secure-scan 1.2.2

package/dist/rules/vulnerabilities/rules/commandInjection.js

@@ -0,0 +1,300 @@
+"use strict";
+/**
+ * @fileoverview Command Injection Detection Rules
+ * @module rules/vulnerabilities/rules/commandInjection
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandInjectionRules = void 0;
+const types_1 = require("../types");
+const constants_1 = require("../constants");
+exports.commandInjectionRules = [
+    {
+        id: 'VUL-CMDI-001',
+        name: 'Command Injection - exec() with User Input',
+        description: 'Detects execution of shell commands with user-controlled input in Node.js.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.COMMAND_INJECTION,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.VulnerabilitySeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 95,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cmdi-exec-req',
+                pattern: '(?:child_process\\.)?exec(?:Sync)?\\s*\\([^)]*req\\.',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'exec with request data'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cmdi-exec-concat',
+                pattern: '(?:child_process\\.)?exec(?:Sync)?\\s*\\([^)]*\\+',
+                flags: 'gi',
+                weight: 0.90,
+                description: 'exec with string concatenation'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cmdi-exec-template',
+                pattern: '(?:child_process\\.)?exec(?:Sync)?\\s*\\(\\s*`[^`]*\\$\\{',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'exec with template literal'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'high',
+            technicalImpact: 'Arbitrary command execution on the server. Full system compromise.',
+            businessImpact: 'Complete server takeover, data breach, lateral movement.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none',
+            knownExploits: true
+        },
+        remediation: {
+            summary: 'Use execFile() or spawn() with arguments array. Never pass user input to shell commands.',
+            steps: [
+                'Replace exec() with execFile() or spawn()',
+                'Pass command arguments as array, not concatenated string',
+                'Validate and sanitize user input',
+                'Use allowlist for permitted commands'
+            ],
+            secureCodeExample: `// Secure: Using execFile with arguments array
+const { execFile } = require('child_process');
+execFile('ls', ['-la', sanitizedPath], (error, stdout) => {
+  // handle output
+});
+
+// Secure: Using spawn with arguments
+const { spawn } = require('child_process');
+const ls = spawn('ls', ['-la', userDir]);`,
+            effort: 'medium',
+            priority: 'immediate'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A03],
+            cwe: [constants_1.CWE_REFERENCES.CWE_78],
+            sans: [{ rank: 3, cweId: 'CWE-78', category: 'OS Command Injection' }]
+        },
+        tags: ['command-injection', 'rce', 'nodejs', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'VUL-CMDI-002',
+        name: 'Command Injection - Python os.system/subprocess',
+        description: 'Detects Python os.system() or subprocess calls with user input.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.COMMAND_INJECTION,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.PYTHON],
+        severity: types_1.VulnerabilitySeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 95,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cmdi-os-system',
+                pattern: 'os\\.system\\s*\\(\\s*(?:f[\'"]|[\'"].*%|[\'"].*\\.format|.*\\+)',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'os.system with formatted string'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cmdi-subprocess-shell',
+                pattern: 'subprocess\\.(?:call|run|Popen)\\s*\\([^)]*shell\\s*=\\s*True',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'subprocess with shell=True'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cmdi-os-popen',
+                pattern: 'os\\.popen\\s*\\(',
+                flags: 'gi',
+                weight: 0.90,
+                description: 'os.popen usage'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'high',
+            technicalImpact: 'Full server compromise via shell command execution.',
+            businessImpact: 'System takeover, data exfiltration.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none'
+        },
+        remediation: {
+            summary: 'Use subprocess with shell=False and command list. Use shlex.quote() for any user input.',
+            steps: [
+                'Replace os.system() with subprocess.run()',
+                'Use shell=False with command as list',
+                'Quote user input with shlex.quote()',
+                'Consider using high-level libraries instead'
+            ],
+            secureCodeExample: `import subprocess
+import shlex
+
+# Secure: Using list form without shell
+subprocess.run(['ls', '-la', user_path], shell=False)
+
+# If shell is needed, quote the input
