secure-scan 1.2.2

package/src/analyzers/iac/iacAnalyzer.ts

@@ -0,0 +1,318 @@
+/**
+ * Infrastructure as Code (IaC) Analyzer
+ * Analyzes Dockerfile, YAML, Terraform, CI/CD configurations
+ */
+
+import { BaseAnalyzer } from '../base';
+import { ScannedFile, Finding, Rule, SupportedLanguage, Severity, ThreatType, FindingCategory } from '../../types';
+import { generateId, extractCodeContext } from '../../utils';
+import { getStandardsForThreat } from '../../rules/standards';
+
+/**
+ * IaC Analyzer Class
+ */
+export class IaCAnalyzer extends BaseAnalyzer {
+  name = 'IaC Analyzer';
+  languages: SupportedLanguage[] = ['dockerfile', 'yaml', 'terraform'];
+  version = '1.0.0';
+
+  /**
+   * Analyze IaC file
+   */
+  async analyze(file: ScannedFile, rules: Rule[]): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    // Determine file type and analyze accordingly
+    if (file.language === 'dockerfile' || file.relativePath.toLowerCase().includes('dockerfile')) {
+      const dockerFindings = await this.analyzeDockerfile(file);
+      findings.push(...dockerFindings);
+    } else if (file.language === 'yaml' || file.extension === '.yml' || file.extension === '.yaml') {
+      const yamlFindings = await this.analyzeYaml(file);
+      findings.push(...yamlFindings);
+    } else if (file.language === 'terraform') {
+      const tfFindings = await this.analyzeTerraform(file);
+      findings.push(...tfFindings);
+    }
+
+    return findings;
+  }
+
+  /**
+   * Analyze Dockerfile
+   */
+  private async analyzeDockerfile(file: ScannedFile): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const lines = file.content.split('\n');
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i].trim();
+      const lineNum = i + 1;
+
+      // Check for running as root
+      if (/^USER\s+root/i.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'Container Running as Root',
+          'Running containers as root is a security risk.',
+          Severity.MEDIUM,
+          ThreatType.SECURITY_MISCONFIGURATION
+        ));
+      }
+
+      // Check for latest tag
+      if (/^FROM\s+\S+:latest/i.test(line) || /^FROM\s+[^:]+\s*$/i.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'Using Latest Tag',
+          'Using "latest" tag can lead to unpredictable builds.',
+          Severity.LOW,
+          ThreatType.SECURITY_MISCONFIGURATION
+        ));
+      }
+
+      // Check for secrets in ENV
+      if (/^ENV\s+.*(?:PASSWORD|SECRET|KEY|TOKEN|API_KEY)\s*=/i.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'Secrets in Environment Variable',
+          'Secrets should not be baked into images via ENV.',
+          Severity.HIGH,
+          ThreatType.HARDCODED_CREDENTIALS
+        ));
+      }
+
+      // Check for ADD instead of COPY
+      if (/^ADD\s+https?:\/\//i.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'ADD with Remote URL',
+          'ADD with URL can introduce security risks. Use curl/wget with verification.',
+          Severity.MEDIUM,
+          ThreatType.SECURITY_MISCONFIGURATION
+        ));
+      }
+
+      // Check for sudo usage
+      if (/\bsudo\b/.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'Sudo in Dockerfile',
+          'Using sudo in Dockerfile is unnecessary and may indicate issues.',
+          Severity.LOW,
+          ThreatType.SECURITY_MISCONFIGURATION
+        ));
+      }
+
+      // Check for curl/wget piped to shell
+      if (/(?:curl|wget)\s+[^|]*\|\s*(?:bash|sh)/i.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'Curl Pipe to Shell',
+          'Piping curl/wget to shell is dangerous without verification.',
+          Severity.HIGH,
+          ThreatType.MALICIOUS_LOADER
+        ));
+      }
+
+      // Check for privileged mode hints
+      if (/--privileged|--cap-add/i.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'Privileged Container',
+          'Privileged containers can access host resources.',
+          Severity.HIGH,
+          ThreatType.SECURITY_MISCONFIGURATION
+        ));
+      }
+    }
+
+    return findings;
+  }
+
+  /**
+   * Analyze YAML (GitHub Actions, GitLab CI, etc.)
+   */
+  private async analyzeYaml(file: ScannedFile): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const lines = file.content.split('\n');
+    const isGitHubActions = file.relativePath.includes('.github/workflows');
+    const isGitLabCI = file.relativePath.includes('.gitlab-ci');
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const lineNum = i + 1;
+
+      // Check for secrets in plain text
+      if (/(?:password|secret|api_key|token|key):\s*["']?[^${\s][^"'\s]+/i.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'Hardcoded Secret in YAML',
+          'Secrets should use environment variables or secret management.',
+          Severity.HIGH,
