اختبار الأمان و OWASP ASVS: الأمن جُوّه الـ CI، مش audit آخر السنة

// sast.js: SAST صغير: rules بـ regex على كل سطر، كل rule مربوطة بـ CWE وفصل في ASVS

const R = (id, severity, cwe, asvs, re, msg) => ({ id, severity, cwe, asvs, re, msg });

export const RULES = [
  R("sql-concat", "high", "CWE-89", "V5 injection", /\b(query|execute)\s*\(\s*`[^`]*\$\{/, "SQL من template: استخدم parameters"),
  R("cmd-injection", "high", "CWE-78", "V5 injection", /\bexec(Sync)?\s*\(\s*`[^`]*\$\{/, "exec بـ shell: استخدم execFile"),
  R("eval-injection", "high", "CWE-95", "V5 injection", /\beval\s*\(|\bnew\s+Function\s*\(/, "eval أو new Function"),
  R("weak-random", "medium", "CWE-338", "V6 crypto", /\bMath\.random\s*\(/, "Math.random للـ tokens: استخدم randomBytes"),
  R("weak-hash", "high", "CWE-327", "V6 crypto", /createHash\(\s*["'](md5|sha1)["']/i, "md5/sha1 ضعاف"),
  R("jwt-no-alg", "medium", "CWE-347", "V3 session", /\bjwt\.verify\((?![^\n]*algorithms)/, "jwt.verify من غير algorithms"),
  R("tls-off", "high", "CWE-295", "V9 TLS", /rejectUnauthorized\s*:\s*false/, "التحقق من الشهادة مقفول"),
  R("hardcoded-secret", "high", "CWE-798", "V14 config", /["'](sk_live_|sk_lab_|ghp_|AKIA)[A-Za-z0-9]{8,}/, "secret مكتوب في الـ code"),
];

// "// appsec-ignore: rule-id السبب" على السطر نفسه أو اللي قبله. لازم rule id وسبب، وإلا التجاهل ما يتحسبش
const IGNORE = /appsec-ignore:\s*([a-z-]+)\s+(\S.*)$/;

export function scan(file, source) {
  const lines = source.split("\n");
  const ignoredAt = (i) => {
    const out = new Set();
    for (const l of [lines[i], lines[i - 1] ?? ""]) {
      const m = IGNORE.exec(l);
      if (m) out.add(m[1]);
    }
    return out;
  };
  const findings = [];
  lines.forEach((text, i) => {
    if (/^\s*\/\//.test(text)) return; // سطر comment كامل
    const ignored = ignoredAt(i);
    for (const r of RULES)
      if (r.re.test(text) && !ignored.has(r.id))
        findings.push({ file, line: i + 1, rule: r.id, severity: r.severity, cwe: r.cwe, asvs: r.asvs, message: r.msg });
  });
  return findings;
}

// SARIF 2.1.0: الشكل اللي GitHub code scanning بيفهمه
export function toSarif(findings) {
  const level = { high: "error", medium: "warning", low: "note" };
  return {
    version: "2.1.0",
    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
    runs: [
      {
        tool: { driver: { name: "mini-sast", rules: RULES.map((r) => ({ id: r.id, shortDescription: { text: r.msg }, properties: { tags: [r.cwe] } })) } },
        results: findings.map((f) => ({
          ruleId: f.rule,
          level: level[f.severity],
          message: { text: `${f.message} (${f.cwe}, ASVS ${f.asvs})` },
          locations: [{ physicalLocation: { artifactLocation: { uri: f.file }, region: { startLine: f.line } } }],
        })),
      },
    ],
  };
}

$ node main.js
high     app/routes.js:7  hardcoded-secret   CWE-798  V14 config
high     app/routes.js:11 sql-concat         CWE-89   V5 injection
high     app/routes.js:21 cmd-injection      CWE-78   V5 injection
high     app/routes.js:28 eval-injection     CWE-95   V5 injection
medium   app/routes.js:31 weak-random        CWE-338  V6 crypto
high     app/routes.js:38 weak-hash          CWE-327  V6 crypto
medium   app/routes.js:44 jwt-no-alg         CWE-347  V3 session
high     app/routes.js:54 tls-off            CWE-295  V9 TLS
high     app/routes.js:64 cmd-injection      CWE-78   V5 injection

