thuban 0.4.9 → 0.4.11

package/packages/crucible/rules/path-traversal.json

@@ -1,422 +0,0 @@
-[
-  {
-    "id": "PATH001",
-    "pattern": "include\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST|page|template|lang)|require(?:_once)?\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Path traversal — broader coverage",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH002",
-    "pattern": "path\\.join\\s*\\([^)]*(?:filename|file|name|param|input|req\\.|request\\.|dir\\b|upload)|path\\.resolve\\s*\\([^)]*(?:req\\.|request\\.)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Path traversal — broader coverage",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH003",
-    "pattern": "(?:uploadDir|baseDir|BASE_DIR|downloadDir|uploadRoot|templateRoot|configRoot)\\s*\\+\\s*|os\\.Open\\s*\\([^)]*\\+",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Go path traversal: base path + user input concatenation",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH004",
-    "pattern": "File\\s*\\([^)]*(?:filename|request\\.|params\\[|getParameter)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Kotlin/Java file path",
-    "language": [
-      "kotlin",
-      "java"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH005",
-    "pattern": "AdmZip|ZipEntry|zipEntry\\.getName\\s*\\(\\)|entry\\.getName|ZipArchive|archive\\.by_index|archive\\.len\\(\\)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Zip-slip",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH006",
-    "pattern": "Path\\.Combine\\s*\\([^)]*(?:reportName|filename|Request\\[|\\.Value\\b|name\\b)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "C# path traversal (Path.Combine with user input, File.WriteAllText)",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH007",
-    "pattern": "File\\.(?:WriteAllText|ReadAllText|Open|ReadAllBytes)\\s*\\([^)]*(?:reportName|filename|Request\\[|\\.Value\\b|path\\b)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "C# path traversal (Path.Combine with user input, File.WriteAllText)",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH008",
-    "pattern": "Path\\.Combine\\s*\\(\\s*\\w+(?:Root|Base|Dir)\\s*,\\s*\\w+\\s*\\)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "C# path traversal via variable named 'path' that was set with Path.Combine + user input",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH009",
-    "pattern": "\\w+(?:Base|Dir|Path|Folder|Root)\\s*\\+\\s*\\w+(?:Name|File|Path|Input)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "C# path traversal: base string + user-supplied name string concatenation",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH010",
-    "pattern": "File\\.(?:read|write|open|binread)\\s*\\([^)]*#\\{|File\\.(?:read|write|open|binread)\\s*\\(\\s*(?:path|params\\[|request\\.)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Ruby File.read / File.write with string interpolation (user-controlled path)",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH011",
-    "pattern": "[\"'\\/][\\/\\w\\-\\.]*\\/[\"']*#\\{[a-zA-Z_]\\w*\\}[\"']?",
-    "flags": "",
-    "category": "path_traversal",
-    "description": "Ruby path string interpolation: \"/base/path/#{user_var}\"",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH012",
-    "pattern": "filepath\\.Join\\s*\\([^)]*(?:tmpl|template|name|path|param|input|rel|query)\\b",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Go filepath.Join / path.Join without validation",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH013",
-    "pattern": "(?:FileInputStream|FileOutputStream|FileReader|FileWriter)\\s*\\([^)]*\\+\\s*\\w|(?:FileInputStream|FileOutputStream)\\s*\\(\\w+\\s*\\+",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Java FileInputStream / FileOutputStream with string concat",
-    "language": [
-      "java"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH014",
-    "pattern": "format!\\s*\\(\\s*[\"'][^\"']*\\{[^}]*\\}[^\"']*[\"'][^)]*(?:config|plugin|template|user|path|name)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Rust format! macro constructing file paths from user input",
-    "language": [
-      "rust"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH015",
-    "pattern": "(?:const\\s+\\w+\\s*=\\s*|let\\s+path\\s*=\\s*)format!\\s*\\(\\s*[\"'][^\"']*\\/\\{\\}[\"']",
-    "flags": "",
-    "category": "path_traversal",
-    "description": "Go/Rust const string + user variable for file path",
-    "language": [
-      "go",
-      "rust"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH016",
