secure-scan 1.2.2

package/src/analyzers/base/baseAnalyzer.ts

@@ -0,0 +1,66 @@
+/**
+ * Base Analyzer Interface
+ * Abstract base class for language-specific analyzers
+ */
+
+import { Analyzer, ScannedFile, Finding, Rule, SupportedLanguage } from '../../types';
+import { RuleEngine } from '../core/engine';
+import { logger } from '../../utils/logger';
+
+/**
+ * Base Analyzer Class
+ * Provides common functionality for all language analyzers
+ */
+export abstract class BaseAnalyzer implements Analyzer {
+  abstract name: string;
+  abstract languages: SupportedLanguage[];
+  abstract version: string;
+
+  protected ruleEngine: RuleEngine;
+  protected initialized: boolean = false;
+
+  constructor() {
+    this.ruleEngine = new RuleEngine();
+  }
+
+  /**
+   * Initialize the analyzer
+   */
+  async initialize(): Promise<void> {
+    logger.debug(`Initializing ${this.name} analyzer...`);
+    this.initialized = true;
+  }
+
+  /**
+   * Check if analyzer supports a language
+   */
+  supportsLanguage(language: SupportedLanguage): boolean {
+    return this.languages.includes(language);
+  }
+
+  /**
+   * Analyze a file
+   */
+  abstract analyze(file: ScannedFile, rules: Rule[]): Promise<Finding[]>;
+
+  /**
+   * Cleanup resources
+   */
+  async cleanup(): Promise<void> {
+    logger.debug(`Cleaning up ${this.name} analyzer...`);
+    this.initialized = false;
+  }
+
+  /**
+   * Get analyzer info
+   */
+  getInfo(): { name: string; languages: SupportedLanguage[]; version: string } {
+    return {
+      name: this.name,
+      languages: this.languages,
+      version: this.version
+    };
+  }
+}
+
+export default BaseAnalyzer;

package/src/analyzers/base/index.ts

@@ -0,0 +1,5 @@
+/**
+ * Base Analyzer Exports
+ */
+
+export * from './baseAnalyzer';

