thuban 0.4.1 → 0.4.2

package/dist/packages/crucible/rules/hardcoded-secret.json

@@ -0,0 +1,397 @@
+[
+  {
+    "id": "SEC001",
+    "pattern": "AKIA[0-9A-Z]{16}|AKIA[A-Z0-9]+['\"]|\\bAKIA",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Hardcoded secrets",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC002",
+    "pattern": "sk-[a-zA-Z0-9]{20,}|sk_live_[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{20,}|AIzaSy[a-zA-Z0-9]{33}",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Hardcoded secrets",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC003",
+    "pattern": "-----BEGIN (RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----|SuperSecretProd\\d+!|hardcoded-jwt-secret",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Hardcoded secrets",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC004",
+    "pattern": "(?:JWT_SECRET|HMAC_SECRET|SECRET_KEY|API_SECRET|WEBHOOK_SECRET)\\s*=\\s*['\"][^'\"]{12,}['\"]",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Generic JWT/HMAC secrets (long strings in secret/key variables)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC005",
+    "pattern": "(?:admin_sk_live|xoxb-[0-9]{11,}|rk_live_[a-zA-Z0-9]{32,})",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Generic JWT/HMAC secrets (long strings in secret/key variables)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC006",
+    "pattern": "(?:JWT_SECRET|JWT_REFRESH_SECRET|SIGNING_KEY|SigningKey|jwtSecret|jwt_secret|secret(?:Key|_key)|signingSecret)\\s*[=:]\\s*['\"`][^'\"`]{12,}['\"`]",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "JWT signing secrets / refresh secrets assigned to variables",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC007",
+    "pattern": "GOCSPX-[A-Za-z0-9_-]{20,}|SG\\.[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}",
+    "flags": "",
+    "category": "hardcoded_secret",
+    "description": "OAuth client secrets, SendGrid, GOCSPX, GitHub secret tokens",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC008",
+    "pattern": "(?:clientSecret|client_secret|refreshToken|refresh_token)\\s*[=:]\\s*['\"`][A-Za-z0-9/_\\-\\.]{16,}['\"`]",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "OAuth client secrets, SendGrid, GOCSPX, GitHub secret tokens",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC009",
+    "pattern": "(?:password|passwd|pwd)\\s*[:=]\\s*['\"`][^'\"`\\s]{6,}['\"`]",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Hardcoded passwords / connection strings with embedded passwords in source code",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC010",
+    "pattern": "redis:\\/\\/:?[^@\\s'\"]{6,}@|mongodb:\\/\\/[^:\\s'\"]+:[^@\\s'\"]{6,}@",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Hardcoded passwords / connection strings with embedded passwords in source code",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC011",
+    "pattern": "(?:ENCRYPTION_KEY|HMAC_KEY|ENCRYPT_KEY|AES_KEY|encKey|EncKey|hmacKey)\\s*[=:]\\s*(?:['\"`]|b['\"])[^\\s'\"]{12,}",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Encryption keys / HMAC keys in const/var",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC012",