+safe_input = shlex.quote(user_input)
+subprocess.run(f'echo {safe_input}', shell=True)`,
+            effort: 'low',
+            priority: 'immediate'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A03],
+            cwe: [constants_1.CWE_REFERENCES.CWE_78]
+        },
+        tags: ['command-injection', 'python', 'subprocess', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'VUL-CMDI-003',
+        name: 'Command Injection - PHP system/exec/shell_exec',
+        description: 'Detects PHP command execution functions with user input.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.COMMAND_INJECTION,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.PHP],
+        severity: types_1.VulnerabilitySeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 95,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cmdi-php-system',
+                pattern: '(?:system|exec|shell_exec|passthru|popen|proc_open)\\s*\\([^)]*\\$_(?:GET|POST|REQUEST)',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'Command function with superglobal'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cmdi-php-backtick',
+                pattern: '`[^`]*\\$[^`]*`',
+                flags: 'g',
+                weight: 0.95,
+                description: 'Backtick operator with variable'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'high',
+            technicalImpact: 'Complete server compromise.',
+            businessImpact: 'Full system access to attacker.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none',
+            knownExploits: true
+        },
+        remediation: {
+            summary: 'Use escapeshellarg() and escapeshellcmd(). Avoid command execution when possible.',
+            steps: [
+                'Escape all user input with escapeshellarg()',
+                'Use escapeshellcmd() for entire command strings',
+                'Consider PHP native functions instead of shell commands',
+                'Disable dangerous functions in php.ini'
+            ],
+            secureCodeExample: `<?php
+// Secure: Using escapeshellarg
+$safe_input = escapeshellarg($_GET['filename']);
+system("cat " . $safe_input);
+
+// Better: Use PHP functions instead
+$content = file_get_contents($validated_path);
+?>`,
+            effort: 'low',
+            priority: 'immediate'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A03],
+            cwe: [constants_1.CWE_REFERENCES.CWE_78]
+        },
+        tags: ['command-injection', 'php', 'rce', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'VUL-CMDI-004',
+        name: 'Command Injection - Java Runtime.exec',
+        description: 'Detects Java Runtime.exec() with concatenated user input.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.COMMAND_INJECTION,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.JAVA],
+        severity: types_1.VulnerabilitySeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 95,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cmdi-java-runtime',
+                pattern: 'Runtime\\.getRuntime\\(\\)\\.exec\\s*\\([^)]*\\+',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'Runtime.exec with concatenation'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cmdi-java-processbuilder',
+                pattern: 'new\\s+ProcessBuilder\\s*\\([^)]*\\+',
+                flags: 'gi',
+                weight: 0.90,
+                description: 'ProcessBuilder with concatenation'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'high',
+            technicalImpact: 'Arbitrary command execution on server.',
+            businessImpact: 'Complete system compromise.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none'
+        },
+        remediation: {
+            summary: 'Use ProcessBuilder with String array. Never concatenate user input into commands.',
+            steps: [
+                'Use ProcessBuilder with command array',
+                'Validate input against allowlist',
+                'Avoid shell interpretation by not using /bin/sh -c'
+            ],
+            secureCodeExample: `// Secure: Using ProcessBuilder with array
+ProcessBuilder pb = new ProcessBuilder("ls", "-la", sanitizedPath);
+Process p = pb.start();`,
+            effort: 'medium',
+            priority: 'immediate'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A03],
+            cwe: [constants_1.CWE_REFERENCES.CWE_78]
+        },
+        tags: ['command-injection', 'java', 'runtime-exec', 'critical'],
+        enabled: true
+    }
+];
+exports.default = exports.commandInjectionRules;
+//# sourceMappingURL=commandInjection.js.map

