codeintely-cli 0.1.0__py3-none-any.whl

codeintely_cli/rules/jsts_backend.yaml

@@ -0,0 +1,167 @@
+rules:
+  # --- JS/TS backend authz gap closure ---------------------------------------
+  #
+  # Every JS/TS rule shipped before this file was React-*frontend*-only
+  # (owasp_generic.yaml: dangerouslySetInnerHTML, JWT-in-localStorage) —
+  # zero Express/NestJS backend tenant-isolation/authz coverage existed.
+  # These retarget the same IDOR/privilege-escalation/RBAC categories
+  # already proven reliable for Django/FastAPI (identity_security.yaml,
+  # tenant_isolation.yaml) at the two most common modern Node backend
+  # stacks: Express+Prisma/Mongoose, and NestJS's decorator-based routing.
+  #
+  # Real Semgrep behavior difference from Python, found by testing rather
+  # than assumed: a JS/TS object-literal pattern like `{ id: $ID }` (no
+  # ellipsis) matches ANY object containing at least an `id` key,
+  # regardless of what else is in it — unlike Python's dict patterns,
+  # which need an explicit `...` to mean "and possibly more" and default
+  # to an exact match without one. This meant the first version of the
+  # Prisma rules below, using a `pattern-not` with an explicit `...` to
+  # try to exclude "has more than just id," instead matched NOTHING at
+  # all — `...` in a JS object pattern also matches the zero-additional-
+  # keys case, so the pattern-not cancelled out the intended vulnerable
+  # match too. Fixed with a `pattern-not-regex` naming the common
+  # tenant/ownership field names directly (organizationId/orgId/
+  # tenantId/userId/ownerId/accountId) instead of trying to express "no
+  # additional keys of any kind" structurally.
+
+  - id: express-prisma-find-unique-missing-tenant-filter
+    languages: [js, ts]
+    severity: ERROR
+    message: >-
+      This Prisma `findUnique` looks up a row by `id` alone, with no
+      tenant/org/user field in the same `where` clause. In a multi-tenant
+      app this is a direct IDOR: any authenticated caller can fetch another
+      tenant's row by guessing/incrementing the id. Add the caller's
+      tenant/owner as an extra field in the same `where` object, e.g.
+      `where: { id, organizationId: req.user.organizationId }`. (Heuristic
+      rule based on common field names — expect some false positives on
+      genuinely single-tenant/global models.)
+    metadata:
+      owasp_category: "A01:2021 - Broken Access Control"
+      cwe: "CWE-639"
+      internal_severity: HIGH
+    patterns:
+      - pattern: '$PRISMA.$MODEL.findUnique({ where: { id: $ID } })'
+      - pattern-not-regex: '(?i)(organizationId|orgId|tenantId|userId|ownerId|accountId)'
+
+  - id: express-prisma-find-first-missing-tenant-filter
+    languages: [js, ts]
+    severity: ERROR
+    message: >-
+      This Prisma `findFirst` filters by `id` alone, with no tenant/org/
+      user field in the same `where` clause — the same IDOR shape as
+      `findUnique` with only an id filter. Add the caller's tenant/owner as
+      an extra field in the same `where` object. (Heuristic rule based on
+      common field names — expect some false positives on genuinely
+      single-tenant/global models.)
+    metadata:
+      owasp_category: "A01:2021 - Broken Access Control"
+      cwe: "CWE-639"
+      internal_severity: HIGH
+    patterns:
+      - pattern: '$PRISMA.$MODEL.findFirst({ where: { id: $ID } })'
+      - pattern-not-regex: '(?i)(organizationId|orgId|tenantId|userId|ownerId|accountId)'
+
+  - id: express-mongoose-findbyid-no-tenant-scoping
+    languages: [js, ts]
+    severity: WARNING
+    message: >-
+      `Model.findById(id)` looks up a row by id alone with no way to add a
+      tenant/owner filter in the same call (unlike `findOne`/`find`, which
+      take a full query object) — in a multi-tenant app this is a direct
+      IDOR unless ownership is verified separately after the fetch. Prefer
+      `Model.findOne({ _id: id, organizationId: req.user.organizationId })`
+      instead, or explicitly verify the fetched document's owner/tenant
+      field before returning it. (Heuristic rule — flags every bare
+      `findById` call as worth a second look, since this shape has no
+      inline way to show a tenant check even when one does happen
+      elsewhere; expect some false positives where ownership is verified
+      in a separate line.)
+    metadata:
+      owasp_category: "A01:2021 - Broken Access Control"
+      cwe: "CWE-639"
+      internal_severity: MEDIUM
+    pattern: $MODEL.findById($ID)
+
+  - id: express-mass-assignment-from-body
+    languages: [js, ts]
+    severity: ERROR
+    message: >-
+      This ORM write passes the raw request body straight through with no
+      field allowlist. Any field the client includes in the body — a
+      privilege/tenancy field like `role`/`isAdmin`/`organizationId`
+      included — gets written as-is. Explicitly pick only the fields this
+      endpoint should accept (destructure the specific fields, or use your
+      ORM's field-allowlist option) instead of passing the whole body
+      object through.
+    metadata:
+      owasp_category: "A01:2021 - Broken Access Control"
+      cwe: "CWE-915"
+      internal_severity: CRITICAL
+    patterns:
+      - pattern-either:
+          - pattern: $MODEL.create(req.body)
+          - pattern: '$MODEL.create({ data: req.body })'
+          - pattern: $MODEL.update(req.body)
+          - pattern: $MODEL.updateOne(req.body)
+          - pattern: Object.assign($OBJ, req.body)
+
+  - id: express-privilege-field-from-body
+    languages: [js, ts]
+    severity: ERROR
+    message: >-
+      A privilege/tenancy attribute is being set directly from
+      `req.body`. If this code path is reachable by a normal
+      (non-admin) authenticated user, they can grant themselves elevated
+      privileges or move themselves into another tenant by sending that
+      field in the request body. Set this field only from trusted
+      server-side logic, gated behind an explicit admin/role check.
+    metadata:
+      owasp_category: "A01:2021 - Broken Access Control"
+      cwe: "CWE-269"
+      internal_severity: CRITICAL
+    patterns:
+      - pattern-either:
+          - pattern: $OBJ.role = req.body.role
+          - pattern: $OBJ.isAdmin = req.body.isAdmin
+          - pattern: $OBJ.is_admin = req.body.is_admin
+          - pattern: $OBJ.isStaff = req.body.isStaff
+          - pattern: $OBJ.organizationId = req.body.organizationId
+          - pattern: $OBJ.tenantId = req.body.tenantId
+
+  - id: nestjs-controller-missing-guard
+    languages: [ts]
+    severity: WARNING
+    message: >-
+      This `@Controller` class has no `@UseGuards(...)` anywhere on the
+      class or its route handlers. Being routable isn't the same as being
+      authorized — every route on this controller is reachable by anyone
+      who can reach the app at all, with no authentication/authorization
+      check. Add `@UseGuards(AuthGuard(...))` (or your app's equivalent) at
+      the class level, or per-method if only some routes need it.
+    metadata:
+      owasp_category: "A01:2021 - Broken Access Control"
+      cwe: "CWE-862"
+      internal_severity: HIGH
+    patterns:
+      - pattern: |
+          @Controller(...)
+          class $CTRL {
+            ...
+          }
+      - pattern-not: |
+          @Controller(...)
+          @UseGuards(...)
+          class $CTRL {
+            ...
+          }
+      - pattern-not: |
+          @Controller(...)
+          class $CTRL {
+            ...
+            @UseGuards(...)
+            $METHOD(...) {
+              ...
+            }
+            ...
+          }

