secure-scan 1.2.2

package/dist/rules/vulnerabilities/rules/deserialization.js

@@ -0,0 +1,336 @@
+"use strict";
+/**
+ * @fileoverview Insecure Deserialization Detection Rules
+ * @module rules/vulnerabilities/rules/deserialization
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deserializationRules = void 0;
+const types_1 = require("../types");
+const constants_1 = require("../constants");
+exports.deserializationRules = [
+    {
+        id: 'VUL-DESER-001',
+        name: 'Insecure Deserialization - Python pickle',
+        description: 'Detects use of Python pickle module with untrusted data.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.INSECURE_DESERIALIZATION,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.PYTHON],
+        severity: types_1.VulnerabilitySeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 95,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'deser-pickle-load',
+                pattern: 'pickle\\.loads?\\s*\\([^)]*(?:request\\.|input\\(|open\\(|socket)',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'pickle.load with untrusted input'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'deser-pickle-import',
+                pattern: 'import\\s+pickle|from\\s+pickle\\s+import',
+                flags: 'g',
+                weight: 0.50,
+                description: 'pickle import (needs review)'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'deser-yaml-load',
+                pattern: 'yaml\\.(?:load|unsafe_load)\\s*\\([^)]*(?!Loader\\s*=\\s*yaml\\.SafeLoader)',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'yaml.load without SafeLoader'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'deser-marshal-load',
+                pattern: 'marshal\\.loads?\\s*\\(',
+                flags: 'gi',
+                weight: 0.90,
+                description: 'marshal.load usage'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'high',
+            technicalImpact: 'Arbitrary code execution via crafted pickle payload.',
+            businessImpact: 'Complete server compromise, RCE.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none',
+            knownExploits: true
+        },
+        remediation: {
+            summary: 'Never unpickle untrusted data. Use JSON or other safe formats.',
+            steps: [
+                'Replace pickle with JSON for data serialization',
+                'If pickle is required, use hmac to verify data integrity',
+                'Use yaml.safe_load() instead of yaml.load()',
+                'Restrict deserialization to known safe classes'
+            ],
+            secureCodeExample: `import json
+import hmac
+import hashlib
+
+# Secure: Use JSON instead
+data = json.loads(request.data)
+
+# If pickle is absolutely required, verify integrity
+def verify_and_load(data, signature, secret_key):
+    expected_sig = hmac.new(secret_key, data, hashlib.sha256).hexdigest()
+    if not hmac.compare_digest(signature, expected_sig):
+        raise ValueError("Data integrity check failed")
+    return pickle.loads(data)  # Still risky, prefer JSON
+
+# Secure YAML loading
+import yaml
+data = yaml.safe_load(yaml_content)`,
+            effort: 'medium',
+            priority: 'immediate'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A08],
+            cwe: [constants_1.CWE_REFERENCES.CWE_502]
+        },
+        tags: ['deserialization', 'rce', 'python', 'pickle', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'VUL-DESER-002',
+        name: 'Insecure Deserialization - PHP unserialize',
+        description: 'Detects use of PHP unserialize() with user-controlled data.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.INSECURE_DESERIALIZATION,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.PHP],
+        severity: types_1.VulnerabilitySeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 95,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'deser-php-unserialize',
+                pattern: 'unserialize\\s*\\([^)]*\\$_(?:GET|POST|REQUEST|COOKIE)',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'unserialize with superglobal'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'deser-php-unserialize-var',
+                pattern: 'unserialize\\s*\\(\\s*\\$[a-zA-Z_]',
+                flags: 'g',
+                weight: 0.80,
+                description: 'unserialize with variable'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'high',
+            technicalImpact: 'Object injection leading to RCE via magic methods (__wakeup, __destruct).',
+            businessImpact: 'Complete server compromise.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'medium',
+            privilegesRequired: 'none',
+            userInteraction: 'none',