package/dist/rules/vulnerabilities/rules/commandInjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandInjection.js","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/commandInjection.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,oCAQkB;AAClB,4CAAiE;AAEpD,QAAA,qBAAqB,GAAwB;IACxD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,4CAA4C;QAClD,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,iBAAiB;QACtD,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,6BAAqB,CAAC,QAAQ;QACxC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,eAAe;gBAC1B,OAAO,EAAE,sDAAsD;gBAC/D,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,wBAAwB;aACtC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,OAAO,EAAE,mDAAmD;gBAC5D,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,gCAAgC;aAC9C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,2DAA2D;gBACpE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,4BAA4B;aAC1C;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,MAAM;YACpB,eAAe,EAAE,oEAAoE;YACrF,cAAc,EAAE,0DAA0D;SAC3E;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;YACvB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,0FAA0F;YACnG,KAAK,EAAE;gBACL,2CAA2C;gBAC3C,0DAA0D;gBAC1D,kCAAkC;gBAClC,sCAAsC;aACvC;YACD,iBAAiB,EAAE;;;;;;;;0CAQiB;YACpC,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,WAAW;SACtB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,MAAM,CAAC;YAC5B,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;SACvE;QACD,IAAI,EAAE,CAAC,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC;QACxD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,iDAAiD;QACvD,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,iBAAiB;QACtD,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,MAAM,CAAC;QACrC,QAAQ,EAAE,6BAAqB,CAAC,QAAQ;QACxC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,kEAAkE;gBAC3E,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,iCAAiC;aAC/C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,uBAAuB;gBAClC,OAAO,EAAE,+DAA+D;gBACxE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,4BAA4B;aAC1C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,eAAe;gBAC1B,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,gBAAgB;aAC9B;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,MAAM;YACpB,eAAe,EAAE,qDAAqD;YACtE,cAAc,EAAE,qCAAqC;SACtD;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;SACxB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,yFAAyF;YAClG,KAAK,EAAE;gBACL,2CAA2C;gBAC3C,sCAAsC;gBACtC,qCAAqC;gBACrC,6CAA6C;aAC9C;YACD,iBAAiB,EAAE;;;;;;;;iDAQwB;YAC3C,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,WAAW;SACtB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,MAAM,CAAC;SAC7B;QACD,IAAI,EAAE,CAAC,mBAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC;QAC/D,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,gDAAgD;QACtD,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,iBAAiB;QACtD,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,GAAG,CAAC;QAClC,QAAQ,EAAE,6BAAqB,CAAC,QAAQ;QACxC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,iBAAiB;gBAC5B,OAAO,EAAE,yFAAyF;gBAClG,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,mCAAmC;aACjD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,iBAAiB;gBAC1B,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,iCAAiC;aAC/C;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,MAAM;YACpB,eAAe,EAAE,6BAA6B;YAC9C,cAAc,EAAE,iCAAiC;SAClD;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;YACvB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,mFAAmF;YAC5F,KAAK,EAAE;gBACL,6CAA6C;gBAC7C,iDAAiD;gBACjD,yDAAyD;gBACzD,wCAAwC;aACzC;YACD,iBAAiB,EAAE;;;;;;;GAOtB;YACG,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,WAAW;SACtB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,MAAM,CAAC;SAC7B;QACD,IAAI,EAAE,CAAC,mBAAmB,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC;QACrD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,uCAAuC;QAC7C,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,iBAAiB;QACtD,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,IAAI,CAAC;QACnC,QAAQ,EAAE,6BAAqB,CAAC,QAAQ;QACxC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,kDAAkD;gBAC3D,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,iCAAiC;aAC/C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,0BAA0B;gBACrC,OAAO,EAAE,sCAAsC;gBAC/C,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,mCAAmC;aACjD;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,MAAM;YACpB,eAAe,EAAE,wCAAwC;YACzD,cAAc,EAAE,6BAA6B;SAC9C;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;SACxB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,mFAAmF;YAC5F,KAAK,EAAE;gBACL,uCAAuC;gBACvC,kCAAkC;gBAClC,oDAAoD;aACrD;YACD,iBAAiB,EAAE;;wBAED;YAClB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,WAAW;SACtB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,MAAM,CAAC;SAC7B;QACD,IAAI,EAAE,CAAC,mBAAmB,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC;QAC/D,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,kBAAe,6BAAqB,CAAC"}

package/dist/rules/vulnerabilities/rules/csrf.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @fileoverview CSRF (Cross-Site Request Forgery) Detection Rules
+ * @module rules/vulnerabilities/rules/csrf
+ */
+import { VulnerabilityRule } from '../types';
+export declare const csrfRules: VulnerabilityRule[];
+export default csrfRules;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/rules/vulnerabilities/rules/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/csrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,iBAAiB,EAOlB,MAAM,UAAU,CAAC;AAGlB,eAAO,MAAM,SAAS,EAAE,iBAAiB,EAyPxC,CAAC;AAEF,eAAe,SAAS,CAAC"}

