/** * @fileoverview Vulnerability Detection Module - Constants * @module rules/vulnerabilities/constants * * Thresholds, limits, and configuration constants for vulnerability detection. */ /** * Score thresholds for severity classification */ export declare const SCORE_THRESHOLDS: { readonly CRITICAL: 90; readonly HIGH: 70; readonly MEDIUM: 50; readonly LOW: 30; readonly INFO: 0; }; /** * Risk level descriptions */ export declare const RISK_LEVELS: { readonly CRITICAL: "critical"; readonly HIGH: "high"; readonly MEDIUM: "medium"; readonly LOW: "low"; readonly MINIMAL: "minimal"; }; /** * Confidence thresholds */ export declare const CONFIDENCE_THRESHOLDS: { readonly CONFIRMED: 0.95; readonly HIGH: 0.8; readonly MEDIUM: 0.6; readonly LOW: 0.4; readonly TENTATIVE: 0.2; }; /** * Engine limits for performance and safety */ export declare const LIMITS: { /** Maximum regex execution time in ms */ readonly REGEX_TIMEOUT: 100; /** Maximum rule execution time in ms */ readonly RULE_TIMEOUT: 5000; /** Maximum file size to analyze in bytes */ readonly MAX_FILE_SIZE: number; /** Maximum AST nodes to analyze */ readonly MAX_AST_NODES: 100000; /** Maximum matches per pattern */ readonly MAX_MATCHES_PER_PATTERN: 100; /** Maximum findings per file */ readonly MAX_FINDINGS_PER_FILE: 500; /** Maximum taint flow depth */ readonly MAX_TAINT_DEPTH: 50; /** Maximum line length to analyze */ readonly MAX_LINE_LENGTH: 10000; }; /** * Default weights for vulnerability scoring */ export declare const DEFAULT_SCORING_WEIGHTS: { readonly taintFlow: 0.3; readonly patternCount: 0.15; readonly exploitability: 0.2; readonly impact: 0.2; readonly context: 0.15; }; /** * Common taint sources for JavaScript/TypeScript */ export declare const JS_TAINT_SOURCES: { readonly 'req.body': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'req.query': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'req.params': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'req.headers': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'req.cookies': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly location: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'document.URL': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'document.referrer': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'document.cookie': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly FormData: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly URLSearchParams: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly innerHTML: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly innerText: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly textContent: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly value: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'process.env': { readonly pattern: RegExp; readonly category: "environment"; }; }; /** * Common taint sources for Python */ export declare const PYTHON_TAINT_SOURCES: { readonly 'request.args': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'request.form': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'request.data': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'request.headers': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'request.cookies': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly GET: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly POST: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly input: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly raw_input: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'sys.argv': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly open: { readonly pattern: RegExp; readonly category: "file"; }; readonly read: { readonly pattern: RegExp; readonly category: "file"; }; readonly 'os.environ': { readonly pattern: RegExp; readonly category: "environment"; }; readonly 'os.getenv': { readonly pattern: RegExp; readonly category: "environment"; }; }; /** * Common taint sources for PHP */ export declare const PHP_TAINT_SOURCES: { readonly $_GET: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly $_POST: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly $_REQUEST: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly $_COOKIE: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly $_FILES: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly $_SERVER: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly $_ENV: { readonly pattern: RegExp; readonly category: "environment"; }; readonly file_get_contents: { readonly pattern: RegExp; readonly category: "file"; }; readonly fread: { readonly pattern: RegExp; readonly category: "file"; }; }; /** * Common taint sources for Java */ export declare const JAVA_TAINT_SOURCES: { readonly getParameter: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly getParameterValues: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly getHeader: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly getCookies: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly getInputStream: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly getReader: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly getPathVariable: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly getRequestBody: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'System.getenv': { readonly pattern: RegExp; readonly category: "environment"; }; readonly 'System.getProperty': { readonly pattern: RegExp; readonly category: "environment"; }; }; /** * Common taint sources for C# */ export declare const CSHARP_TAINT_SOURCES: { readonly 'Request.Form': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'Request.QueryString': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'Request.Headers': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'Request.Cookies': { readonly pattern: RegExp; readonly category: "user_input"; }; readonly FromBody: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly FromQuery: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly FromRoute: { readonly pattern: RegExp; readonly category: "user_input"; }; readonly 'Environment.GetEnvironmentVariable': { readonly pattern: RegExp; readonly category: "environment"; }; readonly 'Console.ReadLine': { readonly pattern: RegExp; readonly category: "user_input"; }; }; /** * SQL Injection sinks */ export declare const SQL_INJECTION_SINKS: { readonly query: RegExp; readonly execute: RegExp; readonly exec: RegExp; readonly raw: RegExp; readonly rawQuery: RegExp; readonly 'mysql.query': RegExp; readonly 'pg.query': RegExp; readonly 'sequelize.query': RegExp; readonly 'cursor.execute': RegExp; readonly 'cursor.executemany': RegExp; readonly mysql_query: RegExp; readonly mysqli_query: RegExp; readonly pg_query: RegExp; readonly 'PDO::query': RegExp; readonly 'Statement.execute': RegExp; readonly createQuery: RegExp; readonly createNativeQuery: RegExp; readonly SqlCommand: RegExp; readonly ExecuteReader: RegExp; readonly ExecuteNonQuery: RegExp; readonly ExecuteScalar: RegExp; }; /** * Command Injection sinks */ export declare const COMMAND_INJECTION_SINKS: { readonly exec: RegExp; readonly execSync: RegExp; readonly spawn: RegExp; readonly spawnSync: RegExp; readonly execFile: RegExp; readonly 'os.system': RegExp; readonly 'os.popen': RegExp; readonly subprocess: RegExp; readonly commands: RegExp; readonly php_system: RegExp; readonly php_exec: RegExp; readonly shell_exec: RegExp; readonly passthru: RegExp; readonly popen: RegExp; readonly proc_open: RegExp; readonly backtick: RegExp; readonly 'Runtime.exec': RegExp; readonly ProcessBuilder: RegExp; readonly 'Process.Start': RegExp; }; /** * XSS sinks */ export declare const XSS_SINKS: { readonly innerHTML: RegExp; readonly outerHTML: RegExp; readonly 'document.write': RegExp; readonly insertAdjacentHTML: RegExp; readonly html: RegExp; readonly append: RegExp; readonly dangerouslySetInnerHTML: RegExp; readonly bypassSecurityTrustHtml: RegExp; readonly 'v-html': RegExp; readonly render_template_string: RegExp; readonly Jinja2: RegExp; readonly echo: RegExp; readonly print: RegExp; }; /** * Path Traversal sinks */ export declare const PATH_TRAVERSAL_SINKS: { readonly readFile: RegExp; readonly writeFile: RegExp; readonly createReadStream: RegExp; readonly createWriteStream: RegExp; readonly unlink: RegExp; readonly readdir: RegExp; readonly stat: RegExp; readonly access: RegExp; readonly sendFile: RegExp; readonly download: RegExp; readonly 'res.render': RegExp; readonly open: RegExp; readonly 