thuban 0.4.0 → 0.4.2

package/dist/packages/crucible/rules/xss.json

@@ -0,0 +1,641 @@
+[
+  {
+    "id": "XSS001",
+    "pattern": "from\\s+mako\\s*\\.\\s*template\\s+import\\s+Template",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Python: Mako Template().render() — multiline template then render (separate lines)",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS002",
+    "pattern": "innerHTML\\s*=|document\\.write\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS (original)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS003",
+    "pattern": "render_template_string\\s*\\(|webView.*javaScriptEnabled\\s*=\\s*true",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS (original)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS004",
+    "pattern": "dangerouslySetInnerHTML\\s*=\\s*\\{\\{?\\s*__html\\s*:",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — React dangerouslySetInnerHTML, Angular [innerHTML], Vue v-html",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS005",
+    "pattern": "\\[innerHTML\\]\\s*=",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — React dangerouslySetInnerHTML, Angular [innerHTML], Vue v-html",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS006",
+    "pattern": "v-html\\s*=",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — React dangerouslySetInnerHTML, Angular [innerHTML], Vue v-html",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS007",
+    "pattern": "\\$\\s*\\([^)]+\\)\\s*\\.\\s*html\\s*\\(\\s*\\w",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS008",
+    "pattern": "\\.outerHTML\\s*=",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS009",
+    "pattern": "\\{\\{\\{[^}]+\\}\\}\\}",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS010",
+    "pattern": "marked\\s*\\(\\s*\\w",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS011",
+    "pattern": "res\\s*\\.\\s*(?:send|end|write)\\s*\\(\\s*`[^`]*\\$\\{",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Express res.send/res.end/res.write with template literal containing user input",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS012",
+    "pattern": "make_response\\s*\\(\\s*f['\"]|HttpResponse\\s*\\(\\s*f['\"]",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS013",
+    "pattern": "HTMLResponse\\s*\\(\\s*content\\s*=\\s*f['\"]",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS014",
+    "pattern": "Template\\s*\\([^)]*\\)\\s*\\.render\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS015",
+    "pattern": "\\|\\s*safe\\b",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS016",
+    "pattern": "ERB\\s*\\.\\s*new\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Ruby: ERB.new with user-controlled template",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS017",
+    "pattern": "<\\?=\\s*\\$[a-zA-Z_]",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — PHP: short echo tags",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS018",
+    "pattern": "io\\s*\\.\\s*WriteString\\s*\\(\\s*w\\b",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Go: io.WriteString to ResponseWriter, template.HTML() cast bypassing escaping",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS019",
+    "pattern": "template\\s*\\.\\s*HTML\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Go: io.WriteString to ResponseWriter, template.HTML() cast bypassing escaping",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS020",
+    "pattern": "Response\\s*\\.\\s*Write\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — C#: Response.Write, HtmlString, Html.Raw, Content(\"text/html\")",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS021",
+    "pattern": "new\\s+HtmlString\\s*\\(|Html\\s*\\.\\s*Raw\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — C#: Response.Write, HtmlString, Html.Raw, Content(\"text/html\")",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS022",
+    "pattern": "return\\s+Content\\s*\\([^,]+,\\s*[\"']text\\/html[\"']",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — C#: Response.Write, HtmlString, Html.Raw, Content(\"text/html\")",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS023",
+    "pattern": "webView\\s*\\.\\s*loadData\\s*\\(|webView\\s*\\.\\s*loadDataWithBaseURL\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Kotlin: WebView.loadData, loadDataWithBaseURL, allowUniversalAccessFromFileURLs, Ktor respondText",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS024",
+    "pattern": "allowUniversalAccessFromFileURLs\\s*=\\s*true",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Kotlin: WebView.loadData, loadDataWithBaseURL, allowUniversalAccessFromFileURLs, Ktor respondText",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS025",
+    "pattern": "call\\s*\\.\\s*respondText\\s*\\([^)]*text\\/html",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Kotlin: WebView.loadData, loadDataWithBaseURL, allowUniversalAccessFromFileURLs, Ktor respondText",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS026",
+    "pattern": "req\\s*\\.\\s*getHeader\\s*\\(|out\\s*\\.\\s*println\\s*\\([^)]*getParameter",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Java: req.getHeader reflection, PrintWriter with getParameter or string concat",
+    "language": [
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS027",
+    "pattern": "out\\s*\\.\\s*(?:print|println)\\s*\\([^)]*[\"'<][^)]*\\+\\s*\\w|pw\\s*\\.\\s*write\\s*\\([^)]*\\+",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Java: out.print/println/pw.write with string concatenation (variable + HTML)",
+    "language": [
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS028",
+    "pattern": "fmt\\s*\\.\\s*Fprintf\\s*\\(\\s*w\\s*,",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Go: fmt.Fprintf(w, \"...%s...\", userVar) — format string with w as target",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS029",
+    "pattern": "fmt\\s*\\.\\s*Fprint\\s*\\(\\s*w\\s*,",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Go: fmt.Fprint(w, ...) with user data",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS030",
+    "pattern": "return\\s+make_response\\s*\\(html\\b|return\\s+HTMLResponse\\s*\\(content\\s*=\\s*html\\b",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Python: make_response/HTMLResponse with variable html built from f-string (multiline pattern)",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS031",
+    "pattern": "\"[^\"]*#\\{[^}]+\\}[^\"]*\"|'[^']*#\\{[^}]+\\}[^']*'",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Ruby: Sinatra route returning string with interpolation #{...}",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS032",
+    "pattern": "call\\s*\\.\\s*respondText\\s*\\(\\s*\\w",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Kotlin: call.respondText with HTML variable (not just ContentType inline)",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS033",
+    "pattern": "ErrorMessage\\s*=\\s*\\$['\"]",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — C#: @Html.Raw rendered from model property (ErrorMessage / body variable)",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS034",
+    "pattern": "echo\\s+.*\\$(?:_POST|_GET|_REQUEST|_COOKIE|comment|username|data|error)",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS - PHP echo with $_POST/$_GET",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS035",
+    "pattern": "(?:print_r|var_dump)\\s*\\(\\s*\\$_(?:REQUEST|GET|POST)",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS - PHP print_r/var_dump user input",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS036",
+    "pattern": "echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$[a-zA-Z_]",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS - concatenation into HTML echo",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS037",
+    "pattern": "(?:w\\.Write|fmt\\.Fprintf\\s*\\(\\s*w)[^;]*(?:r\\.URL\\.Query\\(\\)|r\\.FormValue|r\\.Header)",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS - Go w.Write/fmt.Fprintf with user input",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS038",
+    "pattern": "evaluateJavascript\\s*\\(|webView\\.loadUrl\\s*\\(|addJavascriptInterface\\s*\\(",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS - Kotlin WebView evaluateJavascript",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS039",
+    "pattern": "\\.html_safe\\b|raw\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS - Ruby on Rails raw/html_safe with user content",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS040",
+    "pattern": "Response\\.Write\\s*\\([^)]*(?:Request\\.|QueryString|Form\\[)",
+    "flags": "i",
+    "category": "xss",
+    "description": "C# XSS: Response.Write with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS041",
+    "pattern": "context\\.Response\\.Write\\s*\\([^)]*(?:\\+\\s*\\w|\\bname\\b|\\bq\\b)",
+    "flags": "i",
+    "category": "xss",
+    "description": "C# XSS: Response.Write with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS042",
+    "pattern": "Response\\.Write\\s*\\(\"[^\"]*\"\\s*\\+",
+    "flags": "i",
+    "category": "xss",
+    "description": "C# XSS: Response.Write with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS043",
+    "pattern": "render\\s+html:\\s*\\w+\\.html_safe",
+    "flags": "i",
+    "category": "xss",
+    "description": "Ruby XSS: html_safe / raw()",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS044",
+    "pattern": "echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$(?:_GET|_POST|name|query|msg|error|comment)",
+    "flags": "i",
+    "category": "xss",
+    "description": "PHP XSS: echo without htmlspecialchars",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS045",
+    "pattern": "<\\?=\\s*\\$(?:username|profile|bio|color|font|theme|src|href)",
+    "flags": "i",
+    "category": "xss",
+    "description": "PHP XSS: echo without htmlspecialchars",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS046",
+    "pattern": "fmt\\.Fprintf\\s*\\(\\s*w[^)]*r\\.URL\\.Query\\(\\)\\.Get\\b",
+    "flags": "i",
+    "category": "xss",
+    "description": "Go XSS",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS047",
+    "pattern": "fmt\\.Fprintf\\s*\\(\\s*w[^)]*r\\.FormValue\\b",
+    "flags": "i",
+    "category": "xss",
+    "description": "Go XSS",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS048",
+    "pattern": "template\\.HTML\\s*\\([^)]*\\+\\s*\\w",
+    "flags": "i",
+    "category": "xss",
+    "description": "Go XSS",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS049",
+    "pattern": "res\\s*\\.\\s*send\\s*\\(\\s*['\"`].*\\+",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Express res.send() with string concatenation containing user input",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "high"
+  }
+]