package/src/analyzers/c-cpp/cppAnalyzer.ts

@@ -0,0 +1,308 @@
+/**
+ * C/C++ Analyzer
+ * Specialized analyzer for C and C++ code
+ */
+
+import { BaseAnalyzer } from '../base';
+import { ScannedFile, Finding, Rule, SupportedLanguage, Severity, ThreatType, FindingCategory } from '../../types';
+import { generateId, extractCodeContext } from '../../utils';
+import { getStandardsForThreat } from '../../rules/standards';
+
+/**
+ * C/C++ Analyzer Class
+ */
+export class CppAnalyzer extends BaseAnalyzer {
+  name = 'C/C++ Analyzer';
+  languages: SupportedLanguage[] = ['c', 'cpp'];
+  version = '1.0.0';
+
+  /**
+   * Analyze C/C++ file
+   */
+  async analyze(file: ScannedFile, rules: Rule[]): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    // Filter rules for C/C++
+    const cppRules = rules.filter(r => 
+      r.languages.includes('c') || r.languages.includes('cpp')
+    );
+
+    // Run rule engine
+    const ruleFindings = await this.ruleEngine.analyzeFile(file, cppRules);
+    findings.push(...ruleFindings);
+
+    // Additional C/C++-specific analysis
+    const customFindings = await this.customAnalysis(file);
+    findings.push(...customFindings);
+
+    return findings;
+  }
+
+  /**
+   * Custom C/C++-specific analysis
+   */
+  private async customAnalysis(file: ScannedFile): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const lines = file.content.split('\n');
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const lineNum = i + 1;
+
+      // Check for dangerous functions
+      if (this.checkDangerousFunctions(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Use of Dangerous Function',
+          'This function is known to be vulnerable to buffer overflows.',
+          Severity.HIGH,
+          ThreatType.DANGEROUS_FUNCTION
+        ));
+      }
+
+      // Check for format string vulnerabilities
+      if (this.checkFormatString(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Format String Vulnerability',
+          'User-controlled format string can lead to arbitrary code execution.',
+          Severity.CRITICAL,
+          ThreatType.DANGEROUS_FUNCTION
+        ));
+      }
+
+      // Check for buffer overflow patterns
+      if (this.checkBufferOverflow(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Potential Buffer Overflow',
+          'Fixed-size buffer operation without proper bounds checking.',
+          Severity.HIGH,
+          ThreatType.DANGEROUS_FUNCTION
+        ));
+      }
+
+      // Check for command injection
+      if (this.checkCommandInjection(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Command Injection Risk',
+          'System/exec call with potentially user-controlled input.',
+          Severity.CRITICAL,
+          ThreatType.COMMAND_INJECTION
+        ));
+      }
+
+      // Check for integer overflow
+      if (this.checkIntegerOverflow(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Potential Integer Overflow',
+          'Arithmetic operation without overflow checking.',
+          Severity.MEDIUM,
+          ThreatType.DANGEROUS_FUNCTION
+        ));
+      }
+
+      // Check for use after free patterns
+      if (this.checkUseAfterFree(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Potential Use-After-Free',
+          'Pointer may be used after being freed.',
+          Severity.HIGH,
+          ThreatType.DANGEROUS_FUNCTION
+        ));
+      }
+
+      // Check for hardcoded IPs
+      if (this.checkHardcodedIp(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Hardcoded IP Address',
+          'Hardcoded IP addresses may indicate backdoor connections.',
+          Severity.MEDIUM,
+          ThreatType.SUSPICIOUS_NETWORK
+        ));
+      }
+
+      // Check for shellcode patterns
+      if (this.checkShellcode(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Potential Shellcode',
+          'Byte array resembles shellcode or encoded payload.',
+          Severity.CRITICAL,
+          ThreatType.EMBEDDED_PAYLOAD
+        ));
+      }
+    }
+
+    return findings;
+  }
+
+  /**
+   * Check for dangerous functions
+   */
+  private checkDangerousFunctions(line: string): boolean {
+    const dangerous = [
+      /\bgets\s*\(/,
+      /\bstrcpy\s*\(/,
