thuban 0.4.10 → 0.4.11

package/dist/packages/crucible/rules/code-scanner-core.json

@@ -0,0 +1,303 @@
+[
+  {
+    "id": "SEC001",
+    "name": "Hardcoded API Key",
+    "type": "hardcoded_secret",
+    "pattern": "['\"](?:sk-|sk_(?:live|test)_|pk-|pk_(?:live|test)_|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]|['\"][a-zA-Z0-9]{32,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Possible hardcoded API key or secret detected",
+    "context": "(api[_-]?key|apikey|secret[_\\s]*key|token|credential|bearer)",
+    "contextFlags": "i",
+    "skipIfSafe": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC001B",
+    "name": "Hardcoded API Key (bare)",
+    "type": "hardcoded_secret",
+    "pattern": "['\"](?:sk-|sk_(?:live|test)_|pk-|pk_(?:live|test)_|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Possible hardcoded API key or secret detected",
+    "skipIfSafe": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC002",
+    "name": "Hardcoded Password",
+    "type": "hardcoded_secret",
+    "pattern": "password\\s*[:=]\\s*['\"][^'\"]+['\"]",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded password detected",
+    "skipIfSafe": true,
+    "skipInTests": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC002B",
+    "name": "Hardcoded Password (JSON key)",
+    "type": "hardcoded_secret",
+    "pattern": "[\"']password[\"']\\s*:\\s*[\"'][^\"']+[\"']",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded password detected",
+    "skipIfSafe": true,
+    "skipInTests": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC003",
+    "name": "SQL Injection Risk",
+    "type": "sql_injection",
+    "pattern": "\\b(?:SELECT|INSERT\\s+INTO|UPDATE|DELETE\\s+FROM|WHERE)\\b.*(\\$\\{|#\\{|\\+\\s*['\"]|\\+\\s*\\w+|f['\"].*\\{|%s|%d)",
+    "flags": "i",
+    "severity": "error",
+    "message": "Potential SQL injection - use parameterized queries",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-89"
+  },
+  {
+    "id": "SEC004",
+    "name": "eval() Usage",
+    "type": "eval_abuse",
+    "pattern": "\\beval\\s*\\(\\s*[^\\s)]",
+    "flags": "",
+    "severity": "error",
+    "message": "eval() is dangerous and should be avoided",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-95"
+  },
+  {
+    "id": "SEC004B",
+    "name": "eval() Usage (unicode-escaped)",
+    "type": "eval_abuse",
+    "pattern": "\\\\u0065\\\\u0076\\\\u0061\\\\u006[cC]",
+    "flags": "",
+    "severity": "error",
+    "message": "Obfuscated eval() usage (unicode escapes) is dangerous and should be avoided",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-95"
+  },
+  {
+    "id": "SEC005",
+    "name": "innerHTML/document.write Assignment",
+    "type": "xss",
+    "pattern": "\\.innerHTML\\s*=|\\bdocument\\.write\\s*\\(",
+    "flags": "",
+    "severity": "warning",
+    "message": "innerHTML/document.write can cause XSS - consider using textContent or sanitization",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-79"
+  },
+  {
+    "id": "SEC006",
+    "name": "Disabled Security",
+    "type": "insecure_config",
+    "pattern": "rejectUnauthorized\\s*:\\s*false|verify\\s*=\\s*False|InsecureSkipVerify\\s*:\\s*true",
+    "flags": "",
+    "severity": "error",
+    "message": "SSL certificate validation disabled",
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-295"
+  },
+  {
+    "id": "SEC007",
+    "name": "Exposed .env Reference",
+    "type": "insecure_config",
+    "pattern": "\\.env['\"]",
+    "flags": "",
+    "severity": "warning",
+    "message": "Direct .env file manipulation - ensure not exposed",
