tlc-claude-code 1.4.7 → 1.4.9

package/server/lib/security/query-builder.test.js

@@ -0,0 +1,318 @@
+/**
+ * Query Builder Tests
+ *
+ * Tests for safe parameterized query building.
+ */
+
+import { describe, it, expect } from 'vitest';
+import {
+  createQueryBuilder,
+  select,
+  insert,
+  update,
+  del,
+  SecurityError,
+} from './query-builder.js';
+
+describe('query-builder', () => {
+  describe('select', () => {
+    it('builds SELECT with simple WHERE', () => {
+      const result = select('users')
+        .columns(['id', 'name', 'email'])
+        .where('id', '=', 1)
+        .build();
+
+      expect(result.sql).toBe('SELECT id, name, email FROM users WHERE id = $1');
+      expect(result.params).toEqual([1]);
+    });
+
+    it('builds SELECT with multiple WHERE conditions', () => {
+      const result = select('users')
+        .columns(['*'])
+        .where('status', '=', 'active')
+        .where('age', '>=', 18)
+        .build();
+
+      expect(result.sql).toBe('SELECT * FROM users WHERE status = $1 AND age >= $2');
+      expect(result.params).toEqual(['active', 18]);
+    });
+
+    it('builds SELECT with OR conditions', () => {
+      const result = select('users')
+        .columns(['*'])
+        .where('role', '=', 'admin')
+        .orWhere('role', '=', 'superadmin')
+        .build();
+
+      expect(result.sql).toContain('OR');
+      expect(result.params).toEqual(['admin', 'superadmin']);
+    });
+
+    it('builds SELECT with IN clause', () => {
+      const result = select('users')
+        .columns(['*'])
+        .whereIn('id', [1, 2, 3])
+        .build();
+
+      expect(result.sql).toBe('SELECT * FROM users WHERE id IN ($1, $2, $3)');
+      expect(result.params).toEqual([1, 2, 3]);
+    });
+
+    it('builds SELECT with ORDER BY', () => {
+      const result = select('users')
+        .columns(['*'])
+        .orderBy('created_at', 'DESC')
+        .build();
+
+      expect(result.sql).toContain('ORDER BY created_at DESC');
+    });
+
+    it('builds SELECT with LIMIT and OFFSET', () => {
+      const result = select('users')
+        .columns(['*'])
+        .limit(10)
+        .offset(20)
+        .build();
+
+      expect(result.sql).toContain('LIMIT $1');
+      expect(result.sql).toContain('OFFSET $2');
+      expect(result.params).toContain(10);
+      expect(result.params).toContain(20);
+    });
+
+    it('rejects string concatenation in WHERE value', () => {
+      expect(() => {
+        select('users')
+          .columns(['*'])
+          .whereRaw("name = '" + "'; DROP TABLE users;--")
+          .build();
+      }).toThrow(SecurityError);
+    });
+
+    it('rejects unwhitelisted table name', () => {
+      const builder = createQueryBuilder({
+        allowedTables: ['users', 'posts'],
+      });
+
+      expect(() => {
+        builder.select('admin_secrets').columns(['*']).build();
+      }).toThrow(SecurityError);
+    });
+
+    it('rejects unwhitelisted column name', () => {
+      const builder = createQueryBuilder({
+        allowedColumns: { users: ['id', 'name', 'email'] },
+      });
+
+      expect(() => {
+        builder.select('users').columns(['password_hash']).build();
+      }).toThrow(SecurityError);
+    });
+  });
+
+  describe('insert', () => {
+    it('builds INSERT with values', () => {
+      const result = insert('users')
+        .values({ name: 'John', email: 'john@example.com' })
+        .build();
+
+      expect(result.sql).toBe('INSERT INTO users (name, email) VALUES ($1, $2)');
+      expect(result.params).toEqual(['John', 'john@example.com']);
+    });
+
+    it('builds INSERT with multiple rows', () => {
+      const result = insert('users')
+        .values([
+          { name: 'John', email: 'john@example.com' },
+          { name: 'Jane', email: 'jane@example.com' },
+        ])
+        .build();
+
+      expect(result.sql).toContain('VALUES ($1, $2), ($3, $4)');
+      expect(result.params).toHaveLength(4);
+    });
+
+    it('builds INSERT with RETURNING clause', () => {
+      const result = insert('users')
+        .values({ name: 'John' })
+        .returning(['id'])
+        .build();
+
+      expect(result.sql).toContain('RETURNING id');
+    });
+
+    it('escapes column names with special characters', () => {
+      const result = insert('users')
+        .values({ 'user-name': 'John' })
+        .build();
+
+      expect(result.sql).toContain('"user-name"');
+    });
+
+    it('rejects SQL in column names', () => {
+      expect(() => {
+        insert('users')
+          .values({ 'name; DROP TABLE users;--': 'John' })
+          .build();
+      }).toThrow(SecurityError);
+    });
+  });
+
+  describe('update', () => {
