codeguard-cli 2.0.0__py3-none-any.whl

codeguard/rules/javascript/cg_sec_103_dom_xss.py

@@ -0,0 +1,67 @@
+# SPDX-License-Identifier: Apache-2.0
+"""CG-SEC-103 -- DOM-based XSS sink assigned a non-literal.
+
+Flags ``el.innerHTML = x`` / ``el.outerHTML = x`` / ``el.insertAdjacentHTML(pos, x)``
+/ ``document.write(x)`` where the HTML is not a string literal.  CWE-79.
+"""
+
+from __future__ import annotations
+
+from codeguard.engine.context import RuleContext
+from codeguard.engine.finding import Category, Finding, Severity
+from codeguard.engine.registry import REGISTRY
+from codeguard.engine.rule import TreeSitterRule
+from codeguard.lang.base import Language
+from codeguard.lang.node import SourceNode
+from codeguard.rules._jsnodes import arguments, callee_text, calls, is_literal
+
+_JS_TS = frozenset({Language.JAVASCRIPT, Language.TYPESCRIPT})
+_SINK_PROPS = frozenset({"innerHTML", "outerHTML"})
+_SINK_CALLS = frozenset({"write", "writeln", "insertAdjacentHTML"})
+_FIX = (
+    "Set textContent, or sanitize the HTML with a library like DOMPurify before "
+    "assigning it. Prefer DOM APIs (createElement / append) over HTML strings."
+)
+
+
+class DomXssRule(TreeSitterRule):
+    id = "CG-SEC-103"
+    title = "DOM XSS sink assigned a non-literal value"
+    description = (
+        "A non-literal value is written to innerHTML / outerHTML / document.write "
+        "/ insertAdjacentHTML. If it contains attacker-controlled data the browser "
+        "will execute injected script."
+    )
+    severity = Severity.HIGH
+    category = Category.SECURITY
+    languages = _JS_TS
+    cwe = "CWE-79"
+    owasp = "A03:2021 - Injection"
+
+    def check_tree(self, root: SourceNode, ctx: RuleContext) -> list[Finding]:
+        findings: list[Finding] = []
+
+        for node in root.walk():
+            if node.kind == "assignment_expression":
+                left = node.child_by_field("left")
+                right = node.child_by_field("right")
+                if left is None or right is None or left.kind != "member_expression":
+                    continue
+                prop = left.child_by_field("property")
+                if prop and prop.text() in _SINK_PROPS and not is_literal(right):
+                    findings.append(self._make_finding(node=node, ctx=ctx, fix_suggestion=_FIX))
+
+        for call in calls(root):
+            callee = callee_text(call)
+            base = callee.rsplit(".", 1)[-1]
+            if base not in _SINK_CALLS or "." not in callee:
+                continue
+            args = arguments(call)
+            html_arg = args[-1] if base == "insertAdjacentHTML" else (args[0] if args else None)
+            if html_arg is not None and not is_literal(html_arg):
+                findings.append(self._make_finding(node=call, ctx=ctx, fix_suggestion=_FIX))
+
+        return findings
+
+
+REGISTRY.register(DomXssRule())

