Skip to content

Commit 93feb70

Browse files
gatsby003claude
gatsby003
and
claude
committed
Add TypeScript security rules and tooling
- Add 5 TypeScript security rules with comprehensive tests - Add Claude integration for development assistance - Add temporary dashboard functionality - Add ts-node security rules for runtime protection 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>
1 parent 7312010 commit 93feb70

File tree

59 files changed

+1855
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

59 files changed

+1855
-0
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,3 +197,4 @@ cscope.in.out
197197
cscope.po.out
198198

199199
# End of https://www.toptal.com/developers/gitignore/api/node,tags,macos
200+
.claude

‎rules/typescript/security/argon2-weak-type-typescript.yml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
id: argon2-weak-type-typescript
2+
severity: error
3+
language: typescript
4+
message: >-
5+
Use secure encryption types when using `argon2`. Avoid using weak argon2 types
6+
like argon2i or argon2d. Use argon2id instead for better security.
7+
note: >-
8+
[CWE-327] Use of a Broken or Risky Cryptographic Algorithm.
9+
[REFERENCES]
10+
- https://github.com/ranisalt/node-argon2/wiki/Options#type
11+
ast-grep-essentials: true
12+
utils:
13+
MATCH_ARGON2_WEAK_TYPE:
14+
kind: call_expression
15+
all:
16+
- has:
17+
stopBy: neighbor
18+
kind: member_expression
19+
all:
20+
- has:
21+
stopBy: neighbor
22+
kind: identifier
23+
regex: "^argon2$"
24+
- has:
25+
stopBy: neighbor
26+
kind: property_identifier
27+
regex: "^hash$"
28+
- has:
29+
stopBy: neighbor
30+
kind: arguments
31+
has:
32+
stopBy: neighbor
33+
kind: object
34+
has:
35+
stopBy: neighbor
36+
kind: pair
37+
all:
38+
- has:
39+
stopBy: neighbor
40+
kind: property_identifier
41+
regex: "^type$"
42+
- has:
43+
stopBy: neighbor
44+
kind: member_expression
45+
all:
46+
- has:
47+
stopBy: neighbor
48+
kind: identifier
49+
regex: "^argon2$"
50+
- has:
51+
stopBy: neighbor
52+
kind: property_identifier
53+
any:
54+
- regex: "^argon2i$"
55+
- regex: "^argon2d$"
56+
rule:
57+
kind: call_expression
58+
any:
59+
- matches: MATCH_ARGON2_WEAK_TYPE

‎rules/typescript/security/avoid-crypto-rc4-typescript.yml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
id: avoid-crypto-rc4-typescript
2+
severity: warning
3+
language: typescript
4+
message: >-
5+
Avoid RC4 encryption. Use of the RC4 security protocol exposes your
6+
application to vulnerabilities. Consider using stronger encryption algorithms.
7+
note: >-
8+
[CWE-328] Use of Weak Hash.
9+
[REFERENCES]
10+
- https://cryptojs.gitbook.io/docs/#ciphers
11+
ast-grep-essentials: true
12+
utils:
13+
MATCH_RC4_USAGE:
14+
kind: call_expression
15+
has:
16+
stopBy: neighbor
17+
kind: member_expression
18+
all:
19+
- has:
20+
stopBy: neighbor
21+
kind: member_expression
22+
all:
23+
- has:
24+
stopBy: neighbor
25+
kind: identifier
26+
regex: "^CryptoJS$"
27+
- has:
28+
stopBy: neighbor
29+
kind: property_identifier
30+
any:
31+
- regex: "^RC4$"
32+
- regex: "^RC4Drop$"
33+
- has:
34+
stopBy: neighbor
35+
kind: property_identifier
36+
any:
37+
- regex: "^encrypt$"
38+
- regex: "^decrypt$"
39+
rule:
40+
kind: call_expression
41+
any:
42+
- matches: MATCH_RC4_USAGE