+          ThreatType.HARDCODED_CREDENTIALS
+        ));
+      }
+
+      // GitHub Actions specific checks
+      if (isGitHubActions) {
+        // Check for pull_request_target with checkout
+        if (/pull_request_target/.test(line)) {
+          findings.push(this.createFinding(
+            file, lineNum,
+            'pull_request_target Event',
+            'pull_request_target with actions/checkout can be dangerous.',
+            Severity.MEDIUM,
+            ThreatType.SECURITY_MISCONFIGURATION
+          ));
+        }
+
+        // Check for script injection
+        if (/\$\{\{\s*github\.event\..*\.body\s*\}\}/.test(line) ||
+            /\$\{\{\s*github\.event\..*\.title\s*\}\}/.test(line)) {
+          findings.push(this.createFinding(
+            file, lineNum,
+            'Potential Script Injection',
+            'Using untrusted input in run commands can lead to injection.',
+            Severity.HIGH,
+            ThreatType.COMMAND_INJECTION
+          ));
+        }
+
+        // Check for third-party actions without pinning
+        if (/uses:\s*\S+\/\S+@(?:main|master|v\d+)/.test(line)) {
+          findings.push(this.createFinding(
+            file, lineNum,
+            'Unpinned GitHub Action',
+            'Pin actions to commit SHA for supply chain security.',
+            Severity.LOW,
+            ThreatType.SECURITY_MISCONFIGURATION
+          ));
+        }
+      }
+
+      // Check for curl/wget to shell
+      if (/(?:curl|wget)\s+[^|]*\|\s*(?:bash|sh)/i.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'Curl Pipe to Shell in CI',
+          'Dangerous pattern that can execute malicious code.',
+          Severity.HIGH,
+          ThreatType.MALICIOUS_LOADER
+        ));
+      }
+    }
+
+    return findings;
+  }
+
+  /**
+   * Analyze Terraform
+   */
+  private async analyzeTerraform(file: ScannedFile): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const lines = file.content.split('\n');
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const lineNum = i + 1;
+
+      // Check for hardcoded secrets
+      if (/(?:password|secret|api_key|access_key|secret_key)\s*=\s*["'][^"'$]+["']/i.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'Hardcoded Secret in Terraform',
+          'Use variables or secret management for sensitive values.',
+          Severity.HIGH,
+          ThreatType.HARDCODED_CREDENTIALS
+        ));
+      }
+
+      // Check for open security groups
+      if (/cidr_blocks\s*=\s*\[\s*["']0\.0\.0\.0\/0["']\s*\]/.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'Open Security Group',
+          'Security group allows access from any IP address.',
+          Severity.HIGH,
+          ThreatType.SECURITY_MISCONFIGURATION
+        ));
+      }
+
+      // Check for unencrypted storage
+      if (/encrypted\s*=\s*false/i.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'Unencrypted Storage',
+          'Storage resources should be encrypted at rest.',
+          Severity.MEDIUM,
+          ThreatType.SECURITY_MISCONFIGURATION
+        ));
+      }
+
+      // Check for public access
+      if (/publicly_accessible\s*=\s*true/i.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'Publicly Accessible Resource',
+          'Resources should not be publicly accessible unless required.',
+          Severity.HIGH,
+          ThreatType.SECURITY_MISCONFIGURATION
+        ));
+      }
+
+      // Check for HTTP instead of HTTPS
+      if (/protocol\s*=\s*["']HTTP["']/i.test(line)) {
+        findings.push(this.createFinding(
+          file, lineNum,
+          'HTTP Protocol Used',
+          'Use HTTPS for secure communication.',
+          Severity.MEDIUM,
+          ThreatType.SECURITY_MISCONFIGURATION
+        ));
+      }
+    }
+
+    return findings;
+  }
+
+  /**
+   * Create generic finding
+   */
+  private createFinding(
+    file: ScannedFile,
+    lineNum: number,
+    title: string,
+    description: string,
+    severity: Severity,
+    threatType: ThreatType
+  ): Finding {
+    const context = extractCodeContext(file.content, lineNum, 2);
+
+    return {
+      id: generateId(),
+      title,
+      description,
+      severity,
+      threatType,
+      category: FindingCategory.VULNERABILITY,
+      location: {
+        file: file.relativePath,
+        startLine: lineNum,
+        endLine: lineNum
+      },
+      snippet: {
+        code: context.code,
+        contextBefore: context.contextBefore,
+        contextAfter: context.contextAfter
+      },
+      standards: getStandardsForThreat(threatType),
+      remediation: 'Review and fix the identified configuration issue.',
+      confidence: 80,
+      analyzer: this.name,
+      timestamp: new Date(),
+      tags: ['iac', 'infrastructure', 'devops']
+    };
+  }
+}
+
+export default IaCAnalyzer;

