# 接口安全排查规则
# 来源: 接口越权排查列表.xlsx

rules:
  # === 认证与鉴权 ===

  - id: sec-api-must-have-auth
    type: regex-check
    blocking: false
    severity: warning
    scope: full-only
    source: "接口越权排查指导#认证"
    message: "所有接口应具备接入认证机制，人机接口会话应有超时机制 (需人工确认)"
    pattern: "(?!)"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
    excludes: []

  - id: sec-api-must-have-authorization
    type: regex-check
    blocking: false
    severity: warning
    scope: full-only
    source: "接口越权排查指导#鉴权"
    message: "所有接口应具备鉴权处理，鉴权逻辑需正确覆盖全接口 (需人工确认)"
    pattern: "(?!)"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
    excludes: []

  # === 参数校验 ===

  - id: sec-api-param-validation
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "接口越权排查指导#参数校验"
    message: "所有外部输入参数应进行严格校验，建议采用白名单方式"
    pattern: "(?:query|params|body)\\s*(?::|=>|=)\\s*(?!.*(?:validate|sanitize|check))"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
    excludes:
      - "**/*.test.*"
      - "**/*.d.ts"

  - id: sec-api-param-count-match
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "接口越权排查指导#参数校验"
    message: "后台参数校验时应与数据库参数个数一致"
    pattern: "(?:insert|update|query)\\s*\\(.*(?=,(?:\\s*(?!['\"`])))"
    match_mode: present
    includes:
      - "**/*.ts"
      - "**/*.js"
      - "**/*.py"
    excludes:
      - "**/*.test.*"

  # === 审计日志 ===

  - id: sec-api-audit-log
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "接口越权排查指导#审计日志"
    message: "非查询类接口应记录审计日志，敏感操作也应记录"
    pattern: "(?:POST|PUT|DELETE|PATCH)\\s+.*(?!.*auditLog|audit\\.log|logger\\.audit)"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
    excludes:
      - "**/*.test.*"
      - "**/*.d.ts"

  # === 命令注入防护 ===

  - id: sec-api-no-command-injection
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "接口越权排查指导#命令注入"
    message: "禁止使用外部输入参数拼接执行系统命令"
    pattern: "(?:exec|spawn|shellExec|system)\\s*\\(\\s*['\"].*\\+.*['\"]"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
      - "**/*.py"
    excludes:
      - "**/*.test.*"

  # === XXE注入防护 ===

  - id: sec-api-no-xxe-injection
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "接口越权排查指导#xxe注入"
    message: "禁止使用外部输入拼接XML结构，应禁用实体功能"
    pattern: "(?:xmlParse|parseXML|DOMParser)\\s*\\(.*\\+.*"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
    excludes:
      - "**/*.test.*"

  # === SQL注入防护 ===

  - id: sec-api-no-sql-injection
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "接口越权排查指导#sql注入"
    message: "数据库操作应使用参数预编译方式，防止SQL注入"
    pattern: "(?:query|execute)\\s*\\(\\s*['\"].*\\+.*['\"]"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
      - "**/*.py"
    excludes:
      - "**/*.test.*"

  # === CSRF防护 ===

  - id: sec-api-csrf-protection
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "接口越权排查指导#csrf攻击"
    message: "外部非查询类接口应校验CSRF token"
    pattern: "(?:csrf|XSRF).*(?:token|header)"
    match_mode: present
    includes:
      - "**/*.ts"
      - "**/*.js"
    excludes:
      - "**/*.test.*"
      - "**/*.d.ts"

  # === 日志注入防护 ===

  - id: sec-api-no-log-injection
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "接口越权排查指导#日志注入"
    message: "日志中记录外部输入参数时应对回车换行进行转义"
    pattern: "console\\.(?:log|debug|info|warn|error)\\s*\\(.*(?<!escape|sanitize).*\\)"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
    excludes:
      - "**/*.test.*"
      - "**/*.d.ts"

  # === XSS防护 ===

  - id: sec-api-xss-encoding
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "接口越权排查指导#XSS编码"
    message: "Web页面接口返回数据应进行HTML编码"
    pattern: "(?:htmlEncode|escapeHtml|sanitizeHtml)"
    match_mode: present
    includes:
      - "**/*.ts"
      - "**/*.js"
    excludes:
      - "**/*.test.*"
      - "**/*.d.ts"

  # === 敏感信息保护 ===

  - id: sec-api-no-sensitive-in-url
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "接口越权排查指导#敏感信息"
    message: "敏感数据不应在URL参数中传输"
    pattern: "(?:password|secret|token|creditCard|ssn)\\s*[:=]\\s*['\"].*['\"]"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
      - "**/*.yaml"
      - "**/*.yml"
    excludes:
      - "**/*.test.*"

  - id: sec-api-sensitive-encryption
    type: regex-check
    blocking: false
    severity: warning
    scope: full-only
    source: "接口越权排查指导#敏感信息"
    message: "敏感数据应进行加密存储和传输 (需人工确认)"
    pattern: "(?!)"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
    excludes: []

  # === 文件上传下载 ===

  - id: sec-api-file-upload-validation
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "接口越权排查指导#上传下载"
    message: "文件上传接口应严格校验文件名、路径、类型和大小"
    pattern: "(?:upload|fileUpload|multipart)\\s*(?!.*(?:validate|checkFileType|checkSize))"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
    excludes:
      - "**/*.test.*"

  - id: sec-api-zip-validation
    type: regex-check
    blocking: false
    severity: warning
    scope: incremental
    source: "接口越权排查指导#上传下载"
    message: "ZIP文件上传应校验压缩包内的文件内容"
    pattern: "(?:unzip|extract|decompress)\\s*(?!.*(?:validate|sanitize))"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
    excludes:
      - "**/*.test.*"

  # === 未公开接口 ===

  - id: sec-api-no-unused-endpoints
    type: regex-check
    blocking: false
    severity: warning
    scope: full-only
    source: "接口越权排查指导#未公开接口"
    message: "确认所有接口都是业务需要的，无用接口应删除或提供文档 (需人工确认)"
    pattern: "(?!)"
    match_mode: absent
    includes:
      - "**/*.ts"
      - "**/*.js"
    excludes: []

  # === 接口文档 ===

  - id: sec-api-documented
    type: section-check
    blocking: false
    severity: warning
    scope: full-only
    source: "接口越权排查指导"
    message: "所有API接口应有完整的文档说明"
    file: "{architecture}"
    pattern: "##.*(?:API|接口|Interface)"
    match_mode: present
    includes:
      - "docs/architecture.md"
    excludes: []