+            knownExploits: true
+        },
+        remediation: {
+            summary: 'Never unserialize user data. Use JSON or specify allowed_classes.',
+            steps: [
+                'Replace unserialize() with json_decode()',
+                'If unserialize is required, use allowed_classes option',
+                'Remove dangerous magic methods from classes',
+                'Validate data structure after deserialization'
+            ],
+            secureCodeExample: `<?php
+// Secure: Use JSON
+$data = json_decode($_POST['data'], true);
+
+// If unserialize required, restrict classes
+$data = unserialize($serialized, ['allowed_classes' => ['SafeClass']]);
+
+// Best: Avoid deserialization of user input entirely
+?>`,
+            effort: 'medium',
+            priority: 'immediate'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A08],
+            cwe: [constants_1.CWE_REFERENCES.CWE_502]
+        },
+        tags: ['deserialization', 'php', 'object-injection', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'VUL-DESER-003',
+        name: 'Insecure Deserialization - Java ObjectInputStream',
+        description: 'Detects Java ObjectInputStream usage with untrusted data.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.INSECURE_DESERIALIZATION,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.JAVA],
+        severity: types_1.VulnerabilitySeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 95,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'deser-java-ois',
+                pattern: 'new\\s+ObjectInputStream\\s*\\([^)]*(?:request|socket|input)',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'ObjectInputStream with external input'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'deser-java-readobject',
+                pattern: '\\.readObject\\s*\\(',
+                flags: 'g',
+                weight: 0.70,
+                description: 'readObject call'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'deser-java-xmldecoder',
+                pattern: 'new\\s+XMLDecoder\\s*\\(',
+                flags: 'gi',
+                weight: 0.95,
+                description: 'XMLDecoder usage (dangerous)'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'high',
+            technicalImpact: 'RCE via gadget chains (Commons Collections, etc.).',
+            businessImpact: 'Complete system compromise, lateral movement.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none',
+            knownExploits: true
+        },
+        remediation: {
+            summary: 'Avoid Java serialization. Use JSON with Jackson. If required, use look-ahead deserialization.',
+            steps: [
+                'Replace Java serialization with JSON (Jackson, Gson)',
+                'Use ValidatingObjectInputStream from Apache Commons IO',
+                'Remove vulnerable libraries (old Commons Collections)',
+                'Implement ObjectInputFilter (Java 9+)'
+            ],
+            secureCodeExample: `// Secure: Use JSON instead
+ObjectMapper mapper = new ObjectMapper();
+MyClass obj = mapper.readValue(jsonString, MyClass.class);
+
+// If serialization required, use ObjectInputFilter (Java 9+)
+ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
+    "com.myapp.SafeClass;!*"
+);
+ObjectInputStream ois = new ObjectInputStream(inputStream);
+ois.setObjectInputFilter(filter);`,
+            effort: 'high',
+            priority: 'immediate'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A08],
+            cwe: [constants_1.CWE_REFERENCES.CWE_502]
+        },
+        tags: ['deserialization', 'java', 'rce', 'gadget-chain', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'VUL-DESER-004',
+        name: 'Insecure Deserialization - Node.js node-serialize',
+        description: 'Detects use of dangerous Node.js serialization libraries.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.INSECURE_DESERIALIZATION,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.VulnerabilitySeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 95,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'deser-node-serialize',
+                pattern: 'require\\s*\\([\'"]node-serialize[\'"]\\)',
+                flags: 'g',
+                weight: 0.95,
+                description: 'node-serialize import (vulnerable)'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'deser-serialize-unserialize',
+                pattern: '\\.unserialize\\s*\\([^)]*(?:req\\.|body|cookie)',
+                flags: 'gi',
+                weight: 1.0,
+                description: 'unserialize with user data'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'deser-js-yaml-unsafe',
+                pattern: 'js-yaml.*\\.load\\s*\\([^)]*(?!\\{[^}]*schema)',