package/dist/packages/crucible/rules/xxe.json

@@ -0,0 +1,66 @@
+[
+  {
+    "id": "XXE001",
+    "pattern": "XMLReaderFactory|DocumentBuilderFactory|XmlReader.*DtdProcessing",
+    "flags": "",
+    "category": "xxe",
+    "description": "XXE",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "XXE002",
+    "pattern": "DtdProcessing\\s*=\\s*DtdProcessing\\.Parse",
+    "flags": "i",
+    "category": "xxe",
+    "description": "C# XXE: XmlDocument/XmlReader",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "XXE003",
+    "pattern": "XmlResolver\\s*=\\s*new XmlUrlResolver\\s*\\(\\)",
+    "flags": "i",
+    "category": "xxe",
+    "description": "C# XXE: XmlDocument/XmlReader",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "XXE004",
+    "pattern": "new XPathDocument\\s*\\(",
+    "flags": "i",
+    "category": "xxe",
+    "description": "C# XXE: XPathDocument (no resolver set = default unsafe on older .NET)",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "XXE005",
+    "pattern": "SAXParserFactory\\.newInstance\\s*\\(\\s*\\)",
+    "flags": "",
+    "category": "xxe",
+    "description": "Java: XXE via SAXParserFactory without secure processing",
+    "language": [
+      "java"
+    ],
+    "severity": "critical"
+  }
+]