thuban 0.4.1 → 0.4.3

package/dist/packages/crucible/rules/path-traversal.json

@@ -0,0 +1,422 @@
+[
+  {
+    "id": "PATH001",
+    "pattern": "include\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST|page|template|lang)|require(?:_once)?\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Path traversal — broader coverage",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH002",
+    "pattern": "path\\.join\\s*\\([^)]*(?:filename|file|name|param|input|req\\.|request\\.|dir\\b|upload)|path\\.resolve\\s*\\([^)]*(?:req\\.|request\\.)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Path traversal — broader coverage",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH003",
+    "pattern": "(?:uploadDir|baseDir|BASE_DIR|downloadDir|uploadRoot|templateRoot|configRoot)\\s*\\+\\s*|os\\.Open\\s*\\([^)]*\\+",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Go path traversal: base path + user input concatenation",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH004",
+    "pattern": "File\\s*\\([^)]*(?:filename|request\\.|params\\[|getParameter)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Kotlin/Java file path",
+    "language": [
+      "kotlin",
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH005",
+    "pattern": "AdmZip|ZipEntry|zipEntry\\.getName\\s*\\(\\)|entry\\.getName|ZipArchive|archive\\.by_index|archive\\.len\\(\\)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Zip-slip",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH006",
+    "pattern": "Path\\.Combine\\s*\\([^)]*(?:reportName|filename|Request\\[|\\.Value\\b|name\\b)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "C# path traversal (Path.Combine with user input, File.WriteAllText)",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH007",
+    "pattern": "File\\.(?:WriteAllText|ReadAllText|Open|ReadAllBytes)\\s*\\([^)]*(?:reportName|filename|Request\\[|\\.Value\\b|path\\b)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "C# path traversal (Path.Combine with user input, File.WriteAllText)",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH008",
+    "pattern": "Path\\.Combine\\s*\\(\\s*\\w+(?:Root|Base|Dir)\\s*,\\s*\\w+\\s*\\)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "C# path traversal via variable named 'path' that was set with Path.Combine + user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH009",
+    "pattern": "\\w+(?:Base|Dir|Path|Folder|Root)\\s*\\+\\s*\\w+(?:Name|File|Path|Input)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "C# path traversal: base string + user-supplied name string concatenation",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH010",
+    "pattern": "File\\.(?:read|write|open|binread)\\s*\\([^)]*#\\{|File\\.(?:read|write|open|binread)\\s*\\(\\s*(?:path|params\\[|request\\.)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Ruby File.read / File.write with string interpolation (user-controlled path)",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH011",
+    "pattern": "[\"'\\/][\\/\\w\\-\\.]*\\/[\"']*#\\{[a-zA-Z_]\\w*\\}[\"']?",
+    "flags": "",
+    "category": "path_traversal",
+    "description": "Ruby path string interpolation: \"/base/path/#{user_var}\"",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH012",
+    "pattern": "filepath\\.Join\\s*\\([^)]*(?:tmpl|template|name|path|param|input|rel|query)\\b",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Go filepath.Join / path.Join without validation",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH013",
+    "pattern": "(?:FileInputStream|FileOutputStream|FileReader|FileWriter)\\s*\\([^)]*\\+\\s*\\w|(?:FileInputStream|FileOutputStream)\\s*\\(\\w+\\s*\\+",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Java FileInputStream / FileOutputStream with string concat",
+    "language": [
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH014",
+    "pattern": "format!\\s*\\(\\s*[\"'][^\"']*\\{[^}]*\\}[^\"']*[\"'][^)]*(?:config|plugin|template|user|path|name)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Rust format! macro constructing file paths from user input",
+    "language": [
+      "rust"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH015",
+    "pattern": "(?:const\\s+\\w+\\s*=\\s*|let\\s+path\\s*=\\s*)format!\\s*\\(\\s*[\"'][^\"']*\\/\\{\\}[\"']",
+    "flags": "",
+    "category": "path_traversal",
+    "description": "Go/Rust const string + user variable for file path",
+    "language": [
+      "go",
+      "rust"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH016",