+    "context": "fs\\.(read|write)|path\\.join|open\\s*\\(|os\\.Open",
+    "contextFlags": "i",
+    "owasp": "A05:2021 Security Misconfiguration",
+    "cwe": "CWE-538"
+  },
+  {
+    "id": "SEC008",
+    "name": "Unsafe Block (Rust)",
+    "type": "memory_safety",
+    "pattern": "\\bunsafe\\s*\\{",
+    "flags": "",
+    "severity": "warning",
+    "message": "Rust unsafe block - verify memory safety guarantees",
+    "owasp": "A06:2021 Vulnerable and Outdated Components",
+    "cwe": "CWE-787"
+  },
+  {
+    "id": "SEC009",
+    "name": "Shell Execution (PHP/Ruby/Python)",
+    "type": "command_injection",
+    "pattern": "\\bshell_exec\\s*\\(|\\bpassthru\\s*\\(|\\bos\\.system\\s*\\(|\\bos\\.popen\\s*\\(|\\bsubprocess\\.(?:call|run|Popen|check_output)\\s*\\([^)]*shell\\s*=\\s*True|\\bexec\\s*\\(\\s*[\"']|\\bsystem\\s*\\(\\s*[\"']",
+    "flags": "",
+    "severity": "error",
+    "message": "Shell/OS execution function — command injection risk if input unsanitized",
+    "excludeExtensions": [".js", ".ts", ".jsx", ".tsx", ".mjs", ".cjs"],
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-78"
+  },
+  {
+    "id": "SEC010",
+    "name": "Prototype Pollution",
+    "type": "prototype_pollution",
+    "pattern": "\\[\\s*['\"]__proto__['\"]\\s*\\]|\\.__proto__\\s*(=|\\[)|constructor\\s*\\[\\s*['\"]prototype['\"]\\s*\\]|constructor\\.prototype\\s*(=|\\[)|['\"]__proto__['\"]\\s*:",
+    "flags": "",
+    "severity": "error",
+    "message": "Possible prototype pollution via __proto__/constructor.prototype",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-1321"
+  },
+  {
+    "id": "SEC011",
+    "name": "PHP SQL Injection (dot concatenation)",
+    "type": "sql_injection",
+    "pattern": "\"SELECT[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"UPDATE[^\"]*SET[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"DELETE[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\\$(?:query|sql|qry)\\s*\\.=\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE)",
+    "flags": "i",
+    "severity": "critical",
+    "message": "PHP SQL injection: user input concatenated into SQL query with dot operator — use PDO prepared statements",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-89"
+  },
+  {
+    "id": "SEC012",
+    "name": "PHP XSS (echo with user input)",
+    "type": "xss",
+    "pattern": "echo\\s+(?!htmlspecialchars|htmlentities|strip_tags|esc_html).*\\$(?:_GET|_POST|_REQUEST|_COOKIE)|echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE)|print\\s+\\$(?:_GET|_POST|_REQUEST|_COOKIE)",
+    "flags": "i",
+    "severity": "error",
+    "message": "PHP XSS: unescaped user input echoed to page — use htmlspecialchars()",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-79"
+  },
+  {
+    "id": "SEC013",
+    "name": "Hardcoded JWT Token",
+    "type": "hardcoded_secret",
+    "pattern": "['\"]eyJ[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Hardcoded JWT token detected — rotate immediately and use environment variables",
+    "skipIfSafe": true,
+    "skipInTests": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC014",
+    "name": "Hardcoded PEM Private Key",
+    "type": "hardcoded_secret",
+    "pattern": "-----BEGIN (?:RSA |EC )?PRIVATE KEY-----",
+    "flags": "",
+    "severity": "critical",
+    "message": "Private key embedded in source code — move to secure key store or environment variable",
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-321"
+  },
+  {
+    "id": "SEC015",
+    "name": "Hardcoded AWS Secret Access Key",
+    "type": "hardcoded_secret",