+    "pattern": "auth\\s*:\\s*\\{[^}]*pass\\s*:\\s*['\"`][^'\"`\\s]{4,}['\"`]",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "SMTP auth passwords in transport config",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC013",
+    "pattern": "(?:const|let|var|val|final)\\s+\\w*(?:[Tt]oken|[Aa][Pp][Ii][Kk]ey|[Ss]ecret|[Pp]assword|[Pp]asswd)\\w*\\s*[=:]\\s*['\"`][A-Za-z0-9+\\/=_\\-\\.@#!$%^&*]{12,}['\"`]",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Generic hardcoded token/key/secret/apiKey assignment",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC014",
+    "pattern": "Password=[^;\\s'\"]{6,}[;'\"]|pwd=[^;\\s'\"]{6,}[;'\"]",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Connection strings with embedded Password= (SQL Server, ODBC)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC015",
+    "pattern": "AccountKey=[A-Za-z0-9+\\/=]{20,}",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Azure AccountKey= in connection strings (base64 encoded key)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC016",
+    "pattern": "hooks\\.slack\\.com\\/services\\/[A-Z0-9]+\\/[A-Z0-9]+\\/[A-Za-z0-9]+",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Slack webhook URL",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC017",
+    "pattern": "pdkey-[a-z]-[A-Za-z0-9]{16,}",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "PagerDuty / generic pdkey token",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC018",
+    "pattern": "(?:private\\s+)?static\\s+final\\s+String\\s+\\w*(?:SECRET|KEY|TOKEN|PASSWORD|SIGNING)\\w*\\s*=\\s*[\"'][^\"']{12,}[\"']",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Java static final String SECRET/KEY/TOKEN with hardcoded value",
+    "language": [
+      "java"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC019",
+    "pattern": "\\[\\s*\\]byte\\s*\\(\\s*[\"'][^\"']{12,}[\"']\\s*\\)",
+    "flags": "",
+    "category": "hardcoded_secret",
+    "description": "Go []byte(\"hardcoded secret string\") for JWT signing keys",
+    "language": [
+      "go"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC020",
+    "pattern": "(?:AesKey|AesIv|EncKey|HmacKey|aesKey|hmacKey)\\s*=\\s*new\\s+byte\\s*\\[\\s*\\]",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "Hardcoded byte array AES key (C#: new byte[] { 0x2b, 0x7e, ... })",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC021",
+    "pattern": "define\\s*\\(\\s*['\"](?:REDIS_PASSWORD|SESSION_SECRET|CSRF_SECRET|DB_PASS|APP_SECRET|SMTP_PASS|JWT_SECRET)['\"]\\s*,\\s*['\"][^'\"]{6,}['\"]",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "PHP hardcoded secrets: define() with password/secret constants",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "SEC022",
+    "pattern": "const\\s+\\w*(?:SECRET|_SECRET)\\w*\\s*:\\s*string\\s*=\\s*['\"`][^'\"`]{12,}['\"`]",
+    "flags": "i",
+    "category": "hardcoded_secret",
+    "description": "TypeScript: hardcoded secret with type annotation",
+    "language": [
+      "typescript"
+    ],
+    "severity": "critical"
+  }
+]