codeguard/rules/javascript/cg_sec_104_react_dangerous_html.py

@@ -0,0 +1,54 @@
+# SPDX-License-Identifier: Apache-2.0
+"""CG-SEC-104 -- React dangerouslySetInnerHTML with a non-literal value.
+
+``<div dangerouslySetInnerHTML={{ __html: value }} />`` bypasses React's XSS
+escaping.  If ``value`` is not a literal, the HTML must be sanitized first.
+CWE-79.
+"""
+
+from __future__ import annotations
+
+from codeguard.engine.context import RuleContext
+from codeguard.engine.finding import Category, Finding, Severity
+from codeguard.engine.registry import REGISTRY
+from codeguard.engine.rule import TreeSitterRule
+from codeguard.lang.base import Language
+from codeguard.lang.node import SourceNode
+from codeguard.rules._jsnodes import is_literal
+
+_JS_TS = frozenset({Language.JAVASCRIPT, Language.TYPESCRIPT})
+_FIX = (
+    "Sanitize the HTML with DOMPurify before passing it to __html, or render the "
+    "value as text instead of raw HTML."
+)
+
+
+class ReactDangerousHtmlRule(TreeSitterRule):
+    id = "CG-SEC-104"
+    title = "dangerouslySetInnerHTML with a non-literal value"
+    description = (
+        "dangerouslySetInnerHTML injects raw HTML, bypassing React's escaping. "
+        "The __html value here is not a literal; if it is attacker-controlled "
+        "this is a cross-site scripting vulnerability."
+    )
+    severity = Severity.HIGH
+    category = Category.SECURITY
+    languages = _JS_TS
+    cwe = "CWE-79"
+    owasp = "A03:2021 - Injection"
+
+    def check_tree(self, root: SourceNode, ctx: RuleContext) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in root.walk():
+            if node.kind != "pair":
+                continue
+            key = node.child_by_field("key")
+            value = node.child_by_field("value")
+            if key is None or value is None or key.text().strip("'\"") != "__html":
+                continue
+            if not is_literal(value):
+                findings.append(self._make_finding(node=node, ctx=ctx, fix_suggestion=_FIX))
+        return findings
+
+
+REGISTRY.register(ReactDangerousHtmlRule())

codeguard/rules/javascript/cg_sec_105_hardcoded_secret.py

@@ -0,0 +1,73 @@
+# SPDX-License-Identifier: Apache-2.0
+"""CG-SEC-105 -- hardcoded secret in JavaScript / TypeScript.
+
+A non-trivial string literal assigned to an identifier whose name reads like a
+credential (``password``, ``apiKey``, ``token``, ...).  CWE-798.  Mirrors the
+Python rule CG-SEC-002; confidence 0.9 because placeholder values in examples
+trip it.
+"""
+
+from __future__ import annotations
+
+from codeguard.engine.context import RuleContext
+from codeguard.engine.finding import Category, Finding, Severity
+from codeguard.engine.registry import REGISTRY
+from codeguard.engine.rule import TreeSitterRule
+from codeguard.lang.base import Language
+from codeguard.lang.node import SourceNode
+from codeguard.rules._jsnodes import looks_like_secret
+
+_JS_TS = frozenset({Language.JAVASCRIPT, Language.TYPESCRIPT})
+_MIN_LEN = 3
+_FIX = "Load secrets from process.env or a secrets manager; never commit them."
+
+# (node kind, name field, value field)
+_BINDINGS = (
+    ("variable_declarator", "name", "value"),
+    ("assignment_expression", "left", "right"),
+    ("pair", "key", "value"),
+    ("public_field_definition", "name", "value"),
+)
+
+
+class HardcodedSecretRule(TreeSitterRule):
+    id = "CG-SEC-105"
+    title = "Hardcoded secret"
+    description = (
+        "A string literal is assigned to an identifier whose name indicates a "
+        "credential (password, API key, token, ...). Hardcoded secrets get "
+        "committed and are trivially discoverable."
+    )
+    severity = Severity.HIGH
+    category = Category.SECURITY
+    languages = _JS_TS
+    cwe = "CWE-798"
+    owasp = "A07:2021 - Identification and Authentication Failures"
+
+    def check_tree(self, root: SourceNode, ctx: RuleContext) -> list[Finding]:
+        findings: list[Finding] = []
+        for node in root.walk():
+            for kind, name_field, value_field in _BINDINGS:
+                if node.kind != kind:
+                    continue
+                name = node.child_by_field(name_field)
+                value = node.child_by_field(value_field)
+                if name is None or value is None:
+                    continue
+                if value.kind != "string" or len(value.text()) - 2 < _MIN_LEN:
+                    continue
+                ident = name.text().strip("'\"")
+                if looks_like_secret(ident):
+                    findings.append(
+                        self._make_finding(
+                            node=node,
+                            ctx=ctx,
+                            description=f"{self.description} (identifier: {ident!r})",
+                            fix_suggestion=_FIX,
+                            confidence=0.9,
+                        )
+                    )
+        return findings
+
+
+REGISTRY.register(HardcodedSecretRule())

