nyx-scanner 0.1.1

A CLI security scanner for automating vulnerability checks
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

use crate::patterns::{Pattern, Severity};

pub const PATTERNS: &[Pattern] = &[
    Pattern {
        id: "eval_call",
        description: "Use of eval()",
        query: "(call_expression function: (identifier) @id (#eq? @id \"eval\")) @vuln",
        severity: Severity::High,
    },
    Pattern {
        id: "new_function",
        description: "new Function() constructor",
        query: "(new_expression constructor: (identifier) @id (#eq? @id \"Function\")) @vuln",
        severity: Severity::High,
    },
    Pattern {
        id: "document_write",
        description: "document.write() call",
        query: "(call_expression function: (member_expression object: (identifier) @obj (#eq? @obj \"document\") property: (property_identifier) @prop (#eq? @prop \"write\"))) @vuln",
        severity: Severity::Medium,
    },
    Pattern {
        id: "inner_html_assignment",
        description: "Assignment to element.innerHTML",
        query: "(assignment_expression left: (member_expression property: (property_identifier) @prop (#eq? @prop \"innerHTML\"))) @vuln",
        severity: Severity::Medium,
    },
    Pattern {
        id: "settimeout_string",
        description: "setTimeout / setInterval with a string argument",
        query: "(call_expression function: (identifier) @id (#match? @id \"setTimeout|setInterval\") arguments: (arguments (string) @code . _)) @vuln",
        severity: Severity::Medium,
    },
    Pattern {
        id: "json_parse",
        description: "JSON.parse on dynamic string",
        query: "(call_expression function: (member_expression object: (identifier) @obj (#eq? @obj \"JSON\") property: (property_identifier) @prop (#eq? @prop \"parse\"))) @vuln",
        severity: Severity::Low,
    },
    Pattern {
        id: "outer_html_assignment",
        description: "Assignment to element.outerHTML",
        query: "(assignment_expression
               left: (member_expression
                        property: (property_identifier) @prop
                        (#eq? @prop \"outerHTML\"))) @vuln",
        severity: Severity::Medium,
    },
    Pattern {
        id: "insert_adjacent_html",
        description: "insertAdjacentHTML() call",
        query: "(call_expression
               function: (member_expression
                           property: (property_identifier) @prop
                           (#eq? @prop \"insertAdjacentHTML\"))) @vuln",
        severity: Severity::Medium,
    },
    Pattern {
        id: "location_href_assignment",
        description: "Assignment to window.location / location.href",
        query: "(assignment_expression
               left: (member_expression
                        object: (identifier)? @obj
                        property: (property_identifier) @prop
                        (#match? @prop \"location|href\"))) @vuln",
        severity: Severity::High,
    },
    Pattern {
        id: "cookie_assignment",
        description: "Write to document.cookie",
        query: "(assignment_expression
               left: (member_expression
                        object: (identifier) @obj
                        (#eq? @obj \"document\")
                        property: (property_identifier) @prop
                        (#eq? @prop \"cookie\"))) @vuln",
        severity: Severity::Medium,
    },
    Pattern {
        id: "proto_pollution",
        description: "Assignment to __proto__ (prototype pollution)",
        query: "(assignment_expression
               left: (member_expression
                        property: (property_identifier) @prop
                        (#eq? @prop \"__proto__\"))) @vuln",
        severity: Severity::High,
    },
    Pattern {
        id: "weak_hash_md5",
        description: "crypto.createHash(\"md5\")",
        query: "(call_expression
               function: (member_expression
                           object: (identifier) @obj
                           (#eq? @obj \"crypto\")
                           property: (property_identifier) @prop
                           (#eq? @prop \"createHash\"))
               arguments: (arguments
                            (string) @alg
                            (#eq? @alg \"md5\"))) @vuln",
        severity: Severity::Low,
    },
    Pattern {
        id: "regexp_constructor_string",
        description: "new RegExp() with a dynamic string",
        query: "(new_expression
               constructor: (identifier) @id
               (#eq? @id \"RegExp\")
               arguments: (arguments (string) @pattern)) @vuln",
        severity: Severity::Low,
    },
    Pattern {
        id: "dangerous_extend_builtin",
        description: "Extending Object.prototype (may lead to collisions/pollution)",
        query: "(assignment_expression
               left: (member_expression
                        object: (identifier) @obj
                        (#eq? @obj \"Object\")
                        property: (property_identifier) @prop
                        (#eq? @prop \"prototype\"))) @vuln",
        severity: Severity::Medium,
    },
];