package/dist/packages/crucible/rules/hardcoded-url.json

@@ -0,0 +1,13 @@
+[
+  {
+    "id": "URL001",
+    "pattern": "const\\s+val\\s+\\w*(?:URL|_URL)\\w*\\s*=\\s*[\"']https?:\\/\\/",
+    "flags": "i",
+    "category": "hardcoded_url",
+    "description": "Kotlin: hardcoded production/debug URLs",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "medium"
+  }
+]

package/dist/packages/crucible/rules/insecure-crypto.json

@@ -0,0 +1,302 @@
+[
+  {
+    "id": "CRYPTO001",
+    "pattern": "md5\\s*\\(|hashlib\\.md5|MessageDigest\\.getInstance\\s*\\(\\s*[\"']MD5[\"']\\)",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Insecure crypto (expanded)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO002",
+    "pattern": "Math\\.random\\s*\\(\\)",
+    "flags": "",
+    "category": "insecure_crypto",
+    "description": "Insecure crypto (expanded)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO003",
+    "pattern": "MD5\\.Create\\s*\\(\\)|MD5\\.HashData\\s*\\(|createHash\\s*\\(\\s*['\"]md5['\"]\\)",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "MD5/SHA1 via language-specific APIs",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO004",
+    "pattern": "crypto\\/md5|use\\s+md5\\b|md5::compute|crypto\\/sha1|use\\s+sha1\\b",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "MD5/SHA1 via language-specific APIs",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO005",
+    "pattern": "MessageDigest\\.getInstance\\s*\\(\\s*[\"']SHA-?1[\"']\\)|SHA1\\s*\\(\\)|sha1\\s*\\(",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "MD5/SHA1 via language-specific APIs",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO006",
+    "pattern": "MD5\\.Create\\s*\\(\\)",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "C# insecure crypto: MD5/DES/SHA1/Random/ECB",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO007",
+    "pattern": "DES\\.Create\\s*\\(\\)|new HMACSHA1\\s*\\(",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "C# insecure crypto: MD5/DES/SHA1/Random/ECB",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO008",
+    "pattern": "CipherMode\\.ECB",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "C# insecure crypto: MD5/DES/SHA1/Random/ECB",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO009",
+    "pattern": "new Random\\s*\\(\\)",
+    "flags": "",
+    "category": "insecure_crypto",
+    "description": "C# insecure crypto: MD5/DES/SHA1/Random/ECB",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO010",
+    "pattern": "md5\\s*\\(\\s*\\$(?:_POST|password|user_pass)\\b",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "PHP insecure crypto",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO011",
+    "pattern": "\\bmd5\\s*\\(\\s*rand\\s*\\(\\s*\\)\\s*\\)|sha1\\s*\\(\\s*\\w+\\s*\\.\\s*time\\s*\\(",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "PHP insecure crypto",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO012",
+    "pattern": "mcrypt_encrypt\\s*\\(\\s*MCRYPT_DES",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "PHP insecure crypto",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO013",
+    "pattern": "\"crypto\\/md5\"|md5\\.Sum\\s*\\(|md5\\.New\\s*\\(",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Go insecure crypto",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO014",
+    "pattern": "\"math\\/rand\"|rand\\.Intn\\s*\\(|rand\\.Seed\\s*\\(",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Go insecure crypto",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO015",
+    "pattern": "\"crypto\\/des\"|des\\.NewCipher\\s*\\(",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Go insecure crypto",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO016",
+    "pattern": "\"crypto\\/sha1\"|sha1\\.New\\s*\\(|hmac\\.New\\s*\\(\\s*sha1\\.New",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Go insecure crypto",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO017",
+    "pattern": "rsa\\.GenerateKey\\s*\\([^,]+,\\s*(?:512|1024)\\s*\\)",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Go insecure crypto",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO018",
+    "pattern": "getInstance\\s*\\(\\s*[\"']DES\\b",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Kotlin/Java: DES cipher usage",
+    "language": [
+      "kotlin",
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO019",
+    "pattern": "(?:private\\s+)?static\\s+final\\s+String\\s+\\w*(?:ALGORITHM|ALGO|CIPHER)\\w*\\s*=\\s*[\"']DES[\"']",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Kotlin/Java: DES cipher usage",
+    "language": [
+      "kotlin",
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO020",
+    "pattern": "==\\s*received_sig\\b|received_sig\\s*==|provided\\s*==\\s*stored\\b",
+    "flags": "",
+    "category": "insecure_crypto",
+    "description": "Python: timing attack via == comparison, low-iteration PBKDF2",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO021",
+    "pattern": "pbkdf2_hmac\\s*\\(\\s*[\"'](?:sha1|md5)[\"'][^)]*,\\s*1000\\s*\\)",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Python: timing attack via == comparison, low-iteration PBKDF2",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO022",
+    "pattern": "\\w*(?:Sig|Signature)\\w*\\s*={2,3}\\s*\\w+|={2,3}\\s*\\w*(?:Sig|Signature)\\w*\\b",
+    "flags": "",
+    "category": "insecure_crypto",
+    "description": "(also matches == after loose-equality mutation of ===)",
+    "language": [
+      "typescript"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO023",
+    "pattern": "provided\\w*\\s*={2,3}\\s*stored\\w*|stored\\w*\\s*={2,3}\\s*provided\\w*",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "(also matches == after loose-equality mutation of ===)",
+    "language": [
+      "typescript"
+    ],
+    "severity": "high"
+  }
+]