codeguard/rules/javascript/cg_sec_106_weak_random.py

@@ -0,0 +1,83 @@
+# SPDX-License-Identifier: Apache-2.0
+"""CG-SEC-106 -- Math.random() used for something security-sensitive.
+
+``Math.random()`` is not cryptographically secure.  Using it to build a token,
+session id, password, nonce, salt, OTP, or API key is CWE-338.  The rule only
+fires when the surrounding binding name signals a security use, to keep the
+false-positive rate low (confidence 0.8).
+"""
+
+from __future__ import annotations
+
+import re
+
+from codeguard.engine.context import RuleContext
+from codeguard.engine.finding import Category, Finding, Severity
+from codeguard.engine.registry import REGISTRY
+from codeguard.engine.rule import TreeSitterRule
+from codeguard.lang.base import Language
+from codeguard.lang.node import SourceNode
+from codeguard.rules._jsnodes import callee_text, calls
+
+_JS_TS = frozenset({Language.JAVASCRIPT, Language.TYPESCRIPT})
+_SECURITY_WORD = re.compile(
+    r"(?i)(token|secret|password|passwd|nonce|salt|otp|apikey|api_key|"
+    r"session|session_id|sessionid|csrf|uuid|guid|random_?id|verification|"
+    r"reset_?code|auth)"
+)
+_NAME_BEARING = {
+    "variable_declarator": "name",
+    "assignment_expression": "left",
+    "pair": "key",
+    "public_field_definition": "name",
+}
+_FIX = (
+    "Use a cryptographically secure source: crypto.randomBytes(),"
+    " crypto.randomUUID(), or the Web Crypto API (crypto.getRandomValues())."
+)
+
+
+class WeakRandomRule(TreeSitterRule):
+    id = "CG-SEC-106"
+    title = "Math.random() used for a security value"
+    description = (
+        "Math.random() is not cryptographically secure. It is being used to "
+        "produce a value whose name indicates a token, secret, id, nonce, or "
+        "similar -- an attacker can predict the output."
+    )
+    severity = Severity.MEDIUM
+    category = Category.SECURITY
+    languages = _JS_TS
+    cwe = "CWE-338"
+    owasp = "A02:2021 - Cryptographic Failures"
+
+    def check_tree(self, root: SourceNode, ctx: RuleContext) -> list[Finding]:
+        findings: list[Finding] = []
+        for call in calls(root):
+            if callee_text(call) != "Math.random":
+                continue
+            name = _enclosing_binding_name(call)
+            if name and _SECURITY_WORD.search(name):
+                findings.append(
+                    self._make_finding(node=call, ctx=ctx, fix_suggestion=_FIX, confidence=0.8)
+                )
+        return findings
+
+
+def _enclosing_binding_name(node: SourceNode, *, depth: int = 6) -> str | None:
+    """Walk up to *depth* ancestors looking for a binding, return its name text."""
+    native = node.native
+    for _ in range(depth):
+        parent = getattr(native, "parent", None)
+        if parent is None:
+            return None
+        field = _NAME_BEARING.get(parent.type)
+        if field is not None:
+            target = parent.child_by_field_name(field)
+            if target is not None and target.text is not None:
+                return str(target.text.decode("utf-8", "replace"))
+        native = parent
+    return None
+
+
+REGISTRY.register(WeakRandomRule())