-    "pattern": "[`\"'][.\\/][^`\"']*\\/\\$\\{(?:req\\.|request\\.|params\\.|query\\.|userInput|filename|template|plugin|name)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "JS template literal path construction: `./dir/${userVar}` or `/base/${param}`",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH017",
-    "pattern": "require(?:_once)?\\s*\\(\\s*['\"][^'\"]*['\"]\\s*\\.\\s*\\$[a-zA-Z_]|include(?:_once)?\\s*\\(\\s*['\"][^'\"]*['\"]\\s*\\.\\s*\\$[a-zA-Z_]",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "PHP require/include with string concatenation: require('dir/' . $var)",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH018",
-    "pattern": "File\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+\\s*\\w|File\\s*\\(\\s*\"\\$|File\\s*\\(\\s*[\"'][^\"']*\\/\"\\s*\\+",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Kotlin/Java File() with string interpolation or parameter variable",
-    "language": [
-      "kotlin",
-      "java"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH019",
-    "pattern": "%00|\\\\x00|\\\\u0000",
-    "flags": "",
-    "category": "path_traversal",
-    "description": "Null byte injection pattern",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH020",
-    "pattern": "%2e%2e|%252e|%2f%2e",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "URL-encoded traversal: %2e%2e or %2f",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH021",
-    "pattern": "\\binclude\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST|page|template|lang|plugin)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "PHP path traversal",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH022",
-    "pattern": "\\brequire\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST|module|lang|view|component)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "PHP path traversal",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH023",
-    "pattern": "file_get_contents\\s*\\(\\s*\\$(?:_GET|_POST|url|filename|logFile)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "PHP path traversal",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH024",
-    "pattern": "readfile\\s*\\(\\s*\\$(?:base|path|file)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "PHP path traversal",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH025",
-    "pattern": "\\bfopen\\s*\\(\\s*\\$(?:filepath|path|report)\\s*,",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "PHP path traversal",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH026",
-    "pattern": "file_get_contents\\s*\\(\\s*['\"][^\\\"']*['\"]\\s*\\.\\s*\\$(?:filename|file|name|logFile|log)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "PHP path traversal: file_get_contents with string concat to user var",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH027",
-    "pattern": "os\\.Open\\s*\\(\\s*\\w+(?:Dir|Root|Base|Path)\\s*\\+\\s*\\w+",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Go path traversal",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH028",
-    "pattern": "ioutil\\.ReadFile\\s*\\(\\s*\\w+(?:Root|Base|Dir|Path)\\s*\\+\\s*\\w+",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Go path traversal",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH029",
-    "pattern": "os\\.ReadFile\\s*\\(\\s*\\w+(?:Root|Base|Dir|Path)\\s*\\+\\s*\\w+",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Go path traversal",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH030",
-    "pattern": "os\\.Create\\s*\\(\\s*\\w+(?:Base|Dir|Root|Path)\\s*\\+\\s*\\w+",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Go path traversal",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH031",
-    "pattern": "os\\.Remove\\s*\\(\\s*\\w+(?:Root|Base|Dir)\\s*\\+\\s*\\w+",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Go path traversal",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH032",
-    "pattern": "filepath\\.Join\\s*\\([^)]*(?:extractBase|uploadRoot|configRoot|templateRoot|reportBase)\\s*,",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Go path traversal",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "PATH033",
-    "pattern": "\\.resolve\\s*\\(\\s*\\w*(?:Name|name|file|path|template)\\w*\\s*\\)",
-    "flags": "i",
-    "category": "path_traversal",
-    "description": "Java: path traversal via Path.resolve(userInput)",
-    "language": [
-      "java"
-    ],
-    "severity": "high"
-  }
-]

package/packages/crucible/rules/prototype-pollution.json

@@ -1,22 +0,0 @@
-[
-  {
-    "id": "PROTO001",
-    "pattern": "__proto__|\\[\"__proto__\"\\]",
-    "flags": "",
-    "category": "prototype_pollution",
-    "description": "Prototype pollution",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  }
-]