thuban 0.4.1 → 0.4.3

package/dist/packages/crucible/rules/insecure-crypto.json

@@ -0,0 +1,302 @@
+[
+  {
+    "id": "CRYPTO001",
+    "pattern": "md5\\s*\\(|hashlib\\.md5|MessageDigest\\.getInstance\\s*\\(\\s*[\"']MD5[\"']\\)",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Insecure crypto (expanded)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO002",
+    "pattern": "Math\\.random\\s*\\(\\)",
+    "flags": "",
+    "category": "insecure_crypto",
+    "description": "Insecure crypto (expanded)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO003",
+    "pattern": "MD5\\.Create\\s*\\(\\)|MD5\\.HashData\\s*\\(|createHash\\s*\\(\\s*['\"]md5['\"]\\)",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "MD5/SHA1 via language-specific APIs",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO004",
+    "pattern": "crypto\\/md5|use\\s+md5\\b|md5::compute|crypto\\/sha1|use\\s+sha1\\b",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "MD5/SHA1 via language-specific APIs",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO005",
+    "pattern": "MessageDigest\\.getInstance\\s*\\(\\s*[\"']SHA-?1[\"']\\)|SHA1\\s*\\(\\)|sha1\\s*\\(",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "MD5/SHA1 via language-specific APIs",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO006",
+    "pattern": "MD5\\.Create\\s*\\(\\)",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "C# insecure crypto: MD5/DES/SHA1/Random/ECB",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO007",
+    "pattern": "DES\\.Create\\s*\\(\\)|new HMACSHA1\\s*\\(",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "C# insecure crypto: MD5/DES/SHA1/Random/ECB",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO008",
+    "pattern": "CipherMode\\.ECB",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "C# insecure crypto: MD5/DES/SHA1/Random/ECB",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO009",
+    "pattern": "new Random\\s*\\(\\)",
+    "flags": "",
+    "category": "insecure_crypto",
+    "description": "C# insecure crypto: MD5/DES/SHA1/Random/ECB",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO010",
+    "pattern": "md5\\s*\\(\\s*\\$(?:_POST|password|user_pass)\\b",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "PHP insecure crypto",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO011",
+    "pattern": "\\bmd5\\s*\\(\\s*rand\\s*\\(\\s*\\)\\s*\\)|sha1\\s*\\(\\s*\\w+\\s*\\.\\s*time\\s*\\(",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "PHP insecure crypto",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO012",
+    "pattern": "mcrypt_encrypt\\s*\\(\\s*MCRYPT_DES",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "PHP insecure crypto",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO013",
+    "pattern": "\"crypto\\/md5\"|md5\\.Sum\\s*\\(|md5\\.New\\s*\\(",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Go insecure crypto",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO014",
+    "pattern": "\"math\\/rand\"|rand\\.Intn\\s*\\(|rand\\.Seed\\s*\\(",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Go insecure crypto",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO015",
+    "pattern": "\"crypto\\/des\"|des\\.NewCipher\\s*\\(",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Go insecure crypto",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO016",
+    "pattern": "\"crypto\\/sha1\"|sha1\\.New\\s*\\(|hmac\\.New\\s*\\(\\s*sha1\\.New",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Go insecure crypto",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO017",
+    "pattern": "rsa\\.GenerateKey\\s*\\([^,]+,\\s*(?:512|1024)\\s*\\)",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Go insecure crypto",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO018",
+    "pattern": "getInstance\\s*\\(\\s*[\"']DES\\b",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Kotlin/Java: DES cipher usage",
+    "language": [
+      "kotlin",
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO019",
+    "pattern": "private\\s+static\\s+final\\s+String\\s+\\w*(?:ALGORITHM|ALGO|CIPHER)\\w*\\s*=\\s*[\"']DES[\"']|static\\s+final\\s+String\\s+\\w*(?:ALGORITHM|ALGO|CIPHER)\\w*\\s*=\\s*[\"']DES[\"']",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Kotlin/Java: DES cipher usage",
+    "language": [
+      "kotlin",
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO020",
+    "pattern": "==\\s*received_sig\\b|received_sig\\s*==|provided\\s*==\\s*stored\\b",
+    "flags": "",
+    "category": "insecure_crypto",
+    "description": "Python: timing attack via == comparison, low-iteration PBKDF2",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO021",
+    "pattern": "pbkdf2_hmac\\s*\\(\\s*[\"'](?:sha1|md5)[\"'][^)]*,\\s*1000\\s*\\)",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "Python: timing attack via == comparison, low-iteration PBKDF2",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO022",
+    "pattern": "\\w*(?:Sig|Signature)\\w*\\s*={2,3}\\s*\\w+|={2,3}\\s*\\w*(?:Sig|Signature)\\w*\\b",
+    "flags": "",
+    "category": "insecure_crypto",
+    "description": "(also matches == after loose-equality mutation of ===)",
+    "language": [
+      "typescript"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "CRYPTO023",
+    "pattern": "provided\\w*\\s*={2,3}\\s*stored\\w*|stored\\w*\\s*={2,3}\\s*provided\\w*",
+    "flags": "i",
+    "category": "insecure_crypto",
+    "description": "(also matches == after loose-equality mutation of ===)",
+    "language": [
+      "typescript"
+    ],
+    "severity": "high"
+  }
+]

