Feature/privacy leaks

internal/services/engines/leaks/rule_manager.go

@@ -60,5 +60,9 @@ func Rules() []engine.Rule {
 		NewHardCodedPassword(),
 		NewPasswordExposedInHardcodedURL(),
 		NewWPConfig(),
+
+		// privacy rules
+		BrPrivacyLawHardCodedUserData(),
+		BrPrivacyLawExposureOfUserData(),
 	}
 }

internal/services/engines/leaks/rules.go

@@ -536,3 +536,40 @@ func NewWPConfig() *text.Rule {
 		},
 	}
 }
+
+func BrPrivacyLawExposureOfUserData() *text.Rule {
+	return &text.Rule{
+		Metadata: engine.Metadata{
+			ID:            "HS-PRIVACY-1",
+			Name:          "Exposure of User private Data",
+			Description:   "Brazilian Privacy Law (LGPD) prevents users IDs (cpf, rg) to be exposed in applications.",
+			Severity:      severities.High.ToString(),
+			Confidence:    confidence.Medium.ToString(),
+			SafeExample:   SampleSafeHSPRIVACY1,
+			UnsafeExample: SampleVulnerableHSPRIVACY1,
+		},
+		Type: text.Regular,
+		Expressions: []*regexp.Regexp{
+			regexp.MustCompile(`(?i)\(*[\"\']?(cpf|rg)[:]\s*[%A-Za-z]*[\"\']?\s[%+,.format(]\s(client|user)?[.]?(doc|document)`),
+		},
+	}
+}
+
+func BrPrivacyLawHardCodedUserData() *text.Rule {
+	return &text.Rule{
+		Metadata: engine.Metadata{
+			ID:            "HS-PRIVACY-2",
+			Name:          "Hardcoded User Data related to Brazilian Privacy Law",
+			Description:   "Brazilian Privacy Law (LGPD) prevents user's data to be hardcoded in applications code.",
+			Severity:      severities.High.ToString(),
+			Confidence:    confidence.Medium.ToString(),
+			SafeExample:   SampleSafeHSPRIVACY2,
+			UnsafeExample: SampleVulnerableHSPRIVACY2,
+		},
+		Type: text.Regular,
+		Expressions: []*regexp.Regexp{
+			regexp.MustCompile(`(?i