narvy-cli 1.0.0__py3-none-any.whl

narvy/rules/web/local/java_narvy/spring_hardening.yml

@@ -0,0 +1,291 @@
+rules:
+
+# Java/Spring hardening: CSRF disabled, SpEL injection, permissive CORS.
+
+- id: narvy.java.spring.csrf-disabled.csrf-disabled
+  message: >-
+    CSRF protection is explicitly turned off on this
+    `HttpSecurity`/`ServerHttpSecurity` chain. Once disabled, any
+    state-changing endpoint reachable with a browser-sent cookie can be
+    triggered from a page the victim did not intend to submit (CWE-352).
+    This is a deliberate choice for pure token-authenticated APIs (no
+    cookie-based session, `Authorization: Bearer` on every call) - if that
+    is this service, leave a comment explaining why; if any endpoint still
+    relies on a session cookie, re-enable CSRF or scope the disable to the
+    stateless endpoints only.
+  severity: WARNING
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-352: Cross-Site Request Forgery (CSRF)"
+    owasp:
+      - "A01:2021 - Broken Access Control"
+    subcategory: [audit]
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: MEDIUM
+    technology: [java, spring]
+  patterns:
+    - pattern-either:
+        - pattern: $HTTP.csrf().disable()
+        - pattern: $HTTP.csrf($CSRF -> $CSRF.disable())
+        - pattern: $HTTP.csrf(AbstractHttpConfigurer::disable)
+        - pattern: $HTTP.csrf(CsrfConfigurer::disable)
+        - pattern: $HTTP.csrf(ServerHttpSecurity.CsrfSpec::disable)
+        - pattern: $HTTP.csrf(CsrfSpec::disable)
+
+- id: narvy.java.spring.spel-injection.tainted-request-parseexpression
+  message: >-
+    A Spring Expression Language (SpEL) parser evaluates an expression
+    string built from an HTTP request parameter, header, or a
+    `@RequestParam`/`@PathVariable` handler argument. SpEL is a full
+    expression language with reflection and static-method invocation
+    (`T(java.lang.Runtime).getRuntime().exec(...)` is valid SpEL) - letting
+    the request choose any part of the evaluated expression is remote code
+    execution, not just information disclosure (CWE-94). Never evaluate
+    request-derived text as SpEL; if the request must select between a
+    handful of computations, look them up in a fixed map instead.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-94: Improper Control of Generation of Code ('Code Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [vuln]
+    likelihood: MEDIUM
+    impact: HIGH
+    confidence: HIGH
+    technology: [java, spring]
+  mode: taint
+  pattern-sources:
+    - patterns:
+        - pattern-either:
+            - pattern: $REQ.getParameter(...)
+            - pattern: $REQ.getHeader(...)
+    - patterns:
+        - pattern-inside: |
+            $RET $METHOD(..., @RequestParam $T $PARAM, ...) {
+              ...
+            }
+        - pattern: $PARAM
+    - patterns:
+        - pattern-inside: |
+            $RET $METHOD(..., @RequestParam(...) $T $PARAM, ...) {
+              ...
+            }
+        - pattern: $PARAM
+    - patterns:
+        - pattern-inside: |
+            $RET $METHOD(..., @PathVariable $T $PARAM, ...) {
+              ...
+            }
+        - pattern: $PARAM
+    - patterns:
+        - pattern-inside: |
+            $RET $METHOD(..., @PathVariable(...) $T $PARAM, ...) {
+              ...
+            }
+        - pattern: $PARAM
+  pattern-sinks:
+    - patterns:
+        - pattern: $PARSER.parseExpression($SINK)
+
+- id: narvy.java.spring.spel-injection.dynamic-expression-parsed
+  message: >-
+    A SpEL `ExpressionParser`/`SpelExpressionParser` evaluates a string
+    that is not a fixed literal in this call (it comes from a getter, a
+    method argument, a loop variable, or a field). SpEL grants full
+    reflection and static-method invocation once evaluated, so parsing
+    anything other than a compile-time-fixed expression is a code-injection
+    risk the moment that string can be influenced by a stored record, a
+    config value an admin (not a developer) can edit, or an upstream call
+    (CWE-94). Confirm the expression text is fully outside user/operator
+    reach, or stop building it dynamically.
+  severity: WARNING
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-94: Improper Control of Generation of Code ('Code Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [audit]
+    likelihood: LOW
+    impact: HIGH
+    confidence: LOW
+    technology: [java, spring]
+  patterns:
+    - pattern-inside: |
+        ...
+        $PARSERTYPE $PARSER = ...;
+        ...