codeintely_cli/rules/mass_assignment.yaml

@@ -0,0 +1,37 @@
+rules:
+  - id: drf-serializer-fields-all
+    languages: [python]
+    severity: WARNING
+    message: >-
+      This DRF ModelSerializer uses `fields = "__all__"`. Any field added to the
+      model later (including sensitive ones like `is_admin`, `tenant_id`, `role`)
+      becomes writable through this serializer without a deliberate decision.
+      Prefer an explicit `fields` list or `read_only_fields` for anything the
+      client shouldn't set.
+    metadata:
+      owasp_category: "A01:2021 - Broken Access Control"
+      cwe: "CWE-915"
+      internal_severity: MEDIUM
+    patterns:
+      - pattern: |
+          class $META:
+              model = $MODEL
+              fields = "__all__"
+
+  - id: django-mass-assignment-from-request-data
+    languages: [python]
+    severity: ERROR
+    message: >-
+      This creates/updates a model directly from `request.data`/`request.POST`
+      without going through a serializer's field allowlist. A client can set any
+      model field this way — including ones they shouldn't control, like
+      `is_admin`, `tenant_id`, or `role`.
+    metadata:
+      owasp_category: "A01:2021 - Broken Access Control"
+      cwe: "CWE-915"
+      internal_severity: HIGH
+    patterns:
+      - pattern-either:
+          - pattern: $MODEL.objects.create(**request.data)
+          - pattern: $MODEL.objects.create(**request.POST)
+          - pattern: $MODEL.objects.create(**request.POST.dict())