+                flags: 'gi',
+                weight: 0.85,
+                description: 'js-yaml without safe schema'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'high',
+            technicalImpact: 'RCE via IIFE (Immediately Invoked Function Expression) in serialized data.',
+            businessImpact: 'Complete server compromise.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'none',
+            userInteraction: 'none',
+            knownExploits: true
+        },
+        remediation: {
+            summary: 'Remove node-serialize. Use JSON.parse() for data exchange.',
+            steps: [
+                'Remove node-serialize package',
+                'Use native JSON.parse() and JSON.stringify()',
+                'Use safe YAML parser with safeLoad',
+                'Validate structure after parsing'
+            ],
+            secureCodeExample: `// Secure: Use native JSON
+const data = JSON.parse(req.body.data);
+
+// Validate structure
+if (typeof data.name !== 'string' || typeof data.age !== 'number') {
+  throw new Error('Invalid data structure');
+}
+
+// Safe YAML
+const yaml = require('js-yaml');
+const data = yaml.load(content, { schema: yaml.SAFE_SCHEMA });`,
+            effort: 'low',
+            priority: 'immediate'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A08],
+            cwe: [constants_1.CWE_REFERENCES.CWE_502]
+        },
+        tags: ['deserialization', 'nodejs', 'rce', 'critical'],
+        enabled: true
+    }
+];
+exports.default = exports.deserializationRules;
+//# sourceMappingURL=deserialization.js.map

package/dist/rules/vulnerabilities/rules/deserialization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deserialization.js","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/deserialization.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,oCAQkB;AAClB,4CAAiE;AAEpD,QAAA,oBAAoB,GAAwB;IACvD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,0CAA0C;QAChD,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,wBAAwB;QAC7D,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,MAAM,CAAC;QACrC,QAAQ,EAAE,6BAAqB,CAAC,QAAQ;QACxC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,mEAAmE;gBAC5E,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kCAAkC;aAChD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,OAAO,EAAE,2CAA2C;gBACpD,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,8BAA8B;aAC5C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,iBAAiB;gBAC5B,OAAO,EAAE,6EAA6E;gBACtF,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,8BAA8B;aAC5C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,yBAAyB;gBAClC,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,oBAAoB;aAClC;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,MAAM;YACpB,eAAe,EAAE,sDAAsD;YACvE,cAAc,EAAE,kCAAkC;SACnD;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;YACvB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,gEAAgE;YACzE,KAAK,EAAE;gBACL,iDAAiD;gBACjD,0DAA0D;gBAC1D,6CAA6C;gBAC7C,gDAAgD;aACjD;YACD,iBAAiB,EAAE;;;;;;;;;;;;;;;;oCAgBW;YAC9B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,WAAW;SACtB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,OAAO,CAAC;SAC9B;QACD,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC;QAChE,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,4CAA4C;QAClD,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,wBAAwB;QAC7D,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,GAAG,CAAC;QAClC,QAAQ,EAAE,6BAAqB,CAAC,QAAQ;QACxC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,uBAAuB;gBAClC,OAAO,EAAE,wDAAwD;gBACjE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,8BAA8B;aAC5C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,2BAA2B;gBACtC,OAAO,EAAE,oCAAoC;gBAC7C,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,2BAA2B;aACzC;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,MAAM;YACpB,eAAe,EAAE,2EAA2E;YAC5F,cAAc,EAAE,6BAA6B;SAC9C;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,QAAQ;YAC1B,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;YACvB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,mEAAmE;YAC5E,KAAK,EAAE;gBACL,0CAA0C;gBAC1C,wDAAwD;gBACxD,6CAA6C;gBAC7C,+CAA+C;aAChD;YACD,iBAAiB,EAAE;;;;;;;;GAQtB;YACG,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,WAAW;SACtB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,OAAO,CAAC;SAC9B;QACD,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,CAAC;QAChE,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,mDAAmD;QACzD,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,wBAAwB;QAC7D,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,IAAI,CAAC;QACnC,QAAQ,EAAE,6BAAqB,CAAC,QAAQ;QACxC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,8DAA8D;gBACvE