+    - metavariable-regex:
+        metavariable: $PARSERTYPE
+        regex: ^(SpelExpressionParser|ExpressionParser|TemplateAwareExpressionParser)$
+    - pattern: $PARSER.parseExpression($EXPR)
+    - pattern-not: $PARSER.parseExpression("...")
+    - pattern-not-inside: |
+        String $EXPR = "...";
+        ...
+
+- id: narvy.java.spring.spel-injection.dangerous-type-reference
+  message: >-
+    A hardcoded SpEL expression (parsed directly, or supplied via
+    `@Value(...)`) references `java.lang.Runtime` or
+    `java.lang.ProcessBuilder` through SpEL's `T(...)` type-reference
+    syntax. That is a working remote-code-execution gadget the moment this
+    expression string becomes reachable from outside the codebase - a
+    config value an operator can edit, a template an admin user can save,
+    or debug/test code left behind (CWE-94). Remove the type reference; if
+    process execution is genuinely needed, call `ProcessBuilder` directly
+    from Java code, not through an evaluated expression string.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-94: Improper Control of Generation of Code ('Code Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [vuln]
+    likelihood: LOW
+    impact: HIGH
+    confidence: HIGH
+    technology: [java, spring]
+  patterns:
+    - pattern-either:
+        - pattern: $PARSER.parseExpression($S)
+        - pattern: '@Value($S)'
+    - metavariable-regex:
+        metavariable: $S
+        regex: .*T\(\s*(java\.lang\.)?(Runtime|ProcessBuilder)\s*\).*
+
+- id: narvy.java.spring.permissive-cors.crossorigin-wildcard-annotation
+  message: >-
+    `@CrossOrigin` allows every origin (`"*"`, or no `origins` value at
+    all, which also defaults to allow-all). Any website can now make
+    cross-origin requests to this endpoint from a victim's browser and read
+    the response, defeating the same-origin policy that protects
+    session-cookie-authenticated users from other sites reading their data
+    (CWE-942). Name the exact origins that need access instead of `"*"`.
+  severity: WARNING
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"
+    owasp:
+      - "A05:2021 - Security Misconfiguration"
+    subcategory: [audit]
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: MEDIUM
+    technology: [java, spring]
+  patterns:
+    - pattern-either:
+        - pattern: '@CrossOrigin(origins = "*")'
+        - pattern: '@CrossOrigin(origins = {"*"})'
+        - pattern: '@CrossOrigin("*")'
+
+- id: narvy.java.spring.permissive-cors.corsconfiguration-wildcard
+  message: >-
+    A `CorsConfiguration` allows every origin (`"*"`, or the equivalent
+    `addAllowedOriginPattern("*")`/wildcard `CorsConfigurationSource`).
+    Any website can now make cross-origin requests to this application
+    from a victim's browser (CWE-942). Build the allowed-origins list from
+    a fixed set of known-good hosts instead of a wildcard.
+  severity: WARNING
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"
+    owasp:
+      - "A05:2021 - Security Misconfiguration"
+    subcategory: [audit]
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: MEDIUM
+    technology: [java, spring]
+  patterns:
+    - pattern-either:
+        - pattern: $CFG.setAllowedOrigins(java.util.List.of("*"))
+        - pattern: $CFG.setAllowedOrigins(java.util.Arrays.asList("*"))
+        - pattern: $CFG.setAllowedOrigins(java.util.Collections.singletonList("*"))
+        - pattern: $CFG.addAllowedOrigin("*")
+        - pattern: $CFG.setAllowedOriginPatterns(java.util.List.of("*"))
+        - pattern: $CFG.addAllowedOriginPattern("*")
+
+- id: narvy.java.spring.permissive-cors.corsconfiguration-wildcard-with-credentials
+  message: >-
+    This `CorsConfiguration` allows every origin AND allows credentials
+    (`setAllowCredentials(true)`). Combined, a malicious page on any site
+    can send the victim's session cookie/basic-auth header cross-origin and
+    read the authenticated response - the exact attack CORS's
+    credentialed-request checks exist to block (CWE-942). Most browsers
+    reject a literal `"*"` alongside `allowCredentials(true)` today, but a
+    reflected-origin implementation (echoing whatever `Origin` header the
+    caller sent) has the identical effect and does pass browser checks - if
+    this configuration reflects the request origin rather than using a
+    fixed allow-list, treat this as exploitable now.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"
+    owasp:
+      - "A05:2021 - Security Misconfiguration"
+    subcategory: [vuln]
+    likelihood: MEDIUM
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [java, spring]
+  patterns:
+    - pattern-inside: |
+        $CFGTYPE $CFG = ...;
+        ...
+        $CFG.setAllowCredentials(true);
+        ...