+    it('builds UPDATE with SET and WHERE', () => {
+      const result = update('users')
+        .set({ name: 'John', status: 'active' })
+        .where('id', '=', 1)
+        .build();
+
+      expect(result.sql).toBe('UPDATE users SET name = $1, status = $2 WHERE id = $3');
+      expect(result.params).toEqual(['John', 'active', 1]);
+    });
+
+    it('requires WHERE clause by default', () => {
+      expect(() => {
+        update('users')
+          .set({ status: 'deleted' })
+          .build();
+      }).toThrow(SecurityError);
+    });
+
+    it('allows UPDATE without WHERE when explicitly unsafe', () => {
+      const result = update('users')
+        .set({ status: 'inactive' })
+        .unsafe()
+        .build();
+
+      expect(result.sql).toBe('UPDATE users SET status = $1');
+    });
+
+    it('builds UPDATE with RETURNING', () => {
+      const result = update('users')
+        .set({ name: 'John' })
+        .where('id', '=', 1)
+        .returning(['id', 'name'])
+        .build();
+
+      expect(result.sql).toContain('RETURNING id, name');
+    });
+  });
+
+  describe('delete', () => {
+    it('builds DELETE with WHERE', () => {
+      const result = del('users')
+        .where('id', '=', 1)
+        .build();
+
+      expect(result.sql).toBe('DELETE FROM users WHERE id = $1');
+      expect(result.params).toEqual([1]);
+    });
+
+    it('requires WHERE clause by default', () => {
+      expect(() => {
+        del('users').build();
+      }).toThrow(SecurityError);
+    });
+
+    it('allows DELETE without WHERE when explicitly unsafe', () => {
+      const result = del('users').unsafe().build();
+      expect(result.sql).toBe('DELETE FROM users');
+    });
+
+    it('builds DELETE with multiple conditions', () => {
+      const result = del('users')
+        .where('status', '=', 'deleted')
+        .where('deleted_at', '<', '2024-01-01')
+        .build();
+
+      expect(result.sql).toContain('AND');
+      expect(result.params).toHaveLength(2);
+    });
+  });
+
+  describe('SQL keyword safety', () => {
+    it('treats SQL keywords in values as data', () => {
+      const result = insert('users')
+        .values({ name: 'SELECT * FROM users' })
+        .build();
+
+      expect(result.params).toContain('SELECT * FROM users');
+      expect(result.sql).not.toContain('SELECT * FROM users');
+    });
+
+    it('treats DROP TABLE in values as data', () => {
+      const result = update('users')
+        .set({ bio: 'DROP TABLE users;' })
+        .where('id', '=', 1)
+        .build();
+
+      expect(result.params).toContain('DROP TABLE users;');
+    });
+
+    it('treats UNION in values as data', () => {
+      const result = select('users')
+        .columns(['*'])
+        .where('name', '=', "' UNION SELECT * FROM passwords--")
+        .build();
+
+      expect(result.params).toContain("' UNION SELECT * FROM passwords--");
+    });
+  });
+
+  describe('dialect support', () => {
+    it('uses PostgreSQL parameter style ($1)', () => {
+      const builder = createQueryBuilder({ dialect: 'postgresql' });
+      const result = builder.select('users')
+        .columns(['*'])
+        .where('id', '=', 1)
+        .build();
+
+      expect(result.sql).toContain('$1');
+    });
+
+    it('uses MySQL parameter style (?)', () => {
+      const builder = createQueryBuilder({ dialect: 'mysql' });
+      const result = builder.select('users')
+        .columns(['*'])
+        .where('id', '=', 1)
+        .build();
+
+      expect(result.sql).toContain('?');
+    });
+
+    it('uses SQLite parameter style (?)', () => {
+      const builder = createQueryBuilder({ dialect: 'sqlite' });
+      const result = builder.select('users')
+        .columns(['*'])
+        .where('id', '=', 1)
+        .build();
+
+      expect(result.sql).toContain('?');
+    });
+  });
+
+  describe('identifier escaping', () => {
+    it('escapes table names with special characters', () => {
+      const result = select('user-data')
+        .columns(['*'])
+        .build();
+
+      expect(result.sql).toContain('"user-data"');
+    });
+
+    it('escapes reserved word table names', () => {
+      const result = select('order')
+        .columns(['*'])
+        .build();
+
+      expect(result.sql).toContain('"order"');
+    });
+
+    it('handles schema-qualified table names', () => {
+      const result = select('public.users')
+        .columns(['*'])
+        .build();
+
+      expect(result.sql).toContain('public.users');
+    });
+  });
+});

package/server/lib/security/secret-detector.js

@@ -0,0 +1,290 @@
+/**
+ * Secret Detector Module
+ *
+ * Detects hardcoded secrets, API keys, and credentials in code.