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,uCAAuC;aACrD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,uBAAuB;gBAClC,OAAO,EAAE,sBAAsB;gBAC/B,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,iBAAiB;aAC/B;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,uBAAuB;gBAClC,OAAO,EAAE,0BAA0B;gBACnC,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,8BAA8B;aAC5C;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,MAAM;YACpB,eAAe,EAAE,oDAAoD;YACrE,cAAc,EAAE,+CAA+C;SAChE;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;YACvB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,+FAA+F;YACxG,KAAK,EAAE;gBACL,sDAAsD;gBACtD,wDAAwD;gBACxD,uDAAuD;gBACvD,uCAAuC;aACxC;YACD,iBAAiB,EAAE;;;;;;;;;kCASS;YAC5B,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,WAAW;SACtB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,OAAO,CAAC;SAC9B;QACD,IAAI,EAAE,CAAC,iBAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC;QACpE,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,mDAAmD;QACzD,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,yBAAiB,CAAC,wBAAwB;QAC7D,QAAQ,EAAE,6BAAqB,CAAC,SAAS;QACzC,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,6BAAqB,CAAC,QAAQ;QACxC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,2CAA2C;gBACpD,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,oCAAoC;aAClD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,6BAA6B;gBACxC,OAAO,EAAE,kDAAkD;gBAC3D,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,4BAA4B;aAC1C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,gDAAgD;gBACzD,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,6BAA6B;aAC3C;SACF;QACD,MAAM,EAAE;YACN,eAAe,EAAE,MAAM;YACvB,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,MAAM;YACpB,eAAe,EAAE,4EAA4E;YAC7F,cAAc,EAAE,6BAA6B;SAC9C;QACD,cAAc,EAAE;YACd,YAAY,EAAE,SAAS;YACvB,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,MAAM;YAC1B,eAAe,EAAE,MAAM;YACvB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,4DAA4D;YACrE,KAAK,EAAE;gBACL,+BAA+B;gBAC/B,8CAA8C;gBAC9C,oCAAoC;gBACpC,kCAAkC;aACnC;YACD,iBAAiB,EAAE;;;;;;;;;;+DAUsC;YACzD,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,WAAW;SACtB;QACD,SAAS,EAAE;YACT,KAAK,EAAE,CAAC,6BAAiB,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,CAAC,0BAAc,CAAC,OAAO,CAAC;SAC9B;QACD,IAAI,EAAE,CAAC,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC;QACtD,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,kBAAe,4BAAoB,CAAC"}

package/dist/rules/vulnerabilities/rules/fileUpload.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @fileoverview File Upload Vulnerabilities Detection Rules
+ * @module rules/vulnerabilities/rules/fileUpload
+ */
+import { VulnerabilityRule } from '../types';
+export declare const fileUploadRules: VulnerabilityRule[];
+export default fileUploadRules;
+//# sourceMappingURL=fileUpload.d.ts.map

package/dist/rules/vulnerabilities/rules/fileUpload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileUpload.d.ts","sourceRoot":"","sources":["../../../../src/rules/vulnerabilities/rules/fileUpload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,iBAAiB,EAOlB,MAAM,UAAU,CAAC;AAGlB,eAAO,MAAM,eAAe,EAAE,iBAAiB,EAyT9C,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/rules/vulnerabilities/rules/fileUpload.js

@@ -0,0 +1,325 @@
+"use strict";
+/**
+ * @fileoverview File Upload Vulnerabilities Detection Rules
+ * @module rules/vulnerabilities/rules/fileUpload
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fileUploadRules = void 0;
+const types_1 = require("../types");
+const constants_1 = require("../constants");
+exports.fileUploadRules = [
+    {
+        id: 'VUL-UPLOAD-001',
+        name: 'Unrestricted File Upload - No Extension Validation',
+        description: 'Detects file upload handling without proper extension validation.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.FILE_UPLOAD,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.VulnerabilitySeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 80,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'upload-multer-no-filter',
+                pattern: 'multer\\s*\\([^)]*\\)(?![\\s\\S]{0,100}fileFilter)',
+                flags: 'gi',
+                weight: 0.85,
+                description: 'Multer without fileFilter'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'upload-original-name',
+                pattern: '\\.originalname|file\\.name[^\\s]*path',
+                flags: 'gi',
+                weight: 0.75,
+                description: 'Using original filename in path'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'upload-write-file',
+                pattern: 'fs\\.writeFile(?:Sync)?\\s*\\([^)]*req\\.files?',
+                flags: 'gi',
+                weight: 0.90,