package/src/analyzers/iac/index.ts

@@ -0,0 +1,5 @@
+/**
+ * IaC Analyzer Exports
+ */
+
+export * from './iacAnalyzer';

package/src/analyzers/index.ts

@@ -0,0 +1,67 @@
+/**
+ * Analyzers Module Exports
+ * All language analyzers for the SAST tool
+ */
+
+export * from './base';
+export * from './javascript';
+export * from './python';
+export * from './php';
+export * from './java';
+export * from './c-cpp';
+export * from './csharp';
+export * from './iac';
+
+import { Analyzer, SupportedLanguage } from '../types';
+import { JavaScriptAnalyzer } from './javascript';
+import { PythonAnalyzer } from './python';
+import { PHPAnalyzer } from './php';
+import { JavaAnalyzer } from './java';
+import { CppAnalyzer } from './c-cpp';
+import { CSharpAnalyzer } from './csharp';
+import { IaCAnalyzer } from './iac';
+
+/**
+ * Analyzer registry
+ */
+const analyzers: Analyzer[] = [
+  new JavaScriptAnalyzer(),
+  new PythonAnalyzer(),
+  new PHPAnalyzer(),
+  new JavaAnalyzer(),
+  new CppAnalyzer(),
+  new CSharpAnalyzer(),
+  new IaCAnalyzer()
+];
+
+/**
+ * Get all analyzers
+ */
+export function getAllAnalyzers(): Analyzer[] {
+  return analyzers;
+}
+
+/**
+ * Get analyzer for a specific language
+ */
+export function getAnalyzerForLanguage(language: SupportedLanguage): Analyzer | undefined {
+  return analyzers.find(a => a.languages.includes(language));
+}
+
+/**
+ * Initialize all analyzers
+ */
+export async function initializeAnalyzers(): Promise<void> {
+  for (const analyzer of analyzers) {
+    await analyzer.initialize();
+  }
+}
+
+/**
+ * Cleanup all analyzers
+ */
+export async function cleanupAnalyzers(): Promise<void> {
+  for (const analyzer of analyzers) {
+    await analyzer.cleanup();
+  }
+}

package/src/analyzers/java/index.ts

@@ -0,0 +1,5 @@
+/**
+ * Java Analyzer Exports
+ */
+
+export * from './javaAnalyzer';