package/dist/rules/vulnerabilities/rules/csrf.js

@@ -0,0 +1,261 @@
+"use strict";
+/**
+ * @fileoverview CSRF (Cross-Site Request Forgery) Detection Rules
+ * @module rules/vulnerabilities/rules/csrf
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.csrfRules = void 0;
+const types_1 = require("../types");
+const constants_1 = require("../constants");
+exports.csrfRules = [
+    {
+        id: 'VUL-CSRF-001',
+        name: 'Missing CSRF Protection - Express',
+        description: 'Detects state-changing routes without CSRF protection in Express.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.CSRF,
+        category: types_1.VulnerabilityCategory.BROKEN_ACCESS_CONTROL,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.VulnerabilitySeverity.MEDIUM,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 60,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'csrf-no-csurf',
+                pattern: 'app\\.(?:post|put|patch|delete)\\s*\\([^)]+\\)(?![\\s\\S]*csrf)',
+                flags: 'gi',
+                weight: 0.70,
+                description: 'State-changing route without CSRF mention'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'csrf-disabled',
+                pattern: 'csrf\\s*[({][^}]*ignoreMethods\\s*:\\s*\\[[^\\]]*(?:POST|PUT|DELETE)',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'CSRF protection disabled for state-changing methods'
+            }
+        ],
+        impact: {
+            confidentiality: 'low',
+            integrity: 'high',
+            availability: 'low',
+            technicalImpact: 'Attacker can perform actions on behalf of authenticated users.',
+            businessImpact: 'Unauthorized transactions, account changes.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'required'
+        },
+        remediation: {
+            summary: 'Implement CSRF tokens for all state-changing requests.',
+            steps: [
+                'Use csurf or csrf-csrf middleware',
+                'Include CSRF token in forms and AJAX headers',
+                'Validate token on all POST/PUT/PATCH/DELETE',
+                'Use SameSite=Strict cookies as defense in depth'
+            ],
+            secureCodeExample: `const csrf = require('csurf');
+const csrfProtection = csrf({ cookie: { sameSite: 'strict', httpOnly: true } });
+
+// Apply to all routes
+app.use(csrfProtection);
+
+// Expose token to views
+app.get('/form', (req, res) => {
+  res.render('form', { csrfToken: req.csrfToken() });
+});
+
+// In form: <input type="hidden" name="_csrf" value="<%= csrfToken %>">
+
+// For AJAX, set header:
+// 'CSRF-Token': csrfToken`,
+            effort: 'medium',
+            priority: 'high'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A01],
+            cwe: [constants_1.CWE_REFERENCES.CWE_352]
+        },
+        tags: ['csrf', 'session', 'express'],
+        enabled: true
+    },
+    {
+        id: 'VUL-CSRF-002',
+        name: 'Missing CSRF Protection - Django',
+        description: 'Detects views or forms without CSRF protection in Django.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.CSRF,
+        category: types_1.VulnerabilityCategory.BROKEN_ACCESS_CONTROL,
+        languages: [types_1.SupportedLanguage.PYTHON],
+        severity: types_1.VulnerabilitySeverity.MEDIUM,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 65,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'csrf-django-exempt',
+                pattern: '@csrf_exempt',
+                flags: 'g',
+                weight: 0.95,
+                description: 'CSRF protection exempted'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'csrf-django-disabled',
+                pattern: 'CSRF_COOKIE_SECURE\\s*=\\s*False',
+                flags: 'gi',
+                weight: 0.80,
+                description: 'CSRF cookie not secure'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'csrf-middleware-removed',
+                pattern: '#.*CsrfViewMiddleware',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'CSRF middleware commented out'
+            }
+        ],
+        impact: {
+            confidentiality: 'low',
+            integrity: 'high',
+            availability: 'low',
+            technicalImpact: 'Cross-site request forgery attacks possible.',
+            businessImpact: 'Unauthorized actions on behalf of users.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'required'
+        },
+        remediation: {
+            summary: 'Enable CSRF middleware. Avoid @csrf_exempt except for APIs with token auth.',
+            steps: [
+                'Ensure CsrfViewMiddleware is in MIDDLEWARE',
+                'Remove unnecessary @csrf_exempt decorators',
+                'Use {% csrf_token %} in all forms',
+                'For APIs, use token-based auth instead of session'
+            ],
+            secureCodeExample: `# settings.py
+MIDDLEWARE = [
+    'django.middleware.csrf.CsrfViewMiddleware',
+    # ...