9 finding، منهم 7 high
⛔ الـ PR ما يتعملوش merge

// main.js (ci): خطوة الـ SAST في الـ CI: افحص app/، اطبع التقرير، واكتب SARIF، ووقّف لو فيه high
import { readFileSync, writeFileSync, readdirSync } from "node:fs";
import { scan, toSarif } from "./sast.js";

const files = readdirSync("app").filter((f) => f.endsWith(".js")).map((f) => `app/${f}`);
const findings = files.flatMap((f) => scan(f, readFileSync(f, "utf8")));

for (const f of findings)
  console.log(`${f.severity.padEnd(8)} ${`${f.file}:${f.line}`.padEnd(16)} ${f.rule.padEnd(18)} ${f.cwe.padEnd(8)} ${f.asvs}`);
writeFileSync("results.sarif", JSON.stringify(toSarif(findings), null, 2)); // GitHub بيعرضه في الـ PR

const high = findings.filter((f) => f.severity === "high").length;
console.log(`\n${findings.length} finding، منهم ${high} high`);
console.log(high ? "⛔ الـ PR ما يتعملوش merge" : "✅ عدّى");
process.exitCode = high ? 1 : 0;

// app/routes.js: code حقيقي الشكل من مشروع، فيه مشاكل أمان مستخبية وسط code سليم
import { exec, execFile } from "node:child_process";
import { createHash, randomBytes } from "node:crypto";
import https from "node:https";
import jwt from "jsonwebtoken";

const API_KEY = "sk_lab_51HxFakeKey00000000"; // اتكتب هنا "مؤقتًا" من سنتين

export function routes(app, db) {
  app.get("/users", async (req, res) => {
    const rows = await db.query(`SELECT * FROM users WHERE name = '${req.query.name}'`);
    res.json(rows);
  });

  app.get("/users/:id", async (req, res) => {
    const rows = await db.query("SELECT * FROM users WHERE id = $1", [req.params.id]); // سليم
    res.json(rows);
  });

  app.post("/convert", (req, res) => {
    exec(`convert ${req.body.file} out.png`, () => res.send("ok"));
  });

  app.post("/thumb", (req, res) => {
    execFile("convert", [req.body.file, "thumb.png"], () => res.send("ok")); // سليم: مفيش shell
  });

  app.post("/calc", (req, res) => res.json({ result: eval(req.body.expr) }));

  app.post("/reset", (req, res) => {
    const token = Math.random().toString(36).slice(2);
    res.json({ sent: true, debug: token });
  });

  app.post("/invite", (req, res) => res.json({ code: randomBytes(16).toString("hex") })); // سليم

  app.post("/register", async (req, res) => {
    const hash = createHash("md5").update(req.body.password).digest("hex");
    await db.query("INSERT INTO users (email, hash) VALUES ($1, $2)", [req.body.email, hash]);
    res.sendStatus(201);
  });

  app.get("/me", (req, res) => {
    const claims = jwt.verify(req.headers.authorization.slice(7), process.env.JWT_KEY);
    res.json(claims);
  });

  app.get("/admin", (req, res) => {
    const claims = jwt.verify(req.cookies.t, process.env.JWT_KEY, { algorithms: ["HS256"] }); // سليم
    res.json(claims);
  });

  app.get("/partner", (req, res) => {
    https.get("https://partner.internal/api", { rejectUnauthorized: false }, (r) => r.pipe(res));
  });

  app.get("/report", (req, res) => {
    // appsec-ignore: eval-injection الـ expr ثابت ومن عندنا، مش من المستخدم
    res.json(eval("1 + 1"));
  });

