static_rules_systems.go

package sight

import "regexp"

// systemsSecurityRules returns built-in static analysis rules for
// cross-language (any), Rust, C, and C++.
func systemsSecurityRules() []StaticRule {
	return []StaticRule{
		// =====================================================================
		// SECURITY - Any Language
		// =====================================================================
		{
			ID:          "SEC-ANY-001",
			Name:        "TODO Security",
			Description: "TODO/FIXME/HACK comment related to security found in code",
			Language:    "any",
			Pattern:     regexp.MustCompile(`(?i)(?://|#|/\*)\s*(?:TODO|FIXME|HACK|XXX).*(?:security|auth|crypt|password|token|vuln|inject|xss|csrf)`),
			Antipattern: nil,
			Severity:    "medium",
			Category:    "security",
			CWE:         "",
			Fix:         "Address security-related TODOs before shipping; they indicate known unresolved issues",
		},
		{
			ID:          "SEC-ANY-002",
			Name:        "Private Key in Source",
			Description: "Private key material appears to be embedded in source code",
			Language:    "any",
			Pattern:     regexp.MustCompile(`-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----`),
			Antipattern: regexp.MustCompile(`(?i)(?:test|example|sample|mock|fixture)`),
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-798",
			Fix:         "Remove private keys from source; load them from secure storage or environment at runtime",
		},
		{
			ID:          "SEC-ANY-003",
			Name:        "HTTP in Production",
			Description: "Insecure HTTP URL used where HTTPS should be expected",
			Language:    "any",
			Pattern:     regexp.MustCompile(`http://[a-zA-Z][a-zA-Z0-9._-]*`),
			Antipattern: regexp.MustCompile(`(?i)(?:http://localhost|http://127\.0\.0\.1|http://0\.0\.0\.0|http://\[?::1|http://example\.com|test|spec|mock|doc|xmlns|http://www\.w3\.org)`),
			Severity:    "low",
			Category:    "security",
			CWE:         "CWE-319",
			Fix:         "Use HTTPS for all production URLs to prevent man-in-the-middle attacks",
		},
		// =====================================================================
		// SECURITY - Rust
		// =====================================================================
		{
			ID:          "SEC-RS-001",
			Name:        "Unsafe Block",
			Description: "unsafe block bypasses Rust's memory safety guarantees; ensure the invariant is upheld",
			Language:    "rust",
			Pattern:     regexp.MustCompile(`\bunsafe\s*\{`),
			Antipattern: nil,
			Severity:    "high",
			Category:    "security",
			CWE:         "CWE-242",
			Fix:         "Avoid unsafe blocks; use safe abstractions. If required, document the safety invariant in a comment",
		},
		{
			ID:          "SEC-RS-002",
			Name:        "unwrap() in Production",
			Description: "unwrap() will panic at runtime if the value is None/Err; handle errors gracefully instead",
			Language:    "rust",
			Pattern:     regexp.MustCompile(`\.unwrap\(\)`),
			Antipattern: regexp.MustCompile(`(?i)(?:test|#\[test|#\[cfg\(test|expect\()`),
			Severity:    "medium",
			Category:    "correctness",
			CWE:         "CWE-252",
			Fix:         "Use match, if let, or the ? operator to handle Option/Result properly",
		},
		{
			ID:          "SEC-RS-003",
			Name:        "Hardcoded Secret (Rust)",
			Description: "Hardcoded password or secret string detected",
			Language:    "rust",
			Pattern:     regexp.MustCompile(`(?i)(?:password|secret|api_?key|token|private_?key)\s*(?:=>|:)\s*"[^"]{4,}`),
			Antipattern: regexp.MustCompile(`(?i)(?:test|example|placeholder|TODO|CHANGE|xxx|dummy|fake)`),
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-798",
			Fix:         "Use environment variables or a secrets manager instead of hardcoded credentials",
		},
		{
			ID:          "SEC-RS-004",
			Name:        "SQL Injection (Rust)",
			Description: "format! macro used in SQL query construction; use parameterized queries",
			Language:    "rust",
			Pattern:     regexp.MustCompile(`format!\s*\(\s*"[^"]*(?:SELECT|INSERT|UPDATE|DELETE|DROP)[^"]*\{`),
			Antipattern: nil,
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-89",
			Fix:         "Use parameterized queries with $1 placeholders (e.g., sqlx or diesel) instead of format!",
		},
		{
			ID:          "SEC-RS-005",
			Name:        "Command Injection (Rust)",
			Description: "Command::new with user-controlled input may allow command injection",
			Language:    "rust",
			Pattern:     regexp.MustCompile(`Command::new\s*\([^"'][^)]*\)`),
			Antipattern: regexp.MustCompile(`Command::new\s*\(\s*"[^"]+"\s*\)`),
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-78",
			Fix:         "Validate and sanitize all input passed to Command::new; use an allowlist of permitted commands",
		},
		// =====================================================================
		// SECURITY - C
		// =====================================================================
		{
			ID:          "SEC-C-001",
			Name:        "Buffer Overflow",
			Description: "Unsafe string function (strcpy, strcat, sprintf, gets) used without bounds checking",
			Language:    "c",
			Pattern:     regexp.MustCompile(`\b(?:strcpy|strcat|sprintf|gets)\s*\(`),