+]
+
+CSRF_COOKIE_SECURE = True
+CSRF_COOKIE_HTTPONLY = True
+CSRF_COOKIE_SAMESITE = 'Strict'
+
+# In templates
+<form method="post">
+    {% csrf_token %}
+    ...
+</form>
+
+# For API views with proper token auth, csrf_exempt is acceptable
+from rest_framework.decorators import api_view, authentication_classes
+@api_view(['POST'])
+@authentication_classes([TokenAuthentication])
+def api_endpoint(request):
+    pass`,
+            effort: 'low',
+            priority: 'high'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A01],
+            cwe: [constants_1.CWE_REFERENCES.CWE_352]
+        },
+        tags: ['csrf', 'django', 'python'],
+        enabled: true
+    },
+    {
+        id: 'VUL-CSRF-003',
+        name: 'Missing CSRF Protection - PHP',
+        description: 'Detects PHP forms without CSRF token validation.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.CSRF,
+        category: types_1.VulnerabilityCategory.BROKEN_ACCESS_CONTROL,
+        languages: [types_1.SupportedLanguage.PHP],
+        severity: types_1.VulnerabilitySeverity.MEDIUM,
+        confidence: types_1.ConfidenceLevel.LOW,
+        baseScore: 55,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'csrf-php-post-no-token',
+                pattern: '\\$_POST\\s*\\[[\'"][^\'"]+[\'"]\\](?![\\s\\S]{0,200}(?:csrf|token|_token))',
+                flags: 'gi',
+                weight: 0.60,
+                description: 'POST processing without token check nearby'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'csrf-php-form-no-token',
+                pattern: '<form[^>]*method\\s*=\\s*[\'"]post[\'"][^>]*>(?![\\s\\S]{0,500}(?:csrf|token|_token))',
+                flags: 'gi',
+                weight: 0.50,
+                description: 'Form without CSRF token'
+            }
+        ],
+        impact: {
+            confidentiality: 'low',
+            integrity: 'high',
+            availability: 'low',
+            technicalImpact: 'State-changing actions can be triggered by malicious sites.',
+            businessImpact: 'Unauthorized transactions.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'required'
+        },
+        remediation: {
+            summary: 'Generate and validate CSRF tokens for all forms.',
+            steps: [
+                'Generate token in session and embed in forms',
+                'Validate token on every POST request',
+                'Regenerate token after use (one-time tokens)',
+                'Use framework CSRF protection if available'
+            ],
+            secureCodeExample: `<?php
+// Generate token
+session_start();
+if (empty($_SESSION['csrf_token'])) {
+    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+}
+
+// In form
+?>
+<form method="post">
+    <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
+    ...
+</form>
+
+<?php
+// Validate on submit
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'] ?? '')) {
+        die('CSRF validation failed');
+    }
+    // Process form...