+    - pattern-either:
+        - pattern: $CFG.setAllowedOrigins(java.util.List.of("*"))
+        - pattern: $CFG.setAllowedOrigins(java.util.Arrays.asList("*"))
+        - pattern: $CFG.addAllowedOrigin("*")
+        - pattern: $CFG.setAllowedOriginPatterns(java.util.List.of("*"))
+        - pattern: $CFG.addAllowedOriginPattern("*")
+
+- id: narvy.java.spring.permissive-cors.addcorsmapping-wildcard
+  message: >-
+    A `WebMvcConfigurer.addCorsMapping` registration allows every origin
+    (`"*"`, or omits `.allowedOrigins(...)` entirely, which also defaults
+    to allow-all). Any website can now make cross-origin requests to the
+    mapped paths from a victim's browser (CWE-942). Name the exact origins
+    that need access instead of `"*"`.
+  severity: WARNING
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"
+    owasp:
+      - "A05:2021 - Security Misconfiguration"
+    subcategory: [audit]
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: MEDIUM
+    technology: [java, spring]
+  patterns:
+    - pattern-inside: |
+        class $CLASS implements WebMvcConfigurer {
+          ...
+          public void addCorsMappings(CorsRegistry $REGISTRY) {
+            ...
+          }
+          ...
+        }
+    - pattern-either:
+        - pattern: $REGISTRY.addMapping(...).allowedOrigins("*")
+        - pattern: $MAPPING.allowedOrigins("*")

narvy/rules/web/local/java_narvy/sqli.yml

@@ -0,0 +1,235 @@
+rules:
+
+# Java SQL injection: JDBC, JPA/Hibernate, Spring JdbcTemplate, MyBatis.
+
+- id: narvy.java.sqli.jdbc-statement-concat.jdbc-statement-concat
+  message: >-
+    A plain JDBC `Statement` executes a query string built with `+`
+    concatenation. `Statement` never parameterises, so any tainted value
+    reaching the concatenation is a direct SQL injection (CWE-89). Switch to
+    `PreparedStatement` with `?` placeholders and `setString`/`setInt`/etc.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [vuln]
+    likelihood: HIGH
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [java]
+  patterns:
+    - pattern-either:
+        - pattern: $STMT.executeQuery($A + $B)
+        - pattern: $STMT.executeUpdate($A + $B)
+        - pattern: $STMT.execute($A + $B)
+    - pattern-not: $STMT.executeQuery("..." + "...")
+    - pattern-not: $STMT.executeUpdate("..." + "...")
+    - pattern-not: $STMT.execute("..." + "...")
+
+- id: narvy.java.sqli.jdbc-connection-createquery-concat.jdbc-connection-createquery-concat
+  message: >-
+    `Connection.prepareStatement(...)` is called with a SQL string built by
+    `+` concatenation. Building the query text via concatenation defeats the
+    protection `PreparedStatement` exists to provide, because the tainted
+    value is already part of the parsed SQL grammar by the time the driver
+    sees it (CWE-89). Keep the query text a fixed literal and bind values
+    with `?` + `setString`/`setInt`.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [vuln]
+    likelihood: HIGH
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [java]
+  patterns:
+    - pattern-either:
+        - pattern: $CONN.prepareStatement($A + $B)
+        - pattern: $CONN.prepareStatement($A + $B, ...)
+    - pattern-not: $CONN.prepareStatement("..." + "...")
+    - pattern-not: $CONN.prepareStatement("..." + "...", ...)
+
+- id: narvy.java.sqli.jpa-createquery-concat.jpa-createquery-concat
+  message: >-
+    A JPA/Hibernate `EntityManager.createQuery(...)` or
+    `createNativeQuery(...)` builds JPQL/SQL by string concatenation. Even
+    JPQL is subject to injection when the WHERE clause, ORDER BY column, or
+    table name is built from tainted data this way (CWE-89). Use a named or
+    positional parameter (`:status`, `?1`) and `setParameter(...)` instead
+    of splicing the value into the query text.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [vuln]
+    likelihood: HIGH
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [java]
+  patterns:
+    - pattern-either:
+        - pattern: $EM.createQuery($A + $B)
+        - pattern: $EM.createNativeQuery($A + $B)
+        - pattern: $EM.createNativeQuery($A + $B, ...)
+    - pattern-not: $EM.createQuery("..." + "...")
+    - pattern-not: $EM.createNativeQuery("..." + "...")
+    - pattern-not: $EM.createNativeQuery("..." + "...", ...)
+
+# Covers the variable-indirection shape (concatenation moved to a local) that the inline rule above misses.