package/dist/packages/crucible/rules/integer-overflow.json

@@ -0,0 +1,35 @@
+[
+  {
+    "id": "INT001",
+    "pattern": "\\bas\\s+(?:u8|u16|u32|i8|i16|i32|i64|usize)\\b",
+    "flags": "",
+    "category": "integer_overflow",
+    "description": "Cast truncation: `val as u8/u16/u32/i32/usize` silently drops bits",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "INT002",
+    "pattern": "\\w+\\s*\\*\\s*\\w*(?:size|len)\\w*\\b",
+    "flags": "i",
+    "category": "integer_overflow",
+    "description": "Allocation size computed from untrusted multiplication (user_size * element_size)",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "INT003",
+    "pattern": "\\[\\s*(?:index|idx|start\\.\\.end)\\s*\\]|\\[\\s*row\\s*\\]\\s*\\[\\s*col\\s*\\]|\\[\\s*n\\s*\\]",
+    "flags": "",
+    "category": "integer_overflow",
+    "description": "Array/slice indexing with named variable index / range (no bounds check)",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  }
+]

package/dist/packages/crucible/rules/log-injection.json

@@ -0,0 +1,33 @@
+[
+  {
+    "id": "LOG001",
+    "pattern": "logger\\.(?:info|error|warn|debug)\\s*\\(.*\\+\\s*\\w+",
+    "flags": "",
+    "category": "log_injection",
+    "description": "Log injection",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "LOG002",
+    "pattern": "\\blog\\.(?:info|error|warn|debug)\\s*\\(.*\\+\\s*\\w+",
+    "flags": "",
+    "category": "log_injection",
+    "description": "Java: log4j log.* injection (lowercase `log` logger variable)",
+    "language": [
+      "java"
+    ],
+    "severity": "medium"
+  }
+]

package/dist/packages/crucible/rules/mass-assignment.json

@@ -0,0 +1,112 @@
+[
+  {
+    "id": "MASS001",
+    "pattern": "params\\[:\\w+\\]\\.permit!",
+    "flags": "i",
+    "category": "mass_assignment",
+    "description": "Ruby mass assignment",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "MASS002",
+    "pattern": "\\.update_attributes\\s*\\(\\s*params",
+    "flags": "i",
+    "category": "mass_assignment",
+    "description": "Ruby mass assignment",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "MASS003",
+    "pattern": "\\.update\\s*\\(\\s*params\\[:\\w+\\]\\s*\\)",
+    "flags": "i",
+    "category": "mass_assignment",
+    "description": "Ruby mass assignment",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "MASS004",
+    "pattern": "\\.create\\s*\\(\\s*params\\b(?!\\s*[.\\[])|User\\.create_from_params",
+    "flags": "i",
+    "category": "mass_assignment",
+    "description": "Ruby mass assignment: create/new/update with unfiltered params hash",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "MASS005",
+    "pattern": "\\.new\\s*\\(\\s*registration_params\\b",
+    "flags": "i",
+    "category": "mass_assignment",
+    "description": "Ruby mass assignment: create/new/update with unfiltered params hash",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "MASS006",
+    "pattern": "params\\.require\\s*\\([^)]+\\)\\.permit!",
+    "flags": "i",
+    "category": "mass_assignment",
+    "description": "Ruby mass assignment: create/new/update with unfiltered params hash",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "MASS007",
+    "pattern": "update_attributes!\\s*\\(\\s*\\w*(?:request_params|attrs|hash)",
+    "flags": "i",
+    "category": "mass_assignment",
+    "description": "Ruby mass assignment: create/new/update with unfiltered params hash",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "MASS008",
+    "pattern": "\\.create!\\s*\\(\\s*attrs\\s*\\)",
+    "flags": "i",
+    "category": "mass_assignment",
+    "description": "Ruby mass assignment: create/new/update with unfiltered params hash",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "MASS009",
+    "pattern": "\\bcreate\\s*\\(\\s*params\\s*\\)",
+    "flags": "",
+    "category": "mass_assignment",
+    "description": "Ruby mass assignment: bare create(params)/new(registration_params) call (no receiver dot)",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "MASS010",
+    "pattern": "\\bnew\\s*\\(\\s*registration_params\\b",
+    "flags": "i",
+    "category": "mass_assignment",
+    "description": "Ruby mass assignment: bare create(params)/new(registration_params) call (no receiver dot)",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  }
+]