codeintely_cli/rules/owasp_generic.yaml

@@ -0,0 +1,94 @@
+rules:
+  - id: django-raw-sql-string-built
+    languages: [python]
+    severity: WARNING
+    message: >-
+      This raw SQL call looks string-built (f-string/`.format()`/`%`) rather than
+      using parameterized placeholders. If any part of the query comes from user
+      input, this is SQL injection. Use parameterized placeholders (`%s` with a
+      params list/tuple) instead of formatting user input into the query string.
+    metadata:
+      owasp_category: "A03:2021 - Injection"
+      cwe: "CWE-89"
+      internal_severity: HIGH
+    patterns:
+      - pattern-either:
+          - pattern: $MODEL.objects.raw($QUERY)
+          - pattern: $CURSOR.execute($QUERY)
+      - metavariable-regex:
+          metavariable: $QUERY
+          regex: '.*(f"|f''|\.format\(|%\s*\().*'
+
+  - id: django-debug-true
+    languages: [python]
+    severity: ERROR
+    message: >-
+      DEBUG = True must never ship to production — it leaks stack traces, settings
+      values, and source snippets on error pages to anyone who can trigger a 500.
+    metadata:
+      owasp_category: "A05:2021 - Security Misconfiguration"
+      cwe: "CWE-215"
+      internal_severity: CRITICAL
+    pattern: DEBUG = True
+
+  - id: django-cors-allow-all-origins
+    languages: [python]
+    severity: ERROR
+    message: >-
+      CORS_ALLOW_ALL_ORIGINS = True lets any website make cross-origin requests to
+      this API, including ones carrying a logged-in user's credentials if
+      CORS_ALLOW_CREDENTIALS is also on. Set an explicit CORS_ALLOWED_ORIGINS
+      allowlist instead.
+    metadata:
+      owasp_category: "A05:2021 - Security Misconfiguration"
+      cwe: "CWE-942"
+      internal_severity: HIGH
+    pattern: CORS_ALLOW_ALL_ORIGINS = True
+
+  - id: django-fileupload-original-filename
+    languages: [python]
+    severity: WARNING
+    message: >-
+      This saves an uploaded file using its original filename with no visible
+      extension/content-type validation nearby. A crafted filename (path
+      traversal, double extension, disguised executable) could be written as-is.
+      Validate extension/content-type and generate a safe filename before saving.
+    metadata:
+      owasp_category: "A04:2021 - Insecure Design"
+      cwe: "CWE-434"
+      internal_severity: MEDIUM
+    patterns:
+      - pattern-either:
+          - pattern: default_storage.save($FILE.name, $FILE)
+          - pattern: open($FILE.name, ...)
+
+  - id: react-dangerously-set-inner-html
+    languages: [js, ts]
+    severity: WARNING
+    message: >-
+      `dangerouslySetInnerHTML` renders raw HTML without React's normal escaping.
+      If any part of this value comes from user input or an API response, this is
+      a stored/reflected XSS vector. Sanitize with a library like DOMPurify before
+      rendering, or avoid raw HTML entirely.
+    metadata:
+      owasp_category: "A03:2021 - Injection"
+      cwe: "CWE-79"
+      internal_severity: HIGH
+    pattern: <$EL dangerouslySetInnerHTML={...} />
+
+  - id: jwt-stored-in-localstorage
+    languages: [js, ts]
+    severity: WARNING
+    message: >-
+      Storing a JWT/access token in localStorage exposes it to any XSS on the
+      page — localStorage is readable by any script running on the origin.
+      Prefer an httpOnly, Secure, SameSite cookie for session/auth tokens.
+    metadata:
+      owasp_category: "A02:2021 - Cryptographic Failures"
+      cwe: "CWE-522"
+      internal_severity: MEDIUM
+    patterns:
+      - pattern: localStorage.setItem($KEY, $TOKEN)
+      - metavariable-regex:
+          metavariable: $KEY
+          regex: '(?i).*(token|jwt|auth).*'