'os.path.join': RegExp; readonly shutil: RegExp; readonly send_file: RegExp; readonly include: RegExp; readonly file_get_contents: RegExp; readonly file_put_contents: RegExp; readonly fopen: RegExp; readonly readfile: RegExp; readonly file: RegExp; readonly FileInputStream: RegExp; readonly FileOutputStream: RegExp; readonly FileReader: RegExp; readonly 'Files.read': RegExp; readonly 'File.Read': RegExp; readonly 'File.Write': RegExp; readonly StreamReader: RegExp; }; /** * SSRF sinks */ export declare const SSRF_SINKS: { readonly fetch: RegExp; readonly axios: RegExp; readonly request: RegExp; readonly 'http.request': RegExp; readonly got: RegExp; readonly 'node-fetch': RegExp; readonly requests: RegExp; readonly urllib: RegExp; readonly httplib: RegExp; readonly aiohttp: RegExp; readonly curl: RegExp; readonly file_get_contents: RegExp; readonly fopen_url: RegExp; readonly 'URL.openConnection': RegExp; readonly HttpClient_java: RegExp; readonly RestTemplate: RegExp; readonly HttpClient_csharp: RegExp; readonly WebRequest: RegExp; readonly WebClient: RegExp; }; /** * Deserialization sinks */ export declare const DESERIALIZATION_SINKS: { readonly 'JSON.parse': RegExp; readonly eval: RegExp; readonly Function: RegExp; readonly deserialize: RegExp; readonly js_unserialize: RegExp; readonly pickle: RegExp; readonly 'yaml.load': RegExp; readonly marshal: RegExp; readonly shelve: RegExp; readonly php_unserialize: RegExp; readonly ObjectInputStream: RegExp; readonly XMLDecoder: RegExp; readonly XStream: RegExp; readonly BinaryFormatter: RegExp; readonly XmlSerializer: RegExp; readonly JsonConvert: RegExp; readonly DataContractSerializer: RegExp; }; /** * Common sanitizers for SQL Injection */ export declare const SQL_SANITIZERS: { readonly parameterized: RegExp; readonly preparedStatement: RegExp; readonly escape: RegExp; readonly quote: RegExp; readonly sanitize: RegExp; readonly bindParam: RegExp; readonly placeholders: RegExp; }; /** * Common sanitizers for XSS */ export declare const XSS_SANITIZERS: { readonly htmlEncode: RegExp; readonly sanitizeHtml: RegExp; readonly DOMPurify: RegExp; readonly escapeHtml: RegExp; readonly textContent: RegExp; readonly createTextNode: RegExp; readonly encodeURIComponent: RegExp; readonly htmlspecialchars: RegExp; readonly strip_tags: RegExp; readonly bleach: RegExp; }; /** * Common sanitizers for Command Injection */ export declare const COMMAND_SANITIZERS: { readonly escapeshellarg: RegExp; readonly escapeshellcmd: RegExp; readonly 'shlex.quote': RegExp; readonly shellescape: RegExp; readonly ProcessBuilder: RegExp; }; /** * Common sanitizers for Path Traversal */ export declare const PATH_SANITIZERS: { readonly basename: RegExp; readonly normalize: RegExp; readonly realpath: RegExp; readonly resolve: RegExp; readonly isAbsolute: RegExp; readonly startsWith: RegExp; readonly includes: RegExp; }; /** * OWASP Top 10 2021 mapping */ export declare const OWASP_TOP_10_2021: { readonly A01: { readonly id: "A01:2021"; readonly name: "Broken Access Control"; readonly url: "https://owasp.org/Top10/A01_2021-Broken_Access_Control/"; }; readonly A02: { readonly id: "A02:2021"; readonly name: "Cryptographic Failures"; readonly url: "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"; }; readonly A03: { readonly id: "A03:2021"; readonly name: "Injection"; readonly url: "https://owasp.org/Top10/A03_2021-Injection/"; }; readonly A04: { readonly id: "A04:2021"; readonly name: "Insecure Design"; readonly url: "https://owasp.org/Top10/A04_2021-Insecure_Design/"; }; readonly A05: { readonly id: "A05:2021"; readonly name: "Security Misconfiguration"; readonly url: "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/"; }; readonly A06: { readonly id: "A06:2021"; readonly name: "Vulnerable and Outdated Components"; readonly url: "https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/"; }; readonly A07: { readonly id: "A07:2021"; readonly name: "Identification and Authentication Failures"; readonly url: "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"; }; readonly A08: { readonly id: "A08:2021"; readonly name: "Software and Data Integrity Failures"; readonly url: "https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/"; }; readonly A09: { readonly id: "A09:2021"; readonly name: "Security Logging and Monitoring Failures"; readonly url: "https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/"; }; readonly A10: { readonly id: "A10:2021"; readonly name: "Server-Side Request Forgery (SSRF)"; readonly url: "https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/"; }; }; /** * Common CWE references */ export declare const CWE_REFERENCES: { readonly CWE_89: { readonly id: "CWE-89"; readonly title: "SQL Injection"; readonly url: "https://cwe.mitre.org/data/definitions/89.html"; }; readonly CWE_78: { readonly id: "CWE-78"; readonly title: "OS Command Injection"; readonly url: "https://cwe.mitre.org/data/definitions/78.html"; }; readonly CWE_79: { readonly id: "CWE-79"; readonly title: "Cross-site Scripting (XSS)"; readonly url: "https://cwe.mitre.org/data/definitions/79.html"; }; readonly CWE_94: { readonly id: "CWE-94"; readonly title: "Code Injection"; readonly url: "https://cwe.mitre.org/data/definitions/94.html"; }; readonly CWE_90: { readonly id: "CWE-90"; readonly title: "LDAP Injection"; readonly url: "https://cwe.mitre.org/data/definitions/90.html"; }; readonly CWE_91: { readonly id: "CWE-91"; readonly title: "XML Injection"; readonly url: "https://cwe.mitre.org/data/definitions/91.html"; }; readonly CWE_80: { readonly id: "CWE-80"; readonly title: "Improper Neutralization of Script-Related HTML Tags"; readonly url: "https://cwe.mitre.org/data/definitions/80.html"; }; readonly CWE_352: { readonly id: "CWE-352"; readonly title: "Cross-Site Request Forgery (CSRF)"; readonly url: "https://cwe.mitre.org/data/definitions/352.html"; }; readonly CWE_918: { readonly id: "CWE-918"; readonly title: "Server-Side Request Forgery (SSRF)"; readonly url: "https://cwe.mitre.org/data/definitions/918.html"; }; readonly CWE_502: { readonly id: "CWE-502"; readonly title: "Deserialization of Untrusted Data"; readonly url: "https://cwe.mitre.org/data/definitions/502.html"; }; readonly CWE_1321: { readonly id: "CWE-1321"; readonly title: "Prototype Pollution"; readonly url: "https://cwe.mitre.org/data/definitions/1321.html"; }; readonly CWE_22: { readonly id: "CWE-22"; readonly title: "Path Traversal"; readonly url: "https://cwe.mitre.org/data/definitions/22.html"; }; readonly CWE_434: { readonly id: "CWE-434"; readonly title: "Unrestricted Upload of File with Dangerous Type"; readonly url: "https://cwe.mitre.org/data/definitions/434.html"; }; readonly CWE_73: { readonly id: "CWE-73"; readonly title: "External Control of File Name or Path"; readonly url: "https://cwe.mitre.org/data/definitions/73.html"; }; readonly CWE_98: { readonly id: "CWE-98"; readonly title: "Improper Control of Filename for Include/Require Statement"; readonly url: "https://cwe.mitre.org/data/definitions/98.html"; }; readonly CWE_798: { readonly id: "CWE-798"; readonly title: "Use of Hard-coded Credentials"; readonly url: "https://cwe.mitre.org/data/definitions/798.html"; }; readonly CWE_287: { readonly id: "CWE-287"; readonly title: "Improper Authentication"; readonly url: "https://cwe.mitre.org/data/definitions/287.html"; }; readonly CWE_384: { readonly id: "CWE-384"; readonly title: "Session Fixation"; readonly url: "https://cwe.mitre.org/data/definitions/384.html"; }; readonly CWE_613: { readonly id: "CWE-613"; readonly title: "Insufficient Session Expiration"; readonly url: "https://cwe.mitre.org/data/definitions/613.html"; }; readonly CWE_259: { readonly id: "CWE-259"; readonly title: "Use of Hard-coded Password"; readonly url: "https://cwe.mitre.org/data/definitions/259.html"; }; readonly CWE_306: { readonly id: "CWE-306"; readonly title: "Missing Authentication for Critical Function"; readonly url: "https://cwe.mitre.org/data/definitions/306.html"; }; readonly CWE_862: { readonly id: "CWE-862"; readonly title: "Missing Authorization"; readonly url: "https://cwe.mitre.org/data/definitions/862.html"; }; readonly CWE_614: { readonly id: "CWE-614"; readonly title: "Sensitive Cookie in HTTPS Session Without Secure Attribute"; readonly url: "https://cwe.mitre.org/data/definitions/614.html"; }; readonly CWE_1004: { readonly id: "CWE-1004"; readonly title: "Sensitive Cookie Without HttpOnly Flag"; readonly url: "https://cwe.mitre.org/data/definitions/1004.html"; }; readonly