+                description: 'Writing uploaded file without validation'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'high',
+            technicalImpact: 'Upload and execute malicious scripts. Web shell installation.',
+            businessImpact: 'Complete server compromise via uploaded web shell.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'low',
+            userInteraction: 'none',
+            knownExploits: true
+        },
+        remediation: {
+            summary: 'Validate file extensions, MIME types, and content. Store outside webroot.',
+            steps: [
+                'Validate file extension against allowlist',
+                'Verify MIME type matches extension',
+                'Check file content (magic bytes)',
+                'Generate random filename for storage',
+                'Store files outside webroot or use CDN',
+                'Set Content-Disposition: attachment for downloads'
+            ],
+            secureCodeExample: `const multer = require('multer');
+const path = require('path');
+const crypto = require('crypto');
+
+const ALLOWED_EXTENSIONS = ['.jpg', '.jpeg', '.png', '.gif', '.pdf'];
+const ALLOWED_MIMES = ['image/jpeg', 'image/png', 'image/gif', 'application/pdf'];
+
+const storage = multer.diskStorage({
+  destination: './uploads/', // Outside webroot
+  filename: (req, file, cb) => {
+    // Generate random filename
+    const ext = path.extname(file.originalname).toLowerCase();
+    const name = crypto.randomBytes(16).toString('hex');
+    cb(null, \`\${name}\${ext}\`);
+  }
+});
+
+const fileFilter = (req, file, cb) => {
+  const ext = path.extname(file.originalname).toLowerCase();
+  
+  if (!ALLOWED_EXTENSIONS.includes(ext)) {
+    return cb(new Error('Invalid file type'), false);
+  }
+  
+  if (!ALLOWED_MIMES.includes(file.mimetype)) {
+    return cb(new Error('Invalid MIME type'), false);
+  }
+  
+  cb(null, true);
+};
+
+const upload = multer({
+  storage,
+  fileFilter,
+  limits: { fileSize: 5 * 1024 * 1024 } // 5MB
+});`,
+            effort: 'medium',
+            priority: 'high'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A04],
+            cwe: [constants_1.CWE_REFERENCES.CWE_434]
+        },
+        tags: ['file-upload', 'rce', 'webshell'],
+        enabled: true
+    },
+    {
+        id: 'VUL-UPLOAD-002',
+        name: 'Unrestricted File Upload - PHP',
+        description: 'Detects PHP file upload handling without proper validation.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.FILE_UPLOAD,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.PHP],
+        severity: types_1.VulnerabilitySeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 90,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'upload-php-move-uploaded',
+                pattern: 'move_uploaded_file\\s*\\([^,]+,\\s*[^)]*\\$_FILES',
+                flags: 'gi',
+                weight: 0.85,
+                description: 'move_uploaded_file with user filename'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'upload-php-copy',
+                pattern: 'copy\\s*\\(\\s*\\$_FILES\\[[\'"][^\'"]+[\'"]\\]\\[[\'"]tmp_name[\'"]\\]',
+                flags: 'gi',
+                weight: 0.80,
+                description: 'copy uploaded file'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'upload-php-no-ext-check',
+                pattern: '\\$_FILES\\[[\'"][^\'"]+[\'"]\\]\\[[\'"]name[\'"]\\](?![\\s\\S]{0,50}(?:pathinfo|preg_match|extension))',
+                flags: 'gi',
+                weight: 0.70,
+                description: 'Using filename without extension check'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'high',
+            technicalImpact: 'Upload PHP scripts for remote code execution.',
+            businessImpact: 'Complete server takeover.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'low',
+            userInteraction: 'none',
+            knownExploits: true
+        },
+        remediation: {
+            summary: 'Validate extensions with allowlist. Store outside webroot. Disable PHP in upload directory.',
+            steps: [
+                'Validate extension against strict allowlist',
+                'Check MIME type with finfo_file()',
+                'Store files outside webroot',
+                'Disable PHP execution in upload directory via .htaccess',
+                'Generate random filenames'
+            ],
+            secureCodeExample: `<?php
+$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'pdf'];
+$allowed_mimes = ['image/jpeg', 'image/png', 'image/gif', 'application/pdf'];
+$upload_dir = '/var/uploads/'; // Outside webroot
+
+function validateUpload($file) {
+    global $allowed_extensions, $allowed_mimes;
+    
+    // Get extension
