sight/static_rules_typescript.go at main · GrayCodeAI/sight · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
package sight

import "regexp"

// typescriptSecurityRules returns built-in static analysis rules for TypeScript and JavaScript.
func typescriptSecurityRules() []StaticRule {
	return []StaticRule{
		// =====================================================================
		// SECURITY - TypeScript/JavaScript
		// =====================================================================
		{
			ID:          "SEC-TS-001",
			Name:        "innerHTML Assignment",
			Description: "Direct innerHTML assignment enables XSS attacks",
			Language:    "typescript",
			Pattern:     regexp.MustCompile(`\.innerHTML\s*=`),
			Antipattern: regexp.MustCompile(`(?i)(?:sanitize|DOMPurify|escape)`),
			Severity:    "high",
			Category:    "security",
			CWE:         "CWE-79",
			Fix:         "Use textContent for plain text or a sanitization library (DOMPurify) for HTML",
		},
		{
			ID:          "SEC-JS-001",
			Name:        "innerHTML Assignment",
			Description: "Direct innerHTML assignment enables XSS attacks",
			Language:    "javascript",
			Pattern:     regexp.MustCompile(`\.innerHTML\s*=`),
			Antipattern: regexp.MustCompile(`(?i)(?:sanitize|DOMPurify|escape)`),
			Severity:    "high",
			Category:    "security",
			CWE:         "CWE-79",
			Fix:         "Use textContent for plain text or a sanitization library (DOMPurify) for HTML",
		},
		{
			ID:          "SEC-TS-002",
			Name:        "eval() Usage",
			Description: "eval() executes arbitrary code and is a common injection vector",
			Language:    "typescript",
			Pattern:     regexp.MustCompile(`\beval\s*\(`),
			Antipattern: nil,
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-95",
			Fix:         "Use JSON.parse() for data or Function constructor with extreme caution",
		},
		{
			ID:          "SEC-JS-002",
			Name:        "eval() Usage",
			Description: "eval() executes arbitrary code and is a common injection vector",
			Language:    "javascript",
			Pattern:     regexp.MustCompile(`\beval\s*\(`),
			Antipattern: nil,
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-95",
			Fix:         "Use JSON.parse() for data or Function constructor with extreme caution",
		},
		{
			ID:          "SEC-TS-003",
			Name:        "Prototype Pollution",
			Description: "__proto__ access can lead to prototype pollution attacks",
			Language:    "typescript",
			Pattern:     regexp.MustCompile(`__proto__`),
			Antipattern: regexp.MustCompile(`(?i)(?:hasOwnProperty|Object\.create\(null\))`),
			Severity:    "high",
			Category:    "security",
			CWE:         "CWE-1321",
			Fix:         "Use Object.create(null) for lookup objects or validate keys against __proto__, constructor, prototype",
		},
		{
			ID:          "SEC-JS-003",
			Name:        "Prototype Pollution",
			Description: "__proto__ access can lead to prototype pollution attacks",
			Language:    "javascript",
			Pattern:     regexp.MustCompile(`__proto__`),
			Antipattern: regexp.MustCompile(`(?i)(?:hasOwnProperty|Object\.create\(null\))`),
			Severity:    "high",
			Category:    "security",
			CWE:         "CWE-1321",
			Fix:         "Use Object.create(null) for lookup objects or validate keys against __proto__, constructor, prototype",
		},
		{
			ID:          "SEC-TS-004",
			Name:        "Regex DoS",
			Description: "Complex regex with nested quantifiers may be vulnerable to ReDoS",
			Language:    "typescript",
			Pattern:     regexp.MustCompile(`(?:new RegExp|/).*(?:\+\+|\*\*|\{\d+,\}.*\{\d+,\}|(?:\.\*){2,}|\([^)]*\+\)[^)]*\+)`),
			Antipattern: nil,
			Severity:    "medium",
			Category:    "security",
			CWE:         "CWE-1333",
			Fix:         "Simplify regex; add bounds to quantifiers; consider using re2 or a timeout",
		},
		{
			ID:          "SEC-JS-004",
			Name:        "Regex DoS",
			Description: "Complex regex with nested quantifiers may be vulnerable to ReDoS",
			Language:    "javascript",
			Pattern:     regexp.MustCompile(`(?:new RegExp|/).*(?:\+\+|\*\*|\{\d+,\}.*\{\d+,\}|(?:\.\*){2,}|\([^)]*\+\)[^)]*\+)`),
			Antipattern: nil,
			Severity:    "medium",
			Category:    "security",
			CWE:         "CWE-1333",
			Fix:         "Simplify regex; add bounds to quantifiers; consider using re2 or a timeout",
		},
		{
			ID:          "SEC-TS-005",
			Name:        "Hardcoded Secret (TS)",
			Description: "Hardcoded password or secret string detected",
			Language:    "typescript",
			Pattern:     regexp.MustCompile(`(?i)(?:password|secret|api_?key|token|private_?key)\s*[=:]\s*["'][^"']{4,}["']`),
			Antipattern: regexp.MustCompile(`(?i)(?:test|example|placeholder|TODO|CHANGE|xxx|dummy|process\.env|import)`),
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-798",
			Fix:         "Use environment variables or a secrets manager instead of hardcoded credentials",
		},
		{
			ID:          "SEC-JS-005",
			Name:        "Hardcoded Secret (JS)",
			Description: "Hardcoded password or secret string detected",
			Language:    "javascript",
			Pattern:     regexp.MustCompile(`(?i)(?:password|secret|api_?key|token|private_?key)\s*[=:]\s*["'][^"']{4,}["']`),
			Antipattern: regexp.MustCompile(`(?i)(?:test|example|placeholder|TODO|CHANGE|xxx|dummy|process\.env|import)`),
			Severity:    "critical",
			Category:    "security",
			CWE:         "CWE-798",
			Fix:         "Use environment variables or a secrets manager instead of hardcoded credentials",
		},
	}
}