codeguard/rules/meta/__init__.py

@@ -0,0 +1,55 @@
+# SPDX-License-Identifier: Apache-2.0
+"""Meta rules -- emitted by the suppression engine, not by AST analysis.
+
+CG-META-001 / CG-META-002 are registered here so ``list-rules`` and ``explain``
+can describe them and so they can be disabled or remapped like any other rule.
+The findings themselves are produced by
+:class:`codeguard.engine.suppressions.SuppressionSet` via the runner.
+"""
+
+from __future__ import annotations
+
+from codeguard.engine.context import RuleContext
+from codeguard.engine.finding import Category, Finding, Severity
+from codeguard.engine.registry import REGISTRY
+from codeguard.engine.rule import Rule
+from codeguard.engine.suppressions import META_EXPIRED, META_MISSING_REASON
+from codeguard.lang.base import Language
+
+_ALL_LANGS = frozenset(Language)
+
+
+class _MetaRule(Rule):
+    severity = Severity.LOW
+    category = Category.META
+    languages = _ALL_LANGS
+
+    def analyze(self, ctx: RuleContext) -> list[Finding]:
+        return []  # emitted by the runner from parsed suppressions
+
+
+class SuppressionMissingReasonRule(_MetaRule):
+    id = META_MISSING_REASON
+    title = "Suppression comment has no reason"
+    description = (
+        "A `# codeguard: ignore[...]` comment does not include `reason: ...`. "
+        "Unexplained suppressions rot: require a short reason so reviewers know "
+        "why the finding was waived."
+    )
+    help_uri = "https://mevichitra.github.io/codeguard/suppressions/"
+
+
+class ExpiredSuppressionRule(_MetaRule):
+    id = META_EXPIRED
+    title = "Suppression has expired"
+    description = (
+        "A `# codeguard: ignore[...] until=YYYY-MM-DD` comment is past its date. "
+        "The underlying finding is active again -- fix it, or renew the "
+        "suppression with a new date and reason."
+    )
+    severity = Severity.MEDIUM
+    help_uri = "https://mevichitra.github.io/codeguard/suppressions/"
+
+
+REGISTRY.register(SuppressionMissingReasonRule())
+REGISTRY.register(ExpiredSuppressionRule())

codeguard/rules/security/__init__.py

@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: Apache-2.0
+"""Security rules — imported for side-effect (registers rules into REGISTRY)."""
+
+from . import cg_sec_001_sql_injection as _001  # noqa: F401
+from . import cg_sec_002_hardcoded_secrets as _002  # noqa: F401
+from . import cg_sec_003_eval_exec as _003  # noqa: F401
+from . import cg_sec_004_unsafe_deserialization as _004  # noqa: F401
+from . import cg_sec_005_shell_injection as _005  # noqa: F401

codeguard/rules/security/cg_sec_001_sql_injection.py

@@ -0,0 +1,110 @@
+# SPDX-License-Identifier: Apache-2.0
+"""CG-SEC-001 — SQL query built with string formatting.
+
+Detects f-strings, %-formatting, .format(), and string concatenation used
+as the first argument to cursor.execute() / executemany() / executescript().
+
+Why this matters
+----------------
+Building SQL queries by interpolating variables into strings is the textbook
+SQL injection vector (CWE-89, OWASP A03:2021).  AI models produce this pattern
+frequently because it is syntactically simple and mirrors common tutorial code.
+
+The fix is always the same: use parameterized queries.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codeguard.engine.finding import Category, Finding, Severity
+from codeguard.engine.registry import REGISTRY
+from codeguard.engine.rule import AstRule
+
+_SQL_METHODS = frozenset({"execute", "executemany", "executescript"})
+
+_FIX = (
+    "Use parameterized queries instead of string interpolation: "
+    'cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))'
+)
+
+
+class SQLStringFormattingRule(AstRule):
+    """Detect SQL queries built via string formatting."""
+
+    id = "CG-SEC-001"
+    title = "SQL query built with string formatting"
+    description = (
+        "The SQL query passed to execute() is constructed using string interpolation "
+        "(f-string, %-format, .format(), or concatenation). This allows SQL injection "
+        "if any interpolated value originates from user input."
+    )
+    severity = Severity.HIGH
+    category = Category.SECURITY
+    cwe = "CWE-89"
+    owasp = "A03:2021 - Injection"
+
+    def check_ast(self, tree: ast.AST, source: str, filename: str) -> list[Finding]:
+        """Walk the AST looking for execute()/executemany() calls with dynamic SQL."""
+        findings: list[Finding] = []
+
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+            if not self._is_sql_call(node):
+                continue
+            if node.args and self._is_dynamic_string(node.args[0]):
+                findings.append(
+                    self._make_finding(
+                        node=node,
+                        filename=filename,
+                        fix_suggestion=_FIX,
+                    )
+                )
+
+        return findings
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+
+    @staticmethod
+    def _is_sql_call(node: ast.Call) -> bool:
+        """Return True if the call is a known SQL-execution method."""
+        if isinstance(node.func, ast.Attribute):
+            return node.func.attr in _SQL_METHODS
+        return False
+
+    @staticmethod
+    def _is_dynamic_string(node: ast.AST) -> bool:
+        """Return True if *node* produces a string via formatting or concatenation."""
+        # f"SELECT ... {var} ..."
+        if isinstance(node, ast.JoinedStr):
+            return True
+        # "SELECT ..." % var
+        if isinstance(node, ast.BinOp) and isinstance(node.op, ast.Mod):
+            return True
+        # "SELECT ...".format(var)
+        if (
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Attribute)
+            and node.func.attr == "format"
+        ):
+            return True
+        # "SELECT " + var  or  var + " FROM ..."  -- dynamic unless the whole
+        # concatenation tree is string literals (left-associative, so walk it).
+        if isinstance(node, ast.BinOp) and isinstance(node.op, ast.Add):
+            return not _is_constant_concat(node)
+        return False
+
+
+def _is_constant_concat(node: ast.AST) -> bool:
+    """True if *node* is a string literal or an ``+`` tree of string literals."""
+    if isinstance(node, ast.Constant):
+        return isinstance(node.value, str)
+    if isinstance(node, ast.BinOp) and isinstance(node.op, ast.Add):
+        return _is_constant_concat(node.left) and _is_constant_concat(node.right)
+    return False
+
+
+REGISTRY.register(SQLStringFormattingRule())