‎rules/typescript/security/avoid-crypto-sha1-typescript.yml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
id: avoid-crypto-sha1-typescript
2+
severity: warning
3+
language: typescript
4+
message: >-
5+
Avoid SHA1 security protocol. Use of insecure encryption or hashing protocols
6+
expose your application to vulnerabilities. Use stronger hashing algorithms like SHA-256.
7+
note: >-
8+
[CWE-328] Use of Weak Hash.
9+
[REFERENCES]
10+
- https://cryptojs.gitbook.io/docs/#hmac
11+
ast-grep-essentials: true
12+
utils:
13+
MATCH_SHA1_USAGE:
14+
kind: call_expression
15+
all:
16+
- has:
17+
stopBy: neighbor
18+
kind: member_expression
19+
all:
20+
- has:
21+
stopBy: neighbor
22+
kind: identifier
23+
regex: "^CryptoJS$"
24+
- has:
25+
stopBy: neighbor
26+
kind: property_identifier
27+
regex: "^HmacSHA1$"
28+
- has:
29+
stopBy: neighbor
30+
kind: arguments
31+
rule:
32+
kind: call_expression
33+
any:
34+
- matches: MATCH_SHA1_USAGE

‎rules/typescript/security/avoid-des-typescript.yml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
id: avoid-des-typescript
2+
severity: warning
3+
language: typescript
4+
message: >-
5+
Do not use DES or TripleDES, this is a weak security protocol. Use stronger
6+
encryption algorithms like AES instead.
7+
note: >-
8+
[CWE-328] Use of Weak Hash.
9+
[REFERENCES]
10+
- https://cryptojs.gitbook.io/docs/#ciphers
11+
ast-grep-essentials: true
12+
utils:
13+
MATCH_DES_USAGE:
14+
kind: call_expression
15+
has:
16+
stopBy: neighbor
17+
kind: member_expression
18+
all:
19+
- has:
20+
stopBy: neighbor
21+
kind: member_expression
22+
all:
23+
- has:
24+
stopBy: neighbor
25+
kind: identifier
26+
regex: "^CryptoJS$"
27+
- has:
28+
stopBy: neighbor
29+
kind: property_identifier
30+
any:
31+
- regex: "^DES$"
32+
- regex: "^TripleDES$"
33+
- has:
34+
stopBy: neighbor
35+
kind: property_identifier
36+
any:
37+
- regex: "^encrypt$"
38+
- regex: "^decrypt$"
39+
rule:
40+
kind: call_expression
41+
any:
42+
- matches: MATCH_DES_USAGE

‎rules/typescript/security/chmod-permissions-typescript.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
id: chmod-permissions-typescript
2+
severity: warning
3+
language: typescript
4+
message: >-
5+
Do not give 777 permissions to a file. Always make sure you restrict the
6+
permissions of your application files. Applications should not allow write
7+
and execution for other users.
8+
note: >-
9+
[CWE-732] Incorrect Permission Assignment for Critical Resource.
10+
ast-grep-essentials: true
11+
utils:
12+
MATCH_CHMOD_777:
13+
kind: call_expression
14+
all:
15+
- has:
16+
stopBy: neighbor
17+
kind: member_expression
18+
has:
19+
stopBy: neighbor
20+
kind: property_identifier
21+
any:
22+
- regex: "^chmod$"
23+
- regex: "^chmodSync$"
24+
- has:
25+
stopBy: neighbor
26+
kind: arguments
27+
all:
28+
- has:
29+
stopBy: neighbor
30+
kind: number
31+
regex: "^0o777$"
32+
rule:
33+
kind: call_expression
34+
any:
35+
- matches: MATCH_CHMOD_777

‎rules/typescript/security/command-injection-typescript.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
id: command-injection-typescript
2+
severity: warning
3+
language: typescript
4+
message: >-
5+
Avoid command injection. When executing a command, never use unchecked variables.
6+
Make sure that each variable of the command has been checked.
7+
note: >-
8+
[CWE-78] OS Command Injection.
9+
ast-grep-essentials: true
10+
utils:
11+
MATCH_COMMAND_INJECTION:
12+
kind: call_expression
13+
all:
14+
- has:
15+
stopBy: neighbor
16+
kind: member_expression
17+
has:
18+
stopBy: neighbor
19+
kind: property_identifier
20+
regex: "^(exec|execSync|spawn|spawnSync)$"
21+
- has:
22+
stopBy: neighbor
23+
kind: arguments
24+
has:
25+
stopBy: neighbor
26+
any:
27+
- kind: template_string
28+
has:
29+
stopBy: neighbor
30+
kind: template_substitution
31+
- kind: binary_expression
32+
rule:
33+
kind: call_expression
34+
any:
35+
- matches: MATCH_COMMAND_INJECTION