CWE_347: { readonly id: "CWE-347"; readonly title: "Improper Verification of Cryptographic Signature"; readonly url: "https://cwe.mitre.org/data/definitions/347.html"; }; readonly CWE_916: { readonly id: "CWE-916"; readonly title: "Use of Password Hash With Insufficient Computational Effort"; readonly url: "https://cwe.mitre.org/data/definitions/916.html"; }; readonly CWE_208: { readonly id: "CWE-208"; readonly title: "Observable Timing Discrepancy"; readonly url: "https://cwe.mitre.org/data/definitions/208.html"; }; readonly CWE_327: { readonly id: "CWE-327"; readonly title: "Use of a Broken or Risky Cryptographic Algorithm"; readonly url: "https://cwe.mitre.org/data/definitions/327.html"; }; readonly CWE_328: { readonly id: "CWE-328"; readonly title: "Reversible One-Way Hash"; readonly url: "https://cwe.mitre.org/data/definitions/328.html"; }; readonly CWE_330: { readonly id: "CWE-330"; readonly title: "Use of Insufficiently Random Values"; readonly url: "https://cwe.mitre.org/data/definitions/330.html"; }; readonly CWE_326: { readonly id: "CWE-326"; readonly title: "Inadequate Encryption Strength"; readonly url: "https://cwe.mitre.org/data/definitions/326.html"; }; readonly CWE_321: { readonly id: "CWE-321"; readonly title: "Use of Hard-coded Cryptographic Key"; readonly url: "https://cwe.mitre.org/data/definitions/321.html"; }; readonly CWE_295: { readonly id: "CWE-295"; readonly title: "Improper Certificate Validation"; readonly url: "https://cwe.mitre.org/data/definitions/295.html"; }; readonly CWE_284: { readonly id: "CWE-284"; readonly title: "Improper Access Control"; readonly url: "https://cwe.mitre.org/data/definitions/284.html"; }; readonly CWE_639: { readonly id: "CWE-639"; readonly title: "Authorization Bypass Through User-Controlled Key"; readonly url: "https://cwe.mitre.org/data/definitions/639.html"; }; readonly CWE_200: { readonly id: "CWE-200"; readonly title: "Exposure of Sensitive Information"; readonly url: "https://cwe.mitre.org/data/definitions/200.html"; }; readonly CWE_209: { readonly id: "CWE-209"; readonly title: "Generation of Error Message Containing Sensitive Information"; readonly url: "https://cwe.mitre.org/data/definitions/209.html"; }; readonly CWE_532: { readonly id: "CWE-532"; readonly title: "Insertion of Sensitive Information into Log File"; readonly url: "https://cwe.mitre.org/data/definitions/532.html"; }; readonly CWE_16: { readonly id: "CWE-16"; readonly title: "Configuration"; readonly url: "https://cwe.mitre.org/data/definitions/16.html"; }; readonly CWE_942: { readonly id: "CWE-942"; readonly title: "Permissive Cross-domain Policy with Untrusted Domains"; readonly url: "https://cwe.mitre.org/data/definitions/942.html"; }; readonly CWE_489: { readonly id: "CWE-489"; readonly title: "Active Debug Code"; readonly url: "https://cwe.mitre.org/data/definitions/489.html"; }; readonly CWE_693: { readonly id: "CWE-693"; readonly title: "Protection Mechanism Failure"; readonly url: "https://cwe.mitre.org/data/definitions/693.html"; }; }; /** * Hardcoded secrets patterns */ export declare const HARDCODED_SECRETS_PATTERNS: { readonly aws_access_key: RegExp; readonly aws_secret_key: RegExp; readonly generic_api_key: RegExp; readonly github_token: RegExp; readonly slack_token: RegExp; readonly stripe_key: RegExp; readonly password_assignment: RegExp; readonly private_key: RegExp; readonly connection_string: RegExp; readonly jwt_secret: RegExp; }; /** * Dangerous function patterns */ export declare const DANGEROUS_FUNCTIONS: { readonly eval: RegExp; readonly function_constructor: RegExp; readonly settimeout_string: RegExp; readonly setinterval_string: RegExp; readonly php_eval: RegExp; readonly php_create_function: RegExp; readonly php_assert: RegExp; readonly php_preg_replace_e: RegExp; readonly python_eval: RegExp; readonly python_exec: RegExp; readonly python_compile: RegExp; }; /** * Weak cryptography patterns */ export declare const WEAK_CRYPTO_PATTERNS: { readonly md5: RegExp; readonly sha1: RegExp; readonly des: RegExp; readonly rc4: RegExp; readonly ecb_mode: RegExp; readonly math_random: RegExp; readonly random_random: RegExp; readonly rand_function: RegExp; }; //# sourceMappingURL=index.d.ts.map