codeintely_cli/rules/tenant_isolation.yaml

@@ -0,0 +1,100 @@
+rules:
+  - id: django-viewset-missing-permission-classes
+    languages: [python]
+    severity: ERROR
+    message: >-
+      This DRF ViewSet/APIView does not declare `permission_classes`. Without it, DRF
+      falls back to the global DEFAULT_PERMISSION_CLASSES (or AllowAny if that's unset),
+      which can expose this endpoint to unauthenticated or unauthorized users.
+    metadata:
+      owasp_category: "A01:2021 - Broken Access Control"
+      cwe: "CWE-862"
+      internal_severity: HIGH
+    patterns:
+      - pattern: |
+          class $VIEW(...):
+              ...
+      - pattern-not: |
+          class $VIEW(...):
+              ...
+              permission_classes = ...
+              ...
+      - metavariable-regex:
+          metavariable: $VIEW
+          regex: ".*(ViewSet|APIView)$"
+
+  - id: django-orm-query-missing-tenant-filter
+    languages: [python]
+    severity: WARNING
+    message: >-
+      This ORM lookup filters only by id/pk with no tenant/org scoping visible in the
+      same call. In a multi-tenant app, a user could read another tenant's row by
+      guessing/incrementing the id. Scope the query with the caller's tenant, e.g.
+      `.filter(id=pk, tenant=request.user.tenant)`. (Heuristic rule — expect some
+      false positives on genuinely single-tenant models; a strong candidate for
+      suppression-pattern learning once that exists.)
+    metadata:
+      owasp_category: "A01:2021 - Broken Access Control"
+      cwe: "CWE-639"
+      internal_severity: HIGH
+    patterns:
+      - pattern-either:
+          - pattern: $MODEL.objects.get(id=$ID)
+          - pattern: $MODEL.objects.get(pk=$PK)
+          - pattern: $MODEL.objects.filter(id=$ID)
+          - pattern: $MODEL.objects.filter(pk=$PK)
+
+  - id: fastapi-route-missing-auth-dependency
+    languages: [python]
+    severity: ERROR
+    message: >-
+      This FastAPI route has no `Depends(...)` in its decorator/signature. If this
+      endpoint should require authentication, add a dependency such as
+      `Depends(get_current_user)`.
+    metadata:
+      owasp_category: "A01:2021 - Broken Access Control"
+      cwe: "CWE-306"
+      internal_severity: HIGH
+    patterns:
+      - pattern-either:
+          - pattern: |
+              @$APP.get($PATH, ...)
+              def $FUNC(...):
+                  ...
+          - pattern: |
+              @$APP.post($PATH, ...)
+              def $FUNC(...):
+                  ...
+          - pattern: |
+              @$APP.put($PATH, ...)
+              def $FUNC(...):
+                  ...
+          - pattern: |
+              @$APP.delete($PATH, ...)
+              def $FUNC(...):
+                  ...
+      - pattern-not-regex: "Depends\\("
+
+  - id: fastapi-admin-route-missing-role-check
+    languages: [python]
+    severity: WARNING
+    message: >-
+      This route's path looks admin/internal-only but its body has no visible
+      role/permission check (e.g. `require_role(...)`, `.is_admin`,
+      `check_permission(...)`). Being authenticated isn't the same as being
+      authorized — verify the caller's role explicitly for privileged actions.
+      (Heuristic rule based on path naming; adjust the regex to your project's
+      conventions.)
+    metadata:
+      owasp_category: "A01:2021 - Broken Access Control"
+      cwe: "CWE-862"
+      internal_severity: MEDIUM
+    patterns:
+      - pattern: |
+          @$APP.$METHOD($PATH, ...)
+          def $FUNC(...):
+              ...
+      - metavariable-regex:
+          metavariable: $PATH
+          regex: '.*(admin|internal).*'
+      - pattern-not-regex: "(require_role|check_permission|is_admin|is_staff|is_superuser)"