package/dist/packages/crucible/rules/open-redirect.json

@@ -0,0 +1,196 @@
+[
+  {
+    "id": "REDIR001",
+    "pattern": "redirect_to\\s+params\\[|redirect_to\\s+\\w+\\s*\\|\\||http\\.Redirect\\s*\\([^)]*r\\.Header|Response\\.Redirect\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Open redirect (various frameworks)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR002",
+    "pattern": "http\\.Redirect\\s*\\([^,]+,\\s*[^,]+,\\s*(?:returnURL|redirectTo|returnUrl|returnTo|referer|destination)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Go open redirect: http.Redirect with user-controlled variable (returnURL etc.)",
+    "language": [
+      "go"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR003",
+    "pattern": "r\\.URL\\.Query\\(\\)\\.Get\\s*\\(\\s*[\"']return",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Go open redirect: r.URL.Query() used as redirect target",
+    "language": [
+      "go"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR004",
+    "pattern": "Redirect\\s*\\(\\s*(?:\\w*[Uu]rl|returnUrl)\\b",
+    "flags": "",
+    "category": "open_redirect",
+    "description": "Open redirect",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR005",
+    "pattern": "context\\.Response\\.Redirect\\s*\\(\\s*(?:next|url|returnUrl|redirect)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "C# open redirect",
+    "language": [
+      "csharp"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR006",
+    "pattern": "return Redirect\\s*\\(\\s*(?:returnUrl|destination|state|next)\\s*\\)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "C# open redirect",
+    "language": [
+      "csharp"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR007",
+    "pattern": "redirect_to\\s+params\\[:\\w+\\]",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Ruby open redirect",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR008",
+    "pattern": "redirect_to\\s+(?:next_url|callback|destination|target)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Ruby open redirect",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR009",
+    "pattern": "header\\s*\\(\\s*[\"']Location:[\"']\\s*\\.\\s*\\$(?:_GET|_POST|url|next|redirect)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "PHP open redirect: header Location",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR010",
+    "pattern": "header\\s*\\(\\s*[\"']Location:[\"']\\s*\\.\\s*\\$",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "PHP open redirect: header Location",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR011",
+    "pattern": "header\\s*\\(\\s*['\"]Location:\\s*['\"]\\s*\\.\\s*\\$(?:url|next|redirect|return_to|target|to)\\b",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "PHP open redirect: header('Location') with user-controlled variable",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR012",
+    "pattern": "header\\s*\\(\\s*['\"]Location:\\s*['\"]\\s*\\.\\s*\\$(?:_GET|_POST|_REQUEST)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "PHP open redirect: header('Location') with user-controlled variable",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR013",
+    "pattern": "header\\s*\\(\\s*\"Location:\\s*\\$(?:url|next|redirect|target|return)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "PHP open redirect: header('Location') with user-controlled variable",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR014",
+    "pattern": "header\\s*\\(\\s*\"Location:\\s*\"\\.\\s*\\$\\w",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "PHP open redirect: header('Location') with user-controlled variable",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR015",
+    "pattern": "http\\.Redirect\\s*\\(\\s*w\\s*,\\s*r\\s*,\\s*(?:returnURL|returnUrl|destination|state|next|returnTo|referer)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Go open redirect",
+    "language": [
+      "go"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR016",
+    "pattern": "http\\.Redirect\\s*\\(\\s*w\\s*,\\s*r\\s*,\\s*(?:string\\()?\\s*(?:returnURL|returnUrl|destination|state|next|returnTo|referer)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Go: timing attack via != comparison of tokens; open redirect via decoded state",
+    "language": [
+      "go"
+    ],
+    "severity": "medium"
+  }
+]