  app.get("/legacy", (req, res) => {
    // appsec-ignore: cmd-injection
    exec(`legacy ${req.query.x}`, () => res.end());
  });
}

import { readFileSync } from "node:fs";
import { scan, toSarif, RULES } from "./sast.js";

let ok = 0, all = 0;
const check = (name, cond, extra = "") => { all++; if (cond) ok++; console.log(cond ? "✅" : "❌", name, extra); };
const rules = (src) => scan("t.js", src).map((f) => f.rule);
const hit = (name, src, rule) => check(`${name} ← ${rule}`, rules(src).includes(rule), JSON.stringify(rules(src)));
const clean = (name, src) => check(`${name} ← مفيش finding`, rules(src).length === 0, JSON.stringify(rules(src)));

check("فيه تمن rules على الأقل بـ id و severity و cwe و asvs", RULES.length >= 8 && RULES.every((r) => r.id && r.severity && /^CWE-\d+$/.test(r.cwe) && r.asvs));
hit("SQL بـ template", "db.query(`SELECT * FROM t WHERE a = '${x}'`)", "sql-concat");
clean("SQL بـ parameters", 'db.query("SELECT * FROM t WHERE a = $1", [x])');
clean("template من غير ${} ", "db.query(`SELECT 1`)");
hit("exec بـ template", "exec(`ls ${dir}`)", "cmd-injection");
hit("execSync بـ template", "execSync(`rm ${f}`)", "cmd-injection");
clean("execFile بـ array", 'execFile("ls", [dir])');
hit("eval", "eval(req.body.x)", "eval-injection");
hit("new Function", 'new Function("return " + x)', "eval-injection");
clean("كلمة evaluate عادية", "const evaluate = (x) => x; evaluate(1)");
hit("Math.random", "const t = Math.random().toString(36)", "weak-random");
clean("randomBytes", "randomBytes(16)");
hit("md5", 'createHash("md5")', "weak-hash");
hit("sha1 بـ single quotes", "createHash('SHA1')", "weak-hash");
clean("sha256", 'createHash("sha256")');
hit("jwt.verify من غير algorithms", "jwt.verify(t, key)", "jwt-no-alg");
clean("jwt.verify بـ algorithms", 'jwt.verify(t, key, { algorithms: ["HS256"] })');
hit("rejectUnauthorized false", "https.get(u, { rejectUnauthorized: false })", "tls-off");
clean("rejectUnauthorized true", "{ rejectUnauthorized: true }");
const FAKE = ["sk", "lab", "abcdefgh123"].join("_");
hit("مفتاح مكتوب في الـ code", `const k = "${FAKE}"`, "hardcoded-secret");
clean("مفتاح من الـ env", "const k = process.env.STRIPE_KEY");
clean("سطر comment كامل فيه eval", "// eval(x) كان هنا زمان");
clean("ignore بـ rule و سبب على السطر اللي قبله", "// appsec-ignore: eval-injection ثابت من عندنا\neval('1+1')");
clean("ignore على نفس السطر", "eval('1+1') // appsec-ignore: eval-injection ثابت");
hit("ignore من غير سبب ما يتحسبش", "// appsec-ignore: eval-injection\neval(x)", "eval-injection");
hit("ignore لـ rule تانية ما يتحسبش", "// appsec-ignore: weak-random سبب\neval(x)", "eval-injection");
hit("ignore على بعد سطرين ما يتحسبش", "// appsec-ignore: eval-injection سبب\n\neval(x)", "eval-injection");

const f = scan("app/x.js", "a\nb\neval(x)")[0];
check("finding فيه file و line و rule و severity و cwe و asvs و message",
  f?.file === "app/x.js" && f?.line === 3 && f?.rule === "eval-injection" && f?.severity === "high" && f?.cwe === "CWE-95" && !!f?.asvs && !!f?.message);
check("سطر فيه مشكلتين ← اتنين findings", scan("t.js", "exec(`a ${x}`); eval(y)").length === 2);

cons
…