+- id: narvy.java.sqli.jpa-createquery-concat-var.jpa-createquery-concat-var
+  message: >-
+    The query string handed to `createQuery`/`createNativeQuery` was built
+    by string concatenation a few lines earlier and assigned to a local
+    variable. Moving the concatenation into a variable does not change
+    what reaches the database (CWE-89). Bind the value with
+    `setParameter(...)` instead.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [vuln]
+    likelihood: HIGH
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [java]
+  patterns:
+    - pattern-either:
+        - pattern: |
+            String $Q = $A + $B;
+            ...
+            $EM.createQuery($Q, ...);
+        - pattern: |
+            String $Q = $A + $B;
+            ...
+            $EM.createNativeQuery($Q, ...);
+    - pattern-not: |
+        String $Q = "..." + "...";
+        ...
+        $EM.createQuery($Q, ...);
+    - pattern-not: |
+        String $Q = "..." + "...";
+        ...
+        $EM.createNativeQuery($Q, ...);
+
+- id: narvy.java.sqli.jpa-createquery-sprintf-var.jpa-createquery-sprintf-var
+  message: >-
+    A JPQL/native query string assembled with `String.format(...)` is passed
+    to `createQuery`/`createNativeQuery`. `String.format` does not escape
+    SQL metacharacters - a tainted format argument is a SQL injection the
+    same as direct concatenation would be (CWE-89). Use a bind parameter
+    instead of formatting the value into the query text.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [vuln]
+    likelihood: MEDIUM
+    impact: HIGH
+    confidence: HIGH
+    technology: [java]
+  patterns:
+    - pattern-either:
+        - pattern: |
+            $Q = String.format($FMT, ...);
+            ...
+            $EM.createQuery($Q);
+        - pattern: |
+            $Q = String.format($FMT, ...);
+            ...
+            $EM.createNativeQuery($Q);
+
+- id: narvy.java.sqli.jdbctemplate-concat.jdbctemplate-concat
+  message: >-
+    Spring `JdbcTemplate` is called with a SQL string built by `+`
+    concatenation instead of the `?` placeholder + args form. `JdbcTemplate`
+    only protects arguments passed through its own varargs binder; splicing
+    a value into the SQL text bypasses that entirely (CWE-89). Use
+    `jdbcTemplate.query("... WHERE id = ?", rowMapper, id)`.
+  severity: ERROR
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [vuln]
+    likelihood: HIGH
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [java, spring]
+  patterns:
+    - pattern-either:
+        - pattern: $JT.query($A + $B, ...)
+        - pattern: $JT.queryForObject($A + $B, ...)
+        - pattern: $JT.queryForList($A + $B, ...)
+        - pattern: $JT.update($A + $B, ...)
+        - pattern: $JT.execute($A + $B)
+    - pattern-not: $JT.query("..." + "...", ...)
+    - pattern-not: $JT.queryForObject("..." + "...", ...)
+    - pattern-not: $JT.queryForList("..." + "...", ...)
+    - pattern-not: $JT.update("..." + "...", ...)
+    - pattern-not: $JT.execute("..." + "...")
+
+- id: narvy.java.sqli.tainted-request-param-to-statement.tainted-request-param-to-statement
+  message: >-
+    A value read directly from the HTTP request (`getParameter`,
+    `getHeader`, `getQueryString`) reaches a `Statement`/`PreparedStatement`
+    SQL sink through a local variable, with no bind-parameter API in the
+    call. Even when the sink call itself is a `PreparedStatement`, if the
+    tainted value ends up as part of the SQL text (versus a bound `?`
+    argument) it is a SQL injection (CWE-89). Bind the value with
+    `setString`/`setInt`/etc; never build the SQL string from request data.
+  severity: WARNING
+  languages: [java]
+  metadata:
+    category: security
+    cwe:
+      - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+    owasp:
+      - "A03:2021 - Injection"
+    subcategory: [vuln]
+    likelihood: MEDIUM
+    impact: HIGH
+    confidence: MEDIUM
+    technology: [java]
+  mode: taint
+  pattern-sources:
+    - patterns:
+        - pattern-either:
+            - pattern: $REQ.getParameter(...)
+            - pattern: $REQ.getHeader(...)
+            - pattern: $REQ.getQueryString()
+  pattern-sinks:
+    - patterns:
+        - pattern-either:
+            - pattern: $STMT.executeQuery("..." + $SINK + "...")
+            - pattern: $STMT.executeQuery("..." + $SINK)
+            - pattern: $STMT.executeUpdate("..." + $SINK + "...")
+            - pattern: $STMT.execute("..." + $SINK + "...")
+  pattern-sanitizers:
+    - patterns:
+        - pattern: Integer.parseInt(...)
+    - patterns:
+        - pattern: Long.parseLong(...)