codeguard/rules/security/cg_sec_002_hardcoded_secrets.py

@@ -0,0 +1,184 @@
+# SPDX-License-Identifier: Apache-2.0
+"""CG-SEC-002 — Hardcoded secret in variable assignment.
+
+Detects string literals assigned to variables whose names suggest they hold
+a secret: password, api_key, token, secret, etc.
+
+Why this matters
+----------------
+Hardcoded credentials are one of the most common security mistakes in
+AI-generated code (CWE-798, OWASP A07:2021).  LLMs routinely generate
+example code with placeholder strings like "admin123" or "my_secret_key"
+that end up committed to version control.
+
+This rule has intentionally conservative matching: it only fires when the
+*variable name* matches known secret-naming patterns AND the value is a
+non-empty string literal (not an env-var lookup or config read).
+
+Confidence is set to 0.9 because the rule can fire on intentional test
+fixtures using placeholder values.  Use ``# codeguard: ignore[CG-SEC-002]``
+in tests if needed, or use a non-secret-looking variable name.
+"""
+
+from __future__ import annotations
+
+import ast
+import re
+
+from codeguard.engine.finding import Category, Finding, Severity
+from codeguard.engine.registry import REGISTRY
+from codeguard.engine.rule import AstRule
+
+# Variable names that suggest secret storage.
+# Deliberately conservative — only clear semantic markers.
+_SECRET_NAME_RE = re.compile(
+    r"(?i)(\b|_)("
+    r"password|passwd|pwd|passphrase"
+    r"|secret|api_?key|private_?key|access_?key|secret_?key"
+    r"|auth_?token|bearer_?token|refresh_?token|session_?token|csrf_?token"
+    r"|client_?secret|app_?secret"
+    r"|db_?pass(?:word)?|database_?password"
+    r"|smtp_?pass(?:word)?"
+    r"|aws_?secret|stripe_?(?:secret_?)?key|twilio_?token|github_?token"
+    r")(\b|_)"
+)
+
+_FIX = (
+    "Load secrets from environment variables or a secrets manager: "
+    "os.environ['MY_SECRET'] or a library like python-decouple / hvac."
+)
+
+# Minimum length to avoid flagging empty-string defaults
+_MIN_SECRET_LEN = 1
+
+
+class HardcodedSecretsRule(AstRule):
+    """Detect string literals assigned to secret-named variables."""
+
+    id = "CG-SEC-002"
+    title = "Hardcoded secret"
+    description = (
+        "A string literal is assigned to a variable whose name indicates it holds "
+        "a secret (password, API key, token, etc.). Hardcoded credentials get "
+        "committed to version control and are trivially discoverable."
+    )
+    severity = Severity.HIGH
+    category = Category.SECURITY
+    cwe = "CWE-798"
+    owasp = "A07:2021 - Identification and Authentication Failures"
+
+    def check_ast(self, tree: ast.AST, source: str, filename: str) -> list[Finding]:
+        """Scan assignments for secret-named variables with string literals."""
+        findings: list[Finding] = []
+
+        for node in ast.walk(tree):
+            # Simple assignment:  password = "hunter2"
+            if isinstance(node, ast.Assign):
+                for target in node.targets:
+                    # Handle tuple/list unpacking: user, password = "admin", "hunter2"
+                    if isinstance(target, (ast.Tuple, ast.List)):
+                        findings.extend(self._check_unpacked(target, node.value, node, filename))
+                    else:
+                        name = self._target_name(target)
+                        if name and _SECRET_NAME_RE.search(name):
+                            if self._is_secret_literal(node.value):
+                                findings.append(
+                                    self._make_finding(
+                                        node=node,
+                                        filename=filename,
+                                        description=(f"{self.description} (variable: {name!r})"),
