thuban 0.4.1 → 0.4.3

package/dist/packages/crucible/rules/ssrf.json

@@ -0,0 +1,557 @@
+[
+  {
+    "id": "SSRF001",
+    "pattern": "\\bhttp\\s*\\.\\s*Get\\s*\\(\\s*\\w+[Uu][Rr][Ll]\\b|\\bhttp\\s*\\.\\s*Get\\s*\\(\\s*(?:target|url|endpoint|src|source)\\b",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Go: http.Get() with any variable (targetURL, avatarURL, etc.)",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF002",
+    "pattern": "\\bDownloadString\\s*\\(\\s*\\w*[Uu]rl\\b|\\bDownloadString\\s*\\(\\s*(?:url|target|endpoint)\\b",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — C#: WebClient.DownloadString(variable), HttpClient BaseAddress from Uri(variable)",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF003",
+    "pattern": "new\\s+System\\.Uri\\s*\\(\\s*\\w*[Uu]rl\\b|new\\s+Uri\\s*\\(\\s*\\w*(?:[Uu]rl|[Ee]ndpoint|[Ss]ervice)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — C#: WebClient.DownloadString(variable), HttpClient BaseAddress from Uri(variable)",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF004",
+    "pattern": "requests\\.get\\s*\\(\\s*(?:url|URL)\\b|http\\.get\\s*\\([^)]*req\\.|fetchUrl\\s*\\(.*req",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF (original patterns)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF005",
+    "pattern": "got\\s*\\(\\s*(?:url|targetUrl|userUrl)|superagent\\.get\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF (original patterns)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF006",
+    "pattern": "new\\s+URL\\s*\\([^)]*(?:req\\.|request\\.|getParameter|FormValue)\\s*|URL\\.openConnection|URL\\.openStream",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF (original patterns)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF007",
+    "pattern": "HttpClient.*GetAsync\\s*\\(\\s*\\w*[Uu]rl|HttpClient.*PostAsync\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF (original patterns)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF008",
+    "pattern": "fetch\\s*\\(\\s*(?:req\\.|request\\.|url|targetUrl|webhookUrl|userUrl)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "fetch with user URL",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF009",
+    "pattern": "axios\\s*\\.\\s*(?:get|post|put|delete|request)\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — JS/TS: axios (get/post/put), https.get, broader fetch patterns",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF010",
+    "pattern": "axios\\s*\\.\\s*(?:get|post|put|delete)\\s*\\(\\s*(?:url|source|endpoint|target|webhook|dataUrl|avatar|oembedUrl)\\b",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — JS/TS: axios (get/post/put), https.get, broader fetch patterns",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF011",
+    "pattern": "https?\\s*\\.\\s*get\\s*\\(\\s*\\w*[Uu]rl|\\bhttps\\s*\\.\\s*get\\s*\\(",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — JS/TS: axios (get/post/put), https.get, broader fetch patterns",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF012",
+    "pattern": "fetch\\s*\\(\\s*(?:dataUrl|endpoint|source|avatarUrl|oembedUrl|callbackUrl|profileUrl)\\b",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — JS/TS: axios (get/post/put), https.get, broader fetch patterns",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF013",
+    "pattern": "httpx\\s*\\.\\s*(?:get|post|AsyncClient|Client)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Python: httpx, urllib.request, aiohttp, requests.post",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF014",
+    "pattern": "urllib\\s*\\.\\s*request\\s*\\.\\s*urlopen\\s*\\(",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Python: httpx, urllib.request, aiohttp, requests.post",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF015",
+    "pattern": "aiohttp\\s*\\.\\s*ClientSession",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Python: httpx, urllib.request, aiohttp, requests.post",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF016",
+    "pattern": "requests\\s*\\.\\s*(?:post|put|head|session)\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Python: httpx, urllib.request, aiohttp, requests.post",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF017",
+    "pattern": "http\\s*\\.\\s*Post\\s*\\(\\s*\\w*[Uu]rl|http\\s*\\.\\s*Post\\s*\\(\\s*(?:webhookURL|endpoint)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Go: http.Post, http.NewRequest + client.Do",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF018",
+    "pattern": "http\\s*\\.\\s*NewRequest\\s*\\([^)]*,\\s*\\w*(?:[Uu]rl|[Ee]ndpoint)",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Go: http.Post, http.NewRequest + client.Do",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF019",
+    "pattern": "HttpRequest\\s*\\.\\s*newBuilder\\s*\\(\\s*\\)\\s*\\.\\s*uri\\s*\\(",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Java: Java 11 HttpClient / HttpRequest.newBuilder",
+    "language": [
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF020",
+    "pattern": "OkHttpClient\\s*\\(\\s*\\)|Request\\s*\\.\\s*Builder\\s*\\(\\s*\\)\\s*\\.\\s*url\\s*\\(",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Kotlin: OkHttpClient, Ktor httpClient, URL().readBytes, URL composed from host/port",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF021",
+    "pattern": "httpClient\\s*\\.\\s*get\\s*\\(\\s*\\w*[Uu]rl|httpClient\\s*\\.\\s*get\\s*\\(\\s*\"",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Kotlin: OkHttpClient, Ktor httpClient, URL().readBytes, URL composed from host/port",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF022",
+    "pattern": "URL\\s*\\([^)]*\\)\\s*\\.\\s*(?:readBytes|readText|openStream|openConnection)",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Kotlin: OkHttpClient, Ktor httpClient, URL().readBytes, URL composed from host/port",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF023",
+    "pattern": "new\\s+WebClient\\s*\\(\\s*\\)\\s*\\.\\s*(?:DownloadString|DownloadData|OpenRead)",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — C#: WebClient.DownloadString, WebRequest.Create",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF024",
+    "pattern": "WebRequest\\s*\\.\\s*Create\\s*\\(\\s*\\w*[Uu]rl|WebRequest\\s*\\.\\s*Create\\s*\\(\\s*\\w*(?:endpoint|target)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — C#: WebClient.DownloadString, WebRequest.Create",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF025",
+    "pattern": "file_get_contents\\s*\\(\\s*\\$[a-zA-Z_]",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — PHP: file_get_contents, curl_init/curl_exec",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF026",
+    "pattern": "curl_init\\s*\\(\\s*\\$[a-zA-Z_]|curl_exec\\s*\\(\\s*\\$[a-zA-Z_]",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — PHP: file_get_contents, curl_init/curl_exec",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF027",
+    "pattern": "Net\\s*::\\s*HTTP\\s*\\.\\s*(?:get|get_response|start)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF028",
+    "pattern": "HTTParty\\s*\\.\\s*(?:get|post)\\s*\\(",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF029",
+    "pattern": "Faraday\\s*\\.\\s*new\\s*\\(",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF030",
+    "pattern": "URI\\s*\\.\\s*open\\s*\\(\\s*\\w*[Uu]rl|URI\\s*\\.\\s*open\\s*\\(\\s*(?:resource|source|target)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF031",
+    "pattern": "RestClient\\s*\\.\\s*(?:get|post)\\s*\\(",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF032",
+    "pattern": "reqwest\\s*::\\s*(?:get|Client)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Rust: reqwest::get, reqwest Client builder",
+    "language": [
+      "rust"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF033",
+    "pattern": "client\\s*\\.\\s*(?:get|post)\\s*\\(\\s*&?\\s*(?:url|user_url|req\\.|payload\\.)",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Rust: reqwest::get, reqwest Client builder",
+    "language": [
+      "rust"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF034",
+    "pattern": "new WebClient\\s*\\(\\)|WebRequest\\.Create\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "C# SSRF: WebClient, HttpClient, WebRequest",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF035",
+    "pattern": "client\\.DownloadString\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "C# SSRF: WebClient, HttpClient, WebRequest",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF036",
+    "pattern": "_httpClient\\.(?:GetAsync|PostAsync)\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "C# SSRF: WebClient, HttpClient, WebRequest",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF037",
+    "pattern": "Net::HTTP\\.get_response\\s*\\(",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF038",
+    "pattern": "HTTParty\\.(?:get|post)\\s*\\(\\s*\\w*(?:[Uu]rl|callback|target)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF039",
+    "pattern": "Faraday\\.new\\s*\\(\\s*url:\\s*\\w*(?:[Uu]rl|source_url|feed_url)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF040",
+    "pattern": "RestClient\\.(?:get|post)\\s*\\(\\s*\\w*(?:[Uu]rl|target|host)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF041",
+    "pattern": "URI\\.open\\s*\\(\\s*\\w*(?:[Uu]rl|resource_url|avatar_url)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF042",
+    "pattern": "file_get_contents\\s*\\(\\s*\\$(?:_GET|_POST|url|imageUrl)\\b",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "PHP SSRF",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF043",
+    "pattern": "curl_init\\s*\\(\\s*\\$(?:_POST|_GET|url|target|webhook_url)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "PHP SSRF",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF044",
+    "pattern": "http\\.Get\\s*\\(\\s*\\w*(?:[Uu]rl|[Tt]arget|[Ee]ndpoint|[Ww]ebhook|[Aa]vatar)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Go SSRF",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF045",
+    "pattern": "http\\.Post\\s*\\(\\s*\\w*(?:[Uu]rl|[Ww]ebhook)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Go SSRF",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF046",
+    "pattern": "http\\.NewRequest\\s*\\(\\s*\"GET\"\\s*,\\s*\\w*(?:[Uu]rl|[Ee]ndpoint)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Go SSRF",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  }
+]