+ * Helps prevent OWASP A02: Cryptographic Failures and A07: Auth Failures
+ */
+
+/**
+ * Built-in secret detection patterns
+ * All patterns use simple, non-backtracking regex
+ */
+const BUILT_IN_PATTERNS = [
+  // AWS Access Key (always starts with AKIA, exactly 20 chars)
+  {
+    name: 'aws_access_key',
+    pattern: /AKIA[0-9A-Z]{16}/g,
+    severity: 'critical',
+  },
+  // AWS Secret Key (40 char base64-like, starts with wJalrX typically)
+  {
+    name: 'aws_secret_key',
+    pattern: /(?:secret(?:Access)?Key|aws_secret)\s*[=:]\s*["']([A-Za-z0-9/+=]{40})["']/gi,
+    severity: 'critical',
+  },
+
+  // GitHub tokens (prefixed with ghp_, gho_, ghu_, ghr_, ghs_)
+  {
+    name: 'github_token',
+    pattern: /gh[pousr]_[A-Za-z0-9]{36}/g,
+    severity: 'critical',
+  },
+
+  // Stripe secret key (sk_live_ or sk_test_, 4-32 chars after prefix for tests)
+  {
+    name: 'stripe_secret_key',
+    pattern: /sk_live_[A-Za-z0-9]{4,32}/g,
+    severity: 'critical',
+  },
+  {
+    name: 'stripe_test_key',
+    pattern: /sk_test_[A-Za-z0-9]{4,32}/g,
+    severity: 'high',
+  },
+
+  // Private keys (PEM format headers)
+  {
+    name: 'private_key',
+    pattern: /-----BEGIN\s+(?:RSA\s+|EC\s+|DSA\s+|OPENSSH\s+)?PRIVATE\s+KEY-----/g,
+    severity: 'critical',
+  },
+
+  // JWT tokens - detect by eyJ prefix (Base64 for {"alg" or {"typ")
+  {
+    name: 'jwt_token',
+    pattern: /eyJ[A-Za-z0-9_-]{20,}\.eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,
+    severity: 'high',
+  },
+
+  // Database connection strings with embedded credentials
+  {
+    name: 'connection_string',
+    pattern: /(?:postgresql|mysql|mongodb(?:\+srv)?|redis):\/\/\w+:\w+@[^\s"']+/gi,
+    severity: 'critical',
+  },
+
+  // Password assignments (simple detection)
+  {
+    name: 'password',
+    pattern: /(?:password|passwd|pass|db_password|secret)\s*[:=]\s*["'][^"']{4,30}["']/gi,
+    severity: 'high',
+    excludePatterns: [/process\.env/i, /\$\{/],
+  },
+];
+
+/**
+ * Patterns that indicate false positives
+ * These are checked against the LINE, not just the matched value
+ */
+const FALSE_POSITIVE_PATTERNS = [
+  /process\.env/i,
+  /\$\{[^}]+\}/,
+  /YOUR_[A-Z_]+_HERE/i,
+  /PLACEHOLDER/i,
+  /-----BEGIN\s+PUBLIC\s+KEY-----/,
+  /-----BEGIN\s+CERTIFICATE-----/,
+];
+
+/**
+ * Patterns checked only against the matched value (not the full line)
+ */
+const VALUE_FALSE_POSITIVE_PATTERNS = [
+  /^x{4,}$/i,  // Only if the entire value is just x's
+];
+
+/**
+ * Detect secrets in code content
+ * @param {string} content - Code content to scan
+ * @param {Object} options - Detection options
+ * @returns {Object} Detection results
+ */
+export function detectSecrets(content, options = {}) {
+  const {
+    patterns = BUILT_IN_PATTERNS,
+    ignoreTestValues = false,
+  } = options;
+
+  const findings = [];
+  const lines = content.split('\n');
+
+  for (const patternDef of patterns) {
+    const { name, pattern, severity, excludePatterns } = patternDef;
+
+    // Create a fresh regex instance with global flag
+    const flags = pattern.flags.includes('g') ? pattern.flags : pattern.flags + 'g';
+    const regex = new RegExp(pattern.source, flags);
+
+    let match;
+    while ((match = regex.exec(content)) !== null) {
+      const matchStart = match.index;
+      const matchValue = match[0];
+
+      // Find line number
+      let lineNumber = 1;
+      let charCount = 0;
+      for (let i = 0; i < lines.length; i++) {
+        if (charCount + lines[i].length >= matchStart) {
+          lineNumber = i + 1;
+          break;
+        }
+        charCount += lines[i].length + 1;
+      }
+
+      const line = lines[lineNumber - 1] || '';
+
+      // Check for false positives