+                                        fix_suggestion=_FIX,
+                                        confidence=0.9,
+                                    )
+                                )
+
+            # Annotated assignment:  password: str = "hunter2"
+            elif isinstance(node, ast.AnnAssign):
+                name = self._target_name(node.target)
+                if name and _SECRET_NAME_RE.search(name) and node.value is not None:
+                    if self._is_secret_literal(node.value):
+                        findings.append(
+                            self._make_finding(
+                                node=node,
+                                filename=filename,
+                                description=(f"{self.description} (variable: {name!r})"),
+                                fix_suggestion=_FIX,
+                                confidence=0.9,
+                            )
+                        )
+
+        return findings
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+
+    def _check_unpacked(
+        self,
+        target: ast.Tuple | ast.List,
+        value: ast.AST,
+        node: ast.AST,
+        filename: str,
+    ) -> list[Finding]:
+        """Check each element of a tuple/list unpacking assignment.
+
+        Handles patterns like:
+            user, password = "admin", "hunter2"
+            [username, api_key] = get_credentials()
+        """
+        findings: list[Finding] = []
+
+        # Only inspect element-by-element when the RHS is also a tuple/list
+        # literal so we can match targets to values positionally.
+        if isinstance(value, (ast.Tuple, ast.List)):
+            for tgt, val in zip(target.elts, value.elts, strict=False):
+                name = self._target_name(tgt)
+                if name and _SECRET_NAME_RE.search(name):
+                    if self._is_secret_literal(val):
+                        findings.append(
+                            self._make_finding(
+                                node=node,
+                                filename=filename,
+                                description=(f"{self.description} (variable: {name!r})"),
+                                fix_suggestion=_FIX,
+                                confidence=0.9,
+                            )
+                        )
+        else:
+            # RHS is not a literal tuple — we can't match positionally,
+            # so flag any secret-named target in the unpacking.
+            for tgt in target.elts:
+                name = self._target_name(tgt)
+                if name and _SECRET_NAME_RE.search(name):
+                    findings.append(
+                        self._make_finding(
+                            node=node,
+                            filename=filename,
+                            description=(f"{self.description} (variable: {name!r})"),
+                            fix_suggestion=_FIX,
+                            confidence=0.7,
+                        )
+                    )
+
+        return findings
+
+    @staticmethod
+    def _target_name(target: ast.AST) -> str | None:
+        """Extract the simple name from a Name or Attribute target, or None."""
+        if isinstance(target, ast.Name):
+            return target.id
+        if isinstance(target, ast.Attribute):
+            return target.attr
+        return None
+
+    @staticmethod
+    def _is_secret_literal(node: ast.AST) -> bool:
+        """Return True if *node* is a non-empty string constant."""
+        return (
+            isinstance(node, ast.Constant)
+            and isinstance(node.value, str)
+            and len(node.value) >= _MIN_SECRET_LEN
+        )
+
+
+REGISTRY.register(HardcodedSecretsRule())