thuban 0.4.3 → 0.4.5

package/dist/packages/crucible/rules/crypto-misuse.json

@@ -1,35 +1,35 @@
-[
-  {
-    "id": "CMISUSE001",
-    "pattern": "use\\s+md5\\b|md5::compute|ecb_encrypt|AesCipher|nonce\\s*=\\s*0\\b",
-    "flags": "i",
-    "category": "crypto_misuse",
-    "description": "crypto_misuse (Rust-specific)",
-    "language": [
-      "rust"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "CMISUSE002",
-    "pattern": "\\bxor_encrypt\\b|\\bxor_decrypt\\b|\\brot13\\b|\\bcaesar_cipher\\b",
-    "flags": "i",
-    "category": "crypto_misuse",
-    "description": "Rust: crypto misuse (homegrown ciphers)",
-    "language": [
-      "rust"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "CMISUSE003",
-    "pattern": "struct\\s+Rc4\\b|\\brc4\\b",
-    "flags": "i",
-    "category": "crypto_misuse",
-    "description": "Rust: crypto misuse (homegrown ciphers)",
-    "language": [
-      "rust"
-    ],
-    "severity": "medium"
-  }
-]
+[
+  {
+    "id": "CMISUSE001",
+    "pattern": "use\\s+md5\\b|md5::compute|ecb_encrypt|AesCipher|nonce\\s*=\\s*0\\b",
+    "flags": "i",
+    "category": "crypto_misuse",
+    "description": "crypto_misuse (Rust-specific)",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "CMISUSE002",
+    "pattern": "\\bxor_encrypt\\b|\\bxor_decrypt\\b|\\brot13\\b|\\bcaesar_cipher\\b",
+    "flags": "i",
+    "category": "crypto_misuse",
+    "description": "Rust: crypto misuse (homegrown ciphers)",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "CMISUSE003",
+    "pattern": "struct\\s+Rc4\\b|\\brc4\\b",
+    "flags": "i",
+    "category": "crypto_misuse",
+    "description": "Rust: crypto misuse (homegrown ciphers)",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  }
+]

package/dist/packages/crucible/rules/deserialization.json

@@ -1,152 +1,152 @@
-[
-  {
-    "id": "DESER001",
-    "pattern": "pickle\\.loads|ObjectInputStream|BinaryFormatter|unserialize\\s*\\(",
-    "flags": "",
-    "category": "deserialization",
-    "description": "Deserialization (expanded)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "DESER002",
-    "pattern": "DataContractSerializer|JavaScriptSerializer|JsonConvert\\.DeserializeObject\\s*<(?!string)",
-    "flags": "i",
-    "category": "deserialization",
-    "description": "Deserialization (expanded)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "DESER003",
-    "pattern": "ObjectMessage|message\\.getObject\\s*\\(\\)|readObject\\s*\\(\\)",
-    "flags": "",
-    "category": "deserialization",
-    "description": "Deserialization (expanded)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "DESER004",
-    "pattern": "new BinaryFormatter\\s*\\(\\)",
-    "flags": "i",
-    "category": "deserialization",
-    "description": "C# deserialization",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "DESER005",
-    "pattern": "TypeNameHandling\\.(?:All|Objects|Auto)",
-    "flags": "i",
-    "category": "deserialization",
-    "description": "C# deserialization",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "DESER006",
-    "pattern": "new LosFormatter\\s*\\(\\)",
-    "flags": "i",
-    "category": "deserialization",
-    "description": "C# deserialization",
-    "language": [
-      "csharp"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "DESER007",
-    "pattern": "unserialize\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE|data)",
-    "flags": "i",
-    "category": "deserialization",
-    "description": "PHP deserialization",
-    "language": [
-      "php"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "DESER008",
-    "pattern": "Class\\.forName\\s*\\(",
-    "flags": "",
-    "category": "deserialization",
-    "description": "Kotlin: deserialization (Gson Class.forName, Kryo unsafe config)",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "DESER009",
-    "pattern": "kryo\\.readClassAndObject\\s*\\(|isRegistrationRequired\\s*=\\s*false",
-    "flags": "i",
-    "category": "deserialization",
-    "description": "Kotlin: deserialization (Gson Class.forName, Kryo unsafe config)",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "DESER010",
-    "pattern": "\\[\\s*\\w+\\.(?:action|method|nextStep|type)\\s*\\]",
-    "flags": "",
-    "category": "deserialization",
-    "description": "JS/TS: unsafe deserialization via dynamic property/method dispatch",
-    "language": [
-      "js",
-      "ts"
-    ],
-    "severity": "critical"
-  },
-  {
-    "id": "DESER011",
-    "pattern": "plainToClass\\s*\\(\\s*\\w+\\s*,",
-    "flags": "",
-    "category": "deserialization",
-    "description": "JS/TS: unsafe deserialization via dynamic property/method dispatch",
-    "language": [
-      "js",
-      "ts"
-    ],
-    "severity": "critical"
-  }
-]
+[
+  {
+    "id": "DESER001",
+    "pattern": "pickle\\.loads|ObjectInputStream|BinaryFormatter|unserialize\\s*\\(",
+    "flags": "",
+    "category": "deserialization",
+    "description": "Deserialization (expanded)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER002",
+    "pattern": "DataContractSerializer|JavaScriptSerializer|JsonConvert\\.DeserializeObject\\s*<(?!string)",
+    "flags": "i",
+    "category": "deserialization",
+    "description": "Deserialization (expanded)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER003",
+    "pattern": "ObjectMessage|message\\.getObject\\s*\\(\\)|readObject\\s*\\(\\)",
+    "flags": "",
+    "category": "deserialization",
+    "description": "Deserialization (expanded)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER004",
+    "pattern": "new BinaryFormatter\\s*\\(\\)",
+    "flags": "i",
+    "category": "deserialization",
+    "description": "C# deserialization",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER005",
+    "pattern": "TypeNameHandling\\.(?:All|Objects|Auto)",
+    "flags": "i",
+    "category": "deserialization",
+    "description": "C# deserialization",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER006",
+    "pattern": "new LosFormatter\\s*\\(\\)",
+    "flags": "i",
+    "category": "deserialization",
+    "description": "C# deserialization",
+    "language": [
+      "csharp"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER007",
+    "pattern": "unserialize\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE|data)",
+    "flags": "i",
+    "category": "deserialization",
+    "description": "PHP deserialization",
+    "language": [
+      "php"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER008",
+    "pattern": "Class\\.forName\\s*\\(",
+    "flags": "",
+    "category": "deserialization",
+    "description": "Kotlin: deserialization (Gson Class.forName, Kryo unsafe config)",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER009",
+    "pattern": "kryo\\.readClassAndObject\\s*\\(|isRegistrationRequired\\s*=\\s*false",
+    "flags": "i",
+    "category": "deserialization",
+    "description": "Kotlin: deserialization (Gson Class.forName, Kryo unsafe config)",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER010",
+    "pattern": "\\[\\s*\\w+\\.(?:action|method|nextStep|type)\\s*\\]",
+    "flags": "",
+    "category": "deserialization",
+    "description": "JS/TS: unsafe deserialization via dynamic property/method dispatch",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "critical"
+  },
+  {
+    "id": "DESER011",
+    "pattern": "plainToClass\\s*\\(\\s*\\w+\\s*,",
+    "flags": "",
+    "category": "deserialization",
+    "description": "JS/TS: unsafe deserialization via dynamic property/method dispatch",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "critical"
+  }
+]