+      let isFalsePositive = false;
+
+      // Check pattern-specific exclusions
+      if (excludePatterns) {
+        for (const excl of excludePatterns) {
+          if (excl.test(line)) {
+            isFalsePositive = true;
+            break;
+          }
+        }
+      }
+
+      // Check global false positive patterns (against line)
+      if (!isFalsePositive) {
+        for (const fp of FALSE_POSITIVE_PATTERNS) {
+          if (fp.test(line)) {
+            isFalsePositive = true;
+            break;
+          }
+        }
+      }
+
+      // Check value-specific false positive patterns
+      if (!isFalsePositive) {
+        for (const fp of VALUE_FALSE_POSITIVE_PATTERNS) {
+          if (fp.test(matchValue)) {
+            isFalsePositive = true;
+            break;
+          }
+        }
+      }
+
+      // Skip test values if configured
+      if (!isFalsePositive && ignoreTestValues) {
+        if (/test|example|sample|demo/i.test(matchValue)) {
+          isFalsePositive = true;
+        }
+      }
+
+      if (!isFalsePositive) {
+        findings.push({
+          type: name,
+          line: lineNumber,
+          column: matchStart - content.lastIndexOf('\n', matchStart - 1),
+          severity: severity || 'medium',
+          snippet: line.trim().substring(0, 100),
+        });
+      }
+    }
+  }
+
+  return {
+    findings,
+    hasSecrets: findings.length > 0,
+  };
+}
+
+/**
+ * Scan a file for secrets
+ */
+export async function scanFile(filePath, options = {}) {
+  const { content } = options;
+
+  if (!content) {
+    throw new Error('Content must be provided');
+  }
+
+  const result = detectSecrets(content, options);
+
+  return {
+    file: filePath,
+    findings: result.findings.map((f) => ({ ...f, file: filePath })),
+    hasSecrets: result.hasSecrets,
+  };
+}
+
+/**
+ * Scan a directory for secrets
+ */
+export async function scanDirectory(dirPath, options = {}) {
+  const { files = {}, ignore = [] } = options;
+
+  const allFindings = [];
+  let filesWithSecrets = 0;
+  let totalFiles = 0;
+
+  for (const [filePath, content] of Object.entries(files)) {
+    const relativePath = filePath.replace(dirPath, '').replace(/^\//, '');
+
+    // Check ignore patterns
+    let shouldIgnore = false;
+    for (const pattern of ignore) {
+      if (relativePath.includes(pattern.replace('/**', '').replace('/*', ''))) {
+        shouldIgnore = true;
+        break;
+      }
+    }
+
+    if (shouldIgnore) continue;
+
+    totalFiles++;
+    const result = await scanFile(filePath, { content, ...options });
+
+    if (result.hasSecrets) {
+      filesWithSecrets++;
+      allFindings.push(...result.findings);
+    }
+  }
+
+  return {
+    directory: dirPath,
+    totalFiles,
+    filesWithSecrets,
+    findings: allFindings,
+    hasSecrets: allFindings.length > 0,
+  };
+}
+
+/**
+ * Create a custom secret detector
+ */
+export function createSecretDetector(options = {}) {
+  const { patterns = [], builtInPatterns = true } = options;
+
+  const activePatterns = builtInPatterns
+    ? [...BUILT_IN_PATTERNS, ...patterns]
+    : patterns;
+
+  return {
+    patterns: activePatterns,
+
+    detect(content, detectOptions = {}) {
+      return detectSecrets(content, { ...detectOptions, patterns: this.patterns });
+    },
+
+    addPattern(pattern) {
+      this.patterns.push(pattern);
+    },
+  };
+}
+
+/**
+ * Add a custom pattern to an existing detector
+ */
+export function addCustomPattern(detector, pattern) {
+  if (!detector || !detector.patterns) {
+    throw new Error('Invalid detector');
+  }
+
+  detector.patterns.push({
+    name: pattern.name,
+    pattern: pattern.pattern,
+    severity: pattern.severity || 'medium',
+  });
+}