+      /\bstrcat\s*\(/,
+      /\bsprintf\s*\(/,
+      /\bvsprintf\s*\(/,
+      /\bscanf\s*\(\s*["']%s/,
+      /\bfscanf\s*\([^,]+,\s*["']%s/,
+      /\bsscanf\s*\([^,]+,\s*["']%s/,
+      /\brealpath\s*\([^,]+,\s*NULL\s*\)/
+    ];
+    return dangerous.some(p => p.test(line));
+  }
+
+  /**
+   * Check for format string vulnerabilities
+   */
+  private checkFormatString(line: string): boolean {
+    const patterns = [
+      /printf\s*\(\s*[a-zA-Z_][a-zA-Z0-9_]*\s*\)/,  // printf(var) without format
+      /fprintf\s*\([^,]+,\s*[a-zA-Z_][a-zA-Z0-9_]*\s*\)/,
+      /sprintf\s*\([^,]+,\s*[a-zA-Z_][a-zA-Z0-9_]*\s*\)/,
+      /syslog\s*\([^,]+,\s*[a-zA-Z_][a-zA-Z0-9_]*\s*\)/
+    ];
+    return patterns.some(p => p.test(line));
+  }
+
+  /**
+   * Check for buffer overflow patterns
+   */
+  private checkBufferOverflow(line: string): boolean {
+    const patterns = [
+      /char\s+\w+\s*\[\s*\d+\s*\]/,  // Fixed size buffer
+      /memcpy\s*\([^,]+,[^,]+,[^)]*sizeof/,
+      /strncpy\s*\([^,]+,[^,]+,\s*sizeof\s*\([^)]+\)\s*\)/
+    ];
+    
+    // Only flag if combined with dangerous operations
+    if (patterns.some(p => p.test(line))) {
+      if (/\bstrcpy\b|\bstrcat\b|\bsprintf\b/.test(line)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * Check for command injection
+   */
+  private checkCommandInjection(line: string): boolean {
+    const patterns = [
+      /\bsystem\s*\([^)]*\+/,
+      /\bsystem\s*\([^)]*[a-zA-Z_]\w*\s*\)/,
+      /\bpopen\s*\([^)]*\+/,
+      /\bexecl\s*\([^)]*\+/,
+      /\bexecv\s*\([^)]*\+/,
+      /\bShellExecute\s*\([^)]*\+/
+    ];
+    return patterns.some(p => p.test(line));
+  }
+
+  /**
+   * Check for integer overflow
+   */
+  private checkIntegerOverflow(line: string): boolean {
+    const patterns = [
+      /malloc\s*\(\s*\w+\s*\*\s*\w+\s*\)/,  // malloc(a * b)
+      /calloc\s*\(\s*\w+\s*,\s*\w+\s*\*\s*\w+\s*\)/,
+      /realloc\s*\([^,]+,\s*\w+\s*\*\s*\w+\s*\)/
+    ];
+    return patterns.some(p => p.test(line));
+  }
+
+  /**
+   * Check for use-after-free patterns
+   */
+  private checkUseAfterFree(line: string): boolean {
+    // Simplified check - look for free followed by usage
+    const patterns = [
+      /free\s*\(\s*(\w+)\s*\).*\1/,  // free(ptr)...ptr
+      /delete\s+(\w+).*\1->/  // delete ptr...ptr->
+    ];
+    return patterns.some(p => p.test(line));
+  }
+
+  /**
+   * Check for hardcoded IPs
+   */
+  private checkHardcodedIp(line: string): boolean {
+    // Check for IPv4 addresses that aren't localhost or private
+    const ipPattern = /["']\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}["']/;
+    if (ipPattern.test(line)) {
+      // Exclude common safe IPs
+      if (!/127\.0\.0\.1|0\.0\.0\.0|192\.168\.|10\.|172\.(?:1[6-9]|2[0-9]|3[01])\./.test(line)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * Check for shellcode patterns
+   */
+  private checkShellcode(line: string): boolean {
+    const patterns = [
+      /\\x[0-9a-f]{2}(?:\\x[0-9a-f]{2}){20,}/i,  // Hex escape sequences
+      /\{0x[0-9a-f]{2}(?:,\s*0x[0-9a-f]{2}){20,}\}/i,  // Byte array
+      /char\s+\w+\[\]\s*=\s*"\\x/i
+    ];
+    return patterns.some(p => p.test(line));
+  }
+
+  /**
+   * Create generic finding
+   */
+  private createFinding(
+    file: ScannedFile,
+    lineNum: number,
+    title: string,
+    description: string,
+    severity: Severity,
+    threatType: ThreatType
+  ): Finding {
+    const context = extractCodeContext(file.content, lineNum, 2);
+
+    return {
+      id: generateId(),
+      title,
+      description,
+      severity,
+      threatType,
+      category: FindingCategory.VULNERABILITY,
+      location: {
+        file: file.relativePath,
+        startLine: lineNum,
+        endLine: lineNum
+      },
+      snippet: {
+        code: context.code,
+        contextBefore: context.contextBefore,
+        contextAfter: context.contextAfter
+      },
+      standards: getStandardsForThreat(threatType),
+      remediation: 'Review and fix the identified issue. Use safe alternatives.',
+      confidence: 70,
+      analyzer: this.name,
+      timestamp: new Date(),
+      tags: ['c', 'cpp', 'memory-safety']
+    };
+  }
+}
+
+export default CppAnalyzer;