package/dist/packages/crucible/rules/env-injection.json

@@ -1,46 +1,46 @@
-[
-  {
-    "id": "ENV001",
-    "pattern": "(?:println!|eprintln!)\\s*\\(\\s*\"[^\"]*(?:API_KEY|password|secret|token)[^\"]*\"",
-    "flags": "i",
-    "category": "env_injection",
-    "description": "Rust: env var / secret injection into logs or responses",
-    "language": [
-      "rust"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "ENV002",
-    "pattern": "env::vars\\s*\\(\\s*\\)",
-    "flags": "",
-    "category": "env_injection",
-    "description": "Rust: env var / secret injection into logs or responses",
-    "language": [
-      "rust"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "ENV003",
-    "pattern": "env::var\\s*\\(\\s*key\\s*\\)",
-    "flags": "",
-    "category": "env_injection",
-    "description": "Rust: env var / secret injection into logs or responses",
-    "language": [
-      "rust"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "ENV004",
-    "pattern": "json!\\s*\\(\\s*\\{[\\s\\S]*?env::var",
-    "flags": "",
-    "category": "env_injection",
-    "description": "Rust: env var / secret injection into logs or responses",
-    "language": [
-      "rust"
-    ],
-    "severity": "medium"
-  }
-]
+[
+  {
+    "id": "ENV001",
+    "pattern": "(?:println!|eprintln!)\\s*\\(\\s*\"[^\"]*(?:API_KEY|password|secret|token)[^\"]*\"",
+    "flags": "i",
+    "category": "env_injection",
+    "description": "Rust: env var / secret injection into logs or responses",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "ENV002",
+    "pattern": "env::vars\\s*\\(\\s*\\)",
+    "flags": "",
+    "category": "env_injection",
+    "description": "Rust: env var / secret injection into logs or responses",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "ENV003",
+    "pattern": "env::var\\s*\\(\\s*key\\s*\\)",
+    "flags": "",
+    "category": "env_injection",
+    "description": "Rust: env var / secret injection into logs or responses",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "ENV004",
+    "pattern": "json!\\s*\\(\\s*\\{[\\s\\S]*?env::var",
+    "flags": "",
+    "category": "env_injection",
+    "description": "Rust: env var / secret injection into logs or responses",
+    "language": [
+      "rust"
+    ],
+    "severity": "medium"
+  }
+]