vibe-guard/dist/rules/hardcoded-sensitive-data.js

🛡️ Vibe-Guard Security Scanner - 25 essential security rules to catch vulnerabilities before they catch you! Zero dependencies, instant setup, works everywhere, optimized performance. Detects SQL injection, XSS, exposed secrets, CSRF, CORS issues, and mo

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.HardcodedSensitiveDataRule = void 0;
const types_1 = require("../types");
class HardcodedSensitiveDataRule extends types_1.BaseRule {
    constructor() {
        super(...arguments);
        this.name = 'hardcoded-sensitive-data';
        this.description = 'Detects hardcoded sensitive information in configuration files';
        this.severity = 'critical';
        this.sensitivePatterns = [
            // Database connections
            { pattern: /(?:database_url|db_url|connection_string)\s*[:=]\s*['"`]([^'"`\s]+)['"`]/gi, type: 'Database Connection' },
            { pattern: /(?:mongodb|mysql|postgres|redis):\/\/[^'"`\s]+/gi, type: 'Database URL' },
            // Encryption keys
            { pattern: /(?:encryption_key|secret_key|private_key)\s*[:=]\s*['"`]([a-zA-Z0-9+/=]{20,})['"`]/gi, type: 'Encryption Key' },
            { pattern: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/gi, type: 'Private Key' },
            // Configuration secrets
            { pattern: /(?:app_secret|session_secret|jwt_secret)\s*[:=]\s*['"`]([^'"`\s]{16,})['"`]/gi, type: 'Application Secret' },
            { pattern: /(?:salt|hash_salt)\s*[:=]\s*['"`]([^'"`\s]{8,})['"`]/gi, type: 'Cryptographic Salt' },
            // Third-party service keys
            { pattern: /(?:stripe_secret|stripe_key)\s*[:=]\s*['"`](sk_[a-zA-Z0-9_]+)['"`]/gi, type: 'Stripe Secret Key' },
            { pattern: /(?:sendgrid_api_key)\s*[:=]\s*['"`](SG\.[a-zA-Z0-9_\-\.]+)['"`]/gi, type: 'SendGrid API Key' },
            { pattern: /(?:twilio_auth_token)\s*[:=]\s*['"`]([a-zA-Z0-9]{32})['"`]/gi, type: 'Twilio Auth Token' },
            // Generic API keys
            { pattern: /(?:api_key|apikey)\s*[:=]\s*['"`](sk_[a-zA-Z0-9_]+)['"`]/gi, type: 'API Key' },
            // Generic sensitive patterns
            { pattern: /(?:admin_password|root_password|db_password)\s*[:=]\s*['"`]([^'"`\s]{6,})['"`]/gi, type: 'Admin Password' },
            { pattern: /(?:webhook_secret|signing_secret)\s*[:=]\s*['"`]([^'"`\s]{16,})['"`]/gi, type: 'Webhook Secret' },
            // Configuration file patterns
            { pattern: /password\s*[:=]\s*['"`](?!.*(?:password|secret|key|token))[^'"`\s]{8,}['"`]/gi, type: 'Configuration Password' }
        ];
        this.falsePositivePatterns = [
            // Common false positive patterns
            /example/i,
            /sample/i,
            /demo/i,
            /placeholder/i,
            /your[_-]?(?:key|secret|password)/i,
            /\$\{.*\}/, // Environment variables
            /%.*%/, // Windows environment variables
            /\{\{.*\}\}/, // Template variables
            /^[x]+$/i, // Only x's
            /^[*]+$/, // Only asterisks
            /^[0]+$/, // Only zeros
            /^[1]+$/, // Only ones
            /test/i,
            /mock/i,
            /fake/i,
            /dummy/i,
            /development/i,
            /dev/i,
            /staging/i,
            /localhost/i,
            /127\.0\.0\.1/i,
            /console\.log/i,
            /console\.warn/i,
            /console\.error/i,
            /logger\.(?:log|warn|error|info)/i,
            /print/i,
            /echo/i,
            /printf/i,
            /System\.out\.println/i,
            /puts/i,
            /Console\.WriteLine/i,
            /comment/i,
            /note/i,
            /todo/i,
            /fixme/i,
            /\/\/.*(?:password|secret|key)/i,
            /#.*(?:password|secret|key)/i,
            /\/\*.*(?:password|secret|key).*\*\//i,
            /<!--.*(?:password|secret|key).*-->/i,
            /password.*=.*['"`]password['"`]/i,
            /secret.*=.*['"`]secret['"`]/i,
            /key.*=.*['"`]key['"`]/i
        ];
    }
    check(fileContent) {
        const issues = [];
        // Focus on configuration files and certain code files
        if (!this.isSensitiveFile(fileContent.path)) {
            return issues;
        }
        for (const { pattern, type } of this.sensitivePatterns) {
            const matches = this.findMatches(fileContent.content, pattern);
            for (const { match, line, column, lineContent } of matches) {
                const matchedText = match[0];
                if (this.isFalsePositive(matchedText)) {
                    continue;
                }
                issues.push(this.createIssue(fileContent.path, line, column, lineContent, `Hardcoded ${type} found: ${this.maskSensitiveData(matchedText)}`, `Move sensitive data to environment variables or secure configuration management. Use process.env.VARIABLE_NAME or a secrets management service.`));
            }
        }
        return issues;
    }
    isSensitiveFile(filePath) {
        const sensitiveFiles = [
            /\.env/i,
            /\.config/i,
            /\.conf/i,
            /\.ini/i,
            /\.properties/i,
            /\.yaml/i,
            /\.yml/i,
            /\.json/i,
            /\.toml/i,
            /config\./i,
            /settings\./i,
            /constants\./i,
            /\.js$/i,
            /\.ts$/i,
            /\.py$/i,
            /\.php$/i,
            /\.rb$/i,
            /\.jsx$/i,
            /\.tsx$/i,
            /\.vue$/i,
            /\.svelte$/i
        ];
        return sensitiveFiles.some(pattern => pattern.test(filePath));
    }
    isFalsePositive(text) {
        return this.falsePositivePatterns.some(pattern => pattern.test(text));
    }
    maskSensitiveData(data) {
        if (data.length <= 8) {
            return '*'.repeat(data.length);
        }
        const start = data.substring(0, 4);
        const end = data.substring(data.length - 4);
        const middle = '*'.repeat(Math.min(data.length - 8, 10));
        return `${start}${middle}${end}`;
    }
}
exports.HardcodedSensitiveDataRule = HardcodedSensitiveDataRule;
//# sourceMappingURL=hardcoded-sensitive-data.js.map