package/dist/packages/crucible/rules/timing-attack.json

@@ -0,0 +1,55 @@
+[
+  {
+    "id": "TIME001",
+    "pattern": "token\\s*==\\s*validToken|return\\s+token\\s*==\\s*",
+    "flags": "",
+    "category": "timing_attack",
+    "description": "Timing attack",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "TIME002",
+    "pattern": "bytes\\.Equal\\s*\\(\\s*expected\\s*,\\s*received\\s*\\)",
+    "flags": "i",
+    "category": "timing_attack",
+    "description": "Go timing attack",
+    "language": [
+      "go"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "TIME003",
+    "pattern": "token\\s*!=\\s*validAPIToken\\b",
+    "flags": "",
+    "category": "timing_attack",
+    "description": "Go timing attack",
+    "language": [
+      "go"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "TIME004",
+    "pattern": "\\w*[Tt]oken\\s*!=\\s*\\w*[Tt]oken\\b",
+    "flags": "",
+    "category": "timing_attack",
+    "description": "Go: timing attack via != comparison of tokens; open redirect via decoded state",
+    "language": [
+      "go"
+    ],
+    "severity": "medium"
+  }
+]

package/dist/packages/crucible/rules/unsafe-block.json

@@ -0,0 +1,24 @@
+[
+  {
+    "id": "UNSAFE001",
+    "pattern": "unsafe\\s*\\{|mem::transmute",
+    "flags": "",
+    "category": "unsafe_block",
+    "description": "Unsafe blocks (Rust)",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "UNSAFE002",
+    "pattern": "unsafe\\s+impl\\s+(?:Send|Sync)\\b",
+    "flags": "",
+    "category": "unsafe_block",
+    "description": "Rust: unsafe impl Send/Sync for non-thread-safe types",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  }
+]