...';
+}
+
+/**
+ * Check if string looks like Base64
+ */
+export function isBase64Like(str: string): boolean {
+  // Check if string looks like base64 encoded content
+  if (str.length < 20) return false;
+  const base64Regex = /^[A-Za-z0-9+/=]{20,}$/;
+  return base64Regex.test(str.replace(/\s/g, ''));
+}
+
+/**
+ * Check if string looks like hex encoded
+ */
+export function isHexEncoded(str: string): boolean {
+  if (str.length < 20 || str.length % 2 !== 0) return false;
+  const hexRegex = /^[0-9a-fA-F]+$/;
+  return hexRegex.test(str);
+}
+
+/**
+ * Calculate Shannon entropy of a string
+ * High entropy suggests encrypted/compressed/obfuscated content
+ */
+export function calculateEntropy(str: string): number {
+  if (str.length === 0) return 0;
+
+  const frequencies: Record<string, number> = {};
+  for (const char of str) {
+    frequencies[char] = (frequencies[char] || 0) + 1;
+  }
+
+  let entropy = 0;
+  const len = str.length;
+  for (const count of Object.values(frequencies)) {
+    const probability = count / len;
+    entropy -= probability * Math.log2(probability);
+  }
+
+  return entropy;
+}
+
+/**
+ * Check if code appears obfuscated based on entropy and patterns
+ */
+export function looksObfuscated(code: string): boolean {
+  // Check entropy - obfuscated code tends to have higher entropy
+  const entropy = calculateEntropy(code);
+  if (entropy > 5.5) return true;
+
+  // Check for common obfuscation patterns
+  const obfuscationPatterns = [
+    /\\x[0-9a-f]{2}/gi, // Hex escape sequences
+    /\\u[0-9a-f]{4}/gi, // Unicode escape sequences
+    /['"][^'"]{100,}['"]/g, // Very long strings
+    /\b[a-z]{1}[0-9]{4,}\b/gi, // Variables like a12345
+    /\(\s*function\s*\(\s*\)\s*{[\s\S]*}\s*\)\s*\(\s*\)/g, // IIFE obfuscation
+    /eval\s*\(\s*atob\s*\(/gi, // eval(atob(...))
+    /String\.fromCharCode/gi, // Character code generation
+  ];
+
+  let patternMatches = 0;
+  for (const pattern of obfuscationPatterns) {
+    if (pattern.test(code)) {
+      patternMatches++;
+    }
+  }
+
+  return patternMatches >= 2;
+}