+    "pattern": "[`\"'][.\\/][^`\"']*\\/\\$\\{(?:req\\.|request\\.|params\\.|query\\.|userInput|filename|template|plugin|name)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "JS template literal path construction: `./dir/${userVar}` or `/base/${param}`",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH017",
+    "pattern": "require(?:_once)?\\s*\\(\\s*['\"][^'\"]*['\"]\\s*\\.\\s*\\$[a-zA-Z_]|include(?:_once)?\\s*\\(\\s*['\"][^'\"]*['\"]\\s*\\.\\s*\\$[a-zA-Z_]",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "PHP require/include with string concatenation: require('dir/' . $var)",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH018",
+    "pattern": "File\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+\\s*\\w|File\\s*\\(\\s*\"\\$|File\\s*\\(\\s*[\"'][^\"']*\\/\"\\s*\\+",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Kotlin/Java File() with string interpolation or parameter variable",
+    "language": [
+      "kotlin",
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH019",
+    "pattern": "%00|\\\\x00|\\\\u0000",
+    "flags": "",
+    "category": "path_traversal",
+    "description": "Null byte injection pattern",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH020",
+    "pattern": "%2e%2e|%252e|%2f%2e",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "URL-encoded traversal: %2e%2e or %2f",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH021",
+    "pattern": "\\binclude\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST|page|template|lang|plugin)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "PHP path traversal",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH022",
+    "pattern": "\\brequire\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST|module|lang|view|component)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "PHP path traversal",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH023",
+    "pattern": "file_get_contents\\s*\\(\\s*\\$(?:_GET|_POST|url|filename|logFile)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "PHP path traversal",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH024",
+    "pattern": "readfile\\s*\\(\\s*\\$(?:base|path|file)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "PHP path traversal",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH025",
+    "pattern": "\\bfopen\\s*\\(\\s*\\$(?:filepath|path|report)\\s*,",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "PHP path traversal",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH026",
+    "pattern": "file_get_contents\\s*\\(\\s*['\"][^\\\"']*['\"]\\s*\\.\\s*\\$(?:filename|file|name|logFile|log)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "PHP path traversal: file_get_contents with string concat to user var",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH027",
+    "pattern": "os\\.Open\\s*\\(\\s*\\w+(?:Dir|Root|Base|Path)\\s*\\+\\s*\\w+",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Go path traversal",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH028",
+    "pattern": "ioutil\\.ReadFile\\s*\\(\\s*\\w+(?:Root|Base|Dir|Path)\\s*\\+\\s*\\w+",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Go path traversal",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH029",
+    "pattern": "os\\.ReadFile\\s*\\(\\s*\\w+(?:Root|Base|Dir|Path)\\s*\\+\\s*\\w+",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Go path traversal",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH030",
+    "pattern": "os\\.Create\\s*\\(\\s*\\w+(?:Base|Dir|Root|Path)\\s*\\+\\s*\\w+",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Go path traversal",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH031",
+    "pattern": "os\\.Remove\\s*\\(\\s*\\w+(?:Root|Base|Dir)\\s*\\+\\s*\\w+",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Go path traversal",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH032",
+    "pattern": "filepath\\.Join\\s*\\([^)]*(?:extractBase|uploadRoot|configRoot|templateRoot|reportBase)\\s*,",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Go path traversal",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "PATH033",
+    "pattern": "\\.resolve\\s*\\(\\s*\\w*(?:Name|name|file|path|template)\\w*\\s*\\)",
+    "flags": "i",
+    "category": "path_traversal",
+    "description": "Java: path traversal via Path.resolve(userInput)",
+    "language": [
+      "java"
+    ],
+    "severity": "high"
+  }
+]

package/dist/packages/crucible/rules/prototype-pollution.json

@@ -0,0 +1,22 @@
+[
+  {
+    "id": "PROTO001",
+    "pattern": "__proto__|\\[\"__proto__\"\\]",
+    "flags": "",
+    "category": "prototype_pollution",
+    "description": "Prototype pollution",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  }
+]