package/src/analyzers/c-cpp/index.ts

@@ -0,0 +1,5 @@
+/**
+ * C/C++ Analyzer Exports
+ */
+
+export * from './cppAnalyzer';

package/src/analyzers/core/engine/index.ts

@@ -0,0 +1,5 @@
+/**
+ * Engine Module Exports
+ */
+
+export * from './ruleEngine';

package/src/analyzers/core/engine/ruleEngine.ts

@@ -0,0 +1,221 @@
+/**
+ * Rule Engine
+ * Core engine for running security rules against code
+ */
+
+import {
+  Rule,
+  Finding,
+  ScannedFile,
+  Severity,
+  ThreatType,
+  FindingCategory,
+  SourceLocation,
+  CodeSnippet
+} from '../../../types';
+import { generateId, extractCodeContext } from '../../../utils';
+import { getStandardsForThreat } from '../../../rules/standards';
+import { logger } from '../../../utils/logger';
+
+/**
+ * Pattern match result
+ */
+interface PatternMatch {
+  matched: boolean;
+  line: number;
+  column: number;
+  matchedText: string;
+  groups?: Record<string, string>;
+}
+
+/**
+ * Rule Engine Class
+ */
+export class RuleEngine {
+  private rules: Rule[];
+
+  constructor() {
+    this.rules = [];
+  }
+
+  /**
+   * Load rules for analysis
+   */
+  loadRules(rules: Rule[]): void {
+    this.rules = rules.filter(r => r.enabled);
+    logger.info(`📋 Loaded ${this.rules.length} active rules`);
+  }
+
+  /**
+   * Get rules for a specific language
+   */
+  getRulesForLanguage(language: string): Rule[] {
+    return this.rules.filter(rule =>
+      rule.languages.includes(language as any) ||
+      rule.languages.includes('*' as any)
+    );
+  }
+
+  /**
+   * Run rules against a file
+   */
+  async analyzeFile(file: ScannedFile, rules?: Rule[]): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const applicableRules = rules || this.getRulesForLanguage(file.language || '');
+
+    for (const rule of applicableRules) {
+      try {
+        const ruleFindings = await this.runRule(rule, file);
+        findings.push(...ruleFindings);
+      } catch (error) {
+        logger.debug(`Error running rule ${rule.id}: ${error}`);
+      }
+    }
+
+    return findings;
+  }
+
+  /**
+   * Run a single rule against a file
+   */
+  private async runRule(rule: Rule, file: ScannedFile): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    for (const pattern of rule.patterns) {
+      if (pattern.type === 'regex') {
+        const matches = this.matchRegex(file.content, pattern.pattern, pattern.flags);
+        
+        for (const match of matches) {
+          const finding = this.createFinding(rule, file, match);
+          findings.push(finding);
+        }
+      }
+    }
+
+    return findings;
+  }
+
+  /**
+   * Match regex pattern against content
+   */
+  private matchRegex(content: string, pattern: string, flags: string = 'gim'): PatternMatch[] {
+    const matches: PatternMatch[] = [];
+    const lines = content.split('\n');
+    
+    try {
+      const regex = new RegExp(pattern, flags);
+      
+      let lineOffset = 0;
+      for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+        const line = lines[lineNum];
+        let match: RegExpExecArray | null;
+        
+        // Reset regex for each line
+        const lineRegex = new RegExp(pattern, flags.replace('g', '') + 'g');
+        
+        while ((match = lineRegex.exec(line)) !== null) {
+          matches.push({
+            matched: true,
+            line: lineNum + 1, // 1-indexed
+            column: match.index + 1,
+            matchedText: match[0],
+            groups: match.groups
+          });
+          
+          // Prevent infinite loop on zero-width matches
+          if (match[0].length === 0) {
+            lineRegex.lastIndex++;
+          }
+        }
+        
+        lineOffset += line.length + 1;
+      }
+    } catch (error) {
+      logger.debug(`Invalid regex pattern: ${pattern}`);
+    }
+
+    return matches;
+  }
+
+  /**
+   * Create a finding from a rule match
+   */
+  private createFinding(rule: Rule, file: ScannedFile, match: PatternMatch): Finding {
+    const context = extractCodeContext(file.content, match.line, 3);
+    
+    const location: SourceLocation = {
+      file: file.relativePath,
+      startLine: match.line,
+      endLine: match.line,
+      startColumn: match.column,
+      endColumn: match.column + match.matchedText.length
+    };
+
+    const snippet: CodeSnippet = {
+      code: context.code,
+      contextBefore: context.contextBefore,
+      contextAfter: context.contextAfter,
+      highlight: {
+        start: match.column - 1,
+        end: match.column - 1 + match.matchedText.length
+      }
+    };
+
+    return {
+      id: generateId(),
+      title: rule.name,
+      description: rule.description,
+      severity: rule.severity,
+      threatType: rule.threatType,
+      category: rule.category,
+      location,
+      snippet,
+      standards: rule.standards.length > 0 
+        ? rule.standards 
+        : getStandardsForThreat(rule.threatType),
+      remediation: rule.remediation,
+      confidence: 85, // Default confidence for regex matches
+      analyzer: 'rule-engine',
+      timestamp: new Date(),
+      tags: rule.tags
+    };
+  }
+
+  /**
+   * Deduplicate findings
+   */
+  deduplicateFindings(findings: Finding[]): Finding[] {
+    const seen = new Set<string>();
+    const unique: Finding[] = [];
+
+    for (const finding of findings) {
+      const key = `${finding.location.file}:${finding.location.startLine}:${finding.threatType}`;
+      
+      if (!seen.has(key)) {
+        seen.add(key);
+        unique.push(finding);
+      }
+    }
+
+    return unique;
+  }
+
+  /**
+   * Sort findings by severity
+   */
+  sortBySeverity(findings: Finding[]): Finding[] {
+    const severityOrder: Record<Severity, number> = {
+      [Severity.CRITICAL]: 0,
+      [Severity.HIGH]: 1,
+      [Severity.MEDIUM]: 2,
+      [Severity.LOW]: 3,
+      [Severity.INFO]: 4
+    };
+
+    return [...findings].sort((a, b) => 
+      severityOrder[a.severity] - severityOrder[b.severity]
+    );
+  }
+}
+
+export default RuleEngine;

package/src/analyzers/core/index.ts

@@ -0,0 +1,8 @@
+/**
+ * Core Module Exports
+ */
+
+export * from './scanner';
+export * from './engine';
+export * from './scoring';
+export * from './securityScanner';