+}
+?>`,
+            effort: 'medium',
+            priority: 'high'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A01],
+            cwe: [constants_1.CWE_REFERENCES.CWE_352]
+        },
+        tags: ['csrf', 'php', 'forms'],
+        enabled: true
+    }
+];
+exports.default = exports.csrfRules;
+//# sourceMappingURL=csrf.js.map

package/dist/rules/vulnerabilities/rules/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/csrf.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,oCAQkB;AAClB,4CAAiE;AAEpD,QAAA,SAAS,GAAwB;IAC5C;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,mCAAmC;QACzC,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,IAAI;QACzC,QAAQ,EAAE,6BAAqB,CAAC,qBAAqB;QACrD,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,6BAAqB,CAAC,MAAM;QACtC,UAAU,EAAE,uBAAe,CAAC,MAAM;QAClC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,eAAe;gBAC1B,OAAO,EAAE,iEAAiE;gBAC1E,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,2CAA2C;aACzD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,eAAe;gBAC1B,OAAO,EAAE,sEAAsE;gBAC/E,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,qDAAqD;aACnE;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,gEAAgE;YACjF,cAAc,EAAE,6CAA6C;SAC9D;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,UAAU;SAC5B;QACD,WAAW,EAAE;YACX,OAAO,EAAE,wDAAwD;YACjE,KAAK,EAAE;gBACL,mCAAmC;gBACnC,8CAA8C;gBAC9C,6CAA6C;gBAC7C,iDAAiD;aAClD;YACD,iBAAiB,EAAE;;;;;;;;;;;;;;2BAcE;YACrB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,MAAM;SACjB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,OAAO,CAAC;SAC9B;QACD,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC;QACpC,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,kCAAkC;QACxC,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,IAAI;QACzC,QAAQ,EAAE,6BAAqB,CAAC,qBAAqB;QACrD,SAAS,EAAE,CAAC,yBAAiB,CAAC,MAAM,CAAC;QACrC,QAAQ,EAAE,6BAAqB,CAAC,MAAM;QACtC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,cAAc;gBACvB,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,0BAA0B;aACxC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,kCAAkC;gBAC3C,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,wBAAwB;aACtC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,yBAAyB;gBACpC,OAAO,EAAE,uBAAuB;gBAChC,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,+BAA+B;aAC7C;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,8CAA8C;YAC/D,cAAc,EAAE,0CAA0C;SAC3D;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,UAAU;SAC5B;QACD,WAAW,EAAE;YACX,OAAO,EAAE,6EAA6E;YACtF,KAAK,EAAE;gBACL,4CAA4C;gBAC5C,4CAA4C;gBAC5C,mCAAmC;gBACnC,mDAAmD;aACpD;YACD,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;SAqBhB;YACH,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,MAAM;SACjB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,OAAO,CAAC;SAC9B;QACD,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAClC,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,IAAI;QACzC,QAAQ,EAAE,6BAAqB,CAAC,qBAAqB;QACrD,SAAS,EAAE,CAAC,yBAAiB,CAAC,GAAG,CAAC;QAClC,QAAQ,EAAE,6BAAqB,CAAC,MAAM;QACtC,UAAU,EAAE,uBAAe,CAAC,GAAG;QAC/B,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,wBAAwB;gBACnC,OAAO,EAAE,6EAA6E;gBACtF,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,4CAA4C;aAC1D;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,wBAAwB;gBACnC,OAAO,EAAE,uFAAuF;gBAChG,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,yBAAyB;aACvC;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,6DAA6D;YAC9E,cAAc,EAAE,4BAA4B;SAC7C;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,UAAU;SAC5B;QACD,WAAW,EAAE;YACX,OAAO,EAAE,kDAAkD;YAC3D,KAAK,EAAE;gBACL,8CAA8C;gBAC9C,sCAAsC;gBACtC,8CAA8C;gBAC9C,4CAA4C;aAC7C;YACD,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;;GAsBtB;YACG,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,MAAM;SACjB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,OAAO,CAAC;SAC9B;QACD,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QAC9B,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,kBAAe,iBAAS,CAAC"}

package/dist/rules/vulnerabilities/rules/deserialization.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @fileoverview Insecure Deserialization Detection Rules
+ * @module rules/vulnerabilities/rules/deserialization
+ */
+import { VulnerabilityRule } from '../types';
+export declare const deserializationRules: VulnerabilityRule[];
+export default deserializationRules;
+//# sourceMappingURL=deserialization.d.ts.map

package/dist/rules/vulnerabilities/rules/deserialization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deserialization.d.ts","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/deserialization.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,iBAAiB,EAOlB,MAAM,UAAU,CAAC;AAGlB,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,EAoUnD,CAAC;AAEF,eAAe,oBAAoB,CAAC"}