			Antipattern: regexp.MustCompile(`(?:strncpy|strncat|snprintf|fgets|safe)`),
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-120",
			Fix:         "Use bounded variants: strncpy, strncat, snprintf, or fgets instead",
		},
		{
			ID:          "SEC-C-002",
			Name:        "Format String Vulnerability",
			Description: "printf-family function called with non-literal format string; may enable format string attacks",
			Language:    "c",
			Pattern:     regexp.MustCompile(`\b(?:printf|fprintf|sprintf|snprintf)\s*\(\s*[a-zA-Z_][a-zA-Z0-9_]*\s*[,)]`),
			Antipattern: nil,
			Severity:    "high",
			Category:    "security",
			CWE:         "CWE-134",
			Fix:         `Use a literal format string: printf("%s", var) instead of printf(var)`,
		},
		{
			ID:          "SEC-C-003",
			Name:        "Use-After-Free Risk",
			Description: "Pointer used after free() call without being set to NULL",
			Language:    "c",
			Pattern:     regexp.MustCompile(`\bfree\s*\(\s*\w+\s*\)`),
			Antipattern: regexp.MustCompile(`(?:(?:\w+)\s*=\s*NULL|=\s*0\b)`),
			Severity:    "high",
			Category:    "security",
			CWE:         "CWE-416",
			Fix:         "Set pointer to NULL after free() to prevent use-after-free and double-free",
		},
		{
			ID:          "SEC-C-004",
			Name:        "Hardcoded Secret (C/C++)",
			Description: "Hardcoded password or secret string detected",
			Language:    "c",
			Pattern:     regexp.MustCompile(`(?i)(?:password|secret|api_?key|token|private_?key)\s*=\s*"[^"]{4,}"`),
			Antipattern: regexp.MustCompile(`(?i)(?:test|example|placeholder|TODO|CHANGE|xxx|dummy|fake)`),
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-798",
			Fix:         "Use environment variables or a secure configuration mechanism instead of hardcoded secrets",
		},
		{
			ID:          "SEC-C-005",
			Name:        "Command Injection (C)",
			Description: "system() or popen() with user-controlled input may allow command injection",
			Language:    "c",
			Pattern:     regexp.MustCompile(`\b(?:system|popen)\s*\(\s*[a-zA-Z_]`),
			Antipattern: regexp.MustCompile(`\b(?:system|popen)\s*\(\s*"[^"]*"\s*\)`),
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-78",
			Fix:         "Use execve() with an explicit argument vector instead of system()/popen() with shell interpretation",
		},
		// =====================================================================
		// SECURITY - C++
		// =====================================================================
		{
			ID:          "SEC-CPP-001",
			Name:        "Buffer Overflow (C++)",
			Description: "Unsafe string function (strcpy, strcat, sprintf, gets) used without bounds checking",
			Language:    "cpp",
			Pattern:     regexp.MustCompile(`\b(?:strcpy|strcat|sprintf|gets)\s*\(`),
			Antipattern: regexp.MustCompile(`(?:strncpy|strncat|snprintf|fgets|std::string|safe)`),
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-120",
			Fix:         "Use std::string or bounded variants: strncpy, strncat, snprintf, or fgets instead",
		},
		{
			ID:          "SEC-CPP-002",
			Name:        "Format String Vulnerability (C++)",
			Description: "printf-family function called with non-literal format string",
			Language:    "cpp",
			Pattern:     regexp.MustCompile(`\b(?:printf|fprintf|sprintf|snprintf)\s*\(\s*[a-zA-Z_][a-zA-Z0-9_]*\s*[,)]`),
			Antipattern: nil,
			Severity:    "high",
			Category:    "security",
			CWE:         "CWE-134",
			Fix:         "Use a literal format string or std::cout / fmt::format instead",
		},
		{
			ID:          "SEC-CPP-003",
			Name:        "Use-After-Free Risk (C++)",
			Description: "Pointer used after free()/delete without being set to nullptr",
			Language:    "cpp",
			Pattern:     regexp.MustCompile(`\b(?:free\s*\(\s*\w+\s*\)|delete\s+\w+)`),
			Antipattern: regexp.MustCompile(`(?:(?:\w+)\s*=\s*(?:NULL|nullptr)|=\s*0\b|unique_ptr|shared_ptr)`),
			Severity:    "high",
			Category:    "security",
			CWE:         "CWE-416",
			Fix:         "Use smart pointers (unique_ptr, shared_ptr); set raw pointers to nullptr after delete",
		},
		{
			ID:          "SEC-CPP-004",
			Name:        "Hardcoded Secret (C++)",
			Description: "Hardcoded password or secret string detected",
			Language:    "cpp",
			Pattern:     regexp.MustCompile(`(?i)(?:password|secret|api_?key|token|private_?key)\s*=\s*"[^"]{4,}"`),
			Antipattern: regexp.MustCompile(`(?i)(?:test|example|placeholder|TODO|CHANGE|xxx|dummy|fake)`),
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-798",
			Fix:         "Use environment variables or a secure configuration mechanism instead of hardcoded secrets",
		},
		{
			ID:          "SEC-CPP-005",
			Name:        "Command Injection (C++)",
			Description: "system() or popen() with user-controlled input may allow command injection",
			Language:    "cpp",
			Pattern:     regexp.MustCompile(`\b(?:system|popen)\s*\(\s*[a-zA-Z_]`),
			Antipattern: regexp.MustCompile(`\b(?:system|popen)\s*\(\s*"[^"]*"\s*\)`),
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-78",
			Fix:         "Use execve() or boost::process with an explicit argument vector instead of system()/popen()",
		},
	}
}