+    "pattern": "(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY|SecretAccessKey)\\s*[:=]\\s*['\"][A-Za-z0-9/+=]{40}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "AWS Secret Access Key hardcoded — use IAM roles or environment variables",
+    "skipIfSafe": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC016",
+    "name": "Rust Hardcoded Secret (const &str)",
+    "type": "hardcoded_secret",
+    "pattern": "const\\s+(?:PASSWORD|SECRET|API_KEY|TOKEN|PRIVATE_KEY|DB_PASS)\\s*:\\s*&str\\s*=\\s*\"[^\"]+\"",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded secret in Rust const — use environment variables at runtime",
+    "skipInTests": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC017",
+    "name": "Rust format! SQL Injection",
+    "type": "sql_injection",
+    "pattern": "format!\\s*\\(\\s*\"(?:SELECT|INSERT|UPDATE|DELETE|WHERE)[^\"]*\\{",
+    "flags": "i",
+    "severity": "error",
+    "message": "SQL query built with format!() macro — use parameterized queries (sqlx::query! or bind)",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-89"
+  },
+  {
+    "id": "SEC018",
+    "name": "Ruby String Interpolation XSS/Injection",
+    "type": "xss",
+    "pattern": "[\"'](?:SELECT|INSERT|UPDATE|DELETE|WHERE|<)[^\"']*#\\{[^}]*(?:params|request|input|user|cookies|session)[^}]*\\}",
+    "flags": "i",
+    "severity": "error",
+    "message": "User input interpolated via Ruby #{} into SQL/HTML — use parameterized queries or sanitize",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-89"
+  },
+  {
+    "id": "SEC019",
+    "name": "Go format SQL Injection",
+    "type": "sql_injection",
+    "pattern": "fmt\\.Sprintf\\s*\\(\\s*\"(?:SELECT|INSERT|UPDATE|DELETE|WHERE)[^\"]*%[sv]",
+    "flags": "i",
+    "severity": "error",
+    "message": "SQL query built with fmt.Sprintf — use parameterized queries (db.Query with $1/? placeholders)",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-89"
+  },
+  {
+    "id": "RUST001",
+    "name": "Rust Deprecated API (mem::uninitialized)",
+    "type": "deprecated_api",
+    "pattern": "mem::uninitialized\\s*\\(|MaybeUninit::uninit\\(\\)\\.assume_init\\(\\)",
+    "flags": "",
+    "severity": "error",
+    "message": "mem::uninitialized is UB since Rust 1.39 — use MaybeUninit::zeroed() or MaybeUninit with proper init",
+    "owasp": "A06:2021 Vulnerable and Outdated Components",
+    "cwe": "CWE-908"
+  },
+  {
+    "id": "RUST002",
+    "name": "Rust Deprecated trim_left/trim_right",
+    "type": "deprecated_api",
+    "pattern": "\\.trim_left\\(\\)|\\.trim_right\\(\\)|\\.trim_left_matches\\(|\\.trim_right_matches\\(",
+    "flags": "",
+    "severity": "warning",
+    "message": "trim_left/trim_right deprecated since Rust 1.33 — use trim_start/trim_end",
+    "owasp": "A06:2021 Vulnerable and Outdated Components",
+    "cwe": "CWE-477"
+  },
+  {
+    "id": "SEC020",
+    "name": "C# String Interpolation SQL Injection",
+    "type": "sql_injection",
+    "pattern": "\\$\"[^\"]*(?:SELECT|INSERT|UPDATE|DELETE|WHERE)[^\"]*\\{",
+    "flags": "i",
+    "severity": "error",
+    "message": "SQL query built with C# string interpolation — use parameterized queries (SqlCommand.Parameters)",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-89"
+  },
+  {
+    "id": "SEC021",
+    "name": "PHP Variable Interpolation SQL Injection",
+    "type": "sql_injection",
+    "pattern": "\"(?:SELECT|INSERT|UPDATE|DELETE|WHERE)[^\"]*\\$[a-zA-Z_][a-zA-Z0-9_]*[^\"]*\"",
+    "flags": "i",
+    "severity": "critical",
+    "message": "SQL query built with PHP variable interpolation — use PDO prepared statements",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-89"
+  }
+]