‎rules/typescript/security/crypto-avoid-weak-hash-typescript.yml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
id: crypto-avoid-weak-hash-typescript
2+
severity: warning
3+
language: typescript
4+
message: >-
5+
Avoid weak hash algorithm from CryptoJS. Use of insecure hash functions like
6+
MD5 or SHA1 can expose your application to vulnerabilities. Use stronger hash
7+
algorithms like SHA-256 or SHA-512.
8+
note: >-
9+
[CWE-328] Use of Weak Hash.
10+
[REFERENCES]
11+
- https://cryptojs.gitbook.io/docs/#hashing
12+
ast-grep-essentials: true
13+
utils:
14+
MATCH_WEAK_HASH:
15+
kind: call_expression
16+
all:
17+
- has:
18+
stopBy: neighbor
19+
kind: member_expression
20+
all:
21+
- has:
22+
stopBy: neighbor
23+
kind: identifier
24+
regex: "^CryptoJS$"
25+
- has:
26+
stopBy: neighbor
27+
kind: property_identifier
28+
any:
29+
- regex: "^MD5$"
30+
- regex: "^SHA1$"
31+
- regex: "^HmacMD5$"
32+
- has:
33+
stopBy: neighbor
34+
kind: arguments
35+
rule:
36+
kind: call_expression
37+
any:
38+
- matches: MATCH_WEAK_HASH

‎rules/typescript/security/detect-buffer-noassert-typescript.yml

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
id: detect-buffer-noassert-typescript
2+
severity: error
3+
language: typescript
4+
message: >-
5+
Avoid calls to 'buffer' with 'noAssert' flag set. If you skip the `offset`
6+
validation it can go beyond the end of the `Buffer`.
7+
note: >-
8+
[CWE-119] Buffer Errors.
9+
ast-grep-essentials: true
10+
utils:
11+
MATCH_BUFFER_NOASSERT_READ:
12+
kind: call_expression
13+
all:
14+
- has:
15+
stopBy: neighbor
16+
kind: member_expression
17+
has:
18+
stopBy: neighbor
19+
kind: property_identifier
20+
regex: "^(readUInt8|readUInt16LE|readUInt16BE|readUInt32LE|readUInt32BE|readInt8|readInt16LE|readInt16BE|readInt32LE|readInt32BE|readFloatLE|readFloatBE|readDoubleLE|readDoubleBE)$"
21+
- has:
22+
stopBy: neighbor
23+
kind: arguments
24+
all:
25+
- has:
26+
nthChild:
27+
position: 1
28+
ofRule:
29+
not:
30+
kind: comment
31+
- has:
32+
nthChild:
33+
position: 2
34+
ofRule:
35+
not:
36+
kind: comment
37+
- not:
38+
has:
39+
nthChild:
40+
position: 3
41+
ofRule:
42+
not:
43+
kind: comment
44+
- has:
45+
stopBy: neighbor
46+
regex: ^true$
47+
MATCH_BUFFER_NOASSERT_WRITE:
48+
kind: call_expression
49+
all:
50+
- has:
51+
stopBy: neighbor
52+
kind: member_expression
53+
has:
54+
stopBy: neighbor
55+
kind: property_identifier
56+
regex: "^(writeUInt8|writeUInt16LE|writeUInt16BE|writeUInt32LE|writeUInt32BE|writeInt8|writeInt16LE|writeInt16BE|writeInt32LE|writeInt32BE|writeFloatLE|writeFloatBE|writeDoubleLE|writeDoubleBE)$"
57+
- has:
58+
stopBy: neighbor
59+
kind: arguments
60+
all:
61+
- has:
62+
nthChild:
63+
position: 1
64+
ofRule:
65+
not:
66+
kind: comment
67+
- has:
68+
nthChild:
69+
position: 2
70+
ofRule:
71+
not:
72+
kind: comment
73+
- has:
74+
nthChild:
75+
position: 3
76+
ofRule:
77+
not:
78+
kind: comment
79+
- not:
80+
has:
81+
nthChild:
82+
position: 4
83+
ofRule:
84+
not:
85+
kind: comment
86+
- has:
87+
stopBy: neighbor
88+
regex: ^true$
89+
rule:
90+
kind: call_expression
91+
any:
92+
- matches: MATCH_BUFFER_NOASSERT_READ
93+
- matches: MATCH_BUFFER_NOASSERT_WRITE

0 commit comments

Comments
 (0)