+    $ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
+    if (!in_array($ext, $allowed_extensions, true)) {
+        return false;
+    }
+    
+    // Verify MIME type
+    $finfo = finfo_open(FILEINFO_MIME_TYPE);
+    $mime = finfo_file($finfo, $file['tmp_name']);
+    if (!in_array($mime, $allowed_mimes, true)) {
+        return false;
+    }
+    
+    return true;
+}
+
+if (validateUpload($_FILES['upload'])) {
+    $ext = pathinfo($_FILES['upload']['name'], PATHINFO_EXTENSION);
+    $newname = bin2hex(random_bytes(16)) . '.' . $ext;
+    move_uploaded_file($_FILES['upload']['tmp_name'], $upload_dir . $newname);
+}
+
+// .htaccess in upload directory
+// php_flag engine off
+?>`,
+            effort: 'medium',
+            priority: 'immediate'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A04],
+            cwe: [constants_1.CWE_REFERENCES.CWE_434]
+        },
+        tags: ['file-upload', 'php', 'rce', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'VUL-UPLOAD-003',
+        name: 'Unrestricted File Upload - Python/Flask',
+        description: 'Detects Flask/Django file upload handling without proper validation.',
+        version: '1.0.0',
+        vulnerabilityType: types_1.VulnerabilityType.FILE_UPLOAD,
+        category: types_1.VulnerabilityCategory.INJECTION,
+        languages: [types_1.SupportedLanguage.PYTHON],
+        severity: types_1.VulnerabilitySeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 75,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'upload-flask-save',
+                pattern: 'request\\.files\\[[\'"][^\'"]+[\'"]\\]\\.save\\s*\\([^)]*filename',
+                flags: 'gi',
+                weight: 0.85,
+                description: 'Flask file.save with user filename'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'upload-no-secure-filename',
+                pattern: '\\.filename(?![\\s\\S]{0,50}secure_filename)',
+                flags: 'gi',
+                weight: 0.75,
+                description: 'Using filename without secure_filename'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'upload-django-chunks',
+                pattern: '\\.chunks\\(\\)(?![\\s\\S]{0,50}(?:allowed|extension))',
+                flags: 'gi',
+                weight: 0.70,
+                description: 'Django file upload without extension check'
+            }
+        ],
+        impact: {
+            confidentiality: 'high',
+            integrity: 'high',
+            availability: 'medium',
+            technicalImpact: 'File overwrite, path traversal, potential code execution.',
+            businessImpact: 'Data manipulation, possible RCE.'
+        },
+        exploitability: {
+            attackVector: 'network',
+            attackComplexity: 'low',
+            privilegesRequired: 'low',
+            userInteraction: 'none'
+        },
+        remediation: {
+            summary: 'Use secure_filename(). Validate extensions. Store safely.',
+            steps: [
+                'Use werkzeug.utils.secure_filename()',
+                'Validate extension against allowlist',
+                'Check MIME type with python-magic',
+                'Generate random filenames',
+                'Store outside webroot'
+            ],
+            secureCodeExample: `from flask import Flask, request
+from werkzeug.utils import secure_filename
+import os
+import uuid
+import magic
+
+ALLOWED_EXTENSIONS = {'jpg', 'jpeg', 'png', 'gif', 'pdf'}
+ALLOWED_MIMES = {'image/jpeg', 'image/png', 'image/gif', 'application/pdf'}
+UPLOAD_FOLDER = '/var/uploads'  # Outside webroot
+
+def allowed_file(file):
+    filename = secure_filename(file.filename)
+    ext = filename.rsplit('.', 1)[-1].lower() if '.' in filename else ''
+    
+    if ext not in ALLOWED_EXTENSIONS:
+        return False
+    
+    # Check actual MIME type
+    mime = magic.from_buffer(file.read(2048), mime=True)
+    file.seek(0)  # Reset file position
+    
+    return mime in ALLOWED_MIMES
+
+@app.route('/upload', methods=['POST'])
+def upload_file():
+    file = request.files.get('file')
+    if not file or not allowed_file(file):
+        return 'Invalid file', 400
+    
+    ext = secure_filename(file.filename).rsplit('.', 1)[-1]
+    new_filename = f'{uuid.uuid4().hex}.{ext}'
+    file.save(os.path.join(UPLOAD_FOLDER, new_filename))
+    return 'Upload successful'`,
+            effort: 'medium',
+            priority: 'high'
+        },
+        standards: {
+            owasp: [constants_1.OWASP_TOP_10_2021.A04],
+            cwe: [constants_1.CWE_REFERENCES.CWE_434]
+        },
+        tags: ['file-upload', 'python', 'flask', 'django'],
+        enabled: true
+    }
+];
+exports.default = exports.fileUploadRules;
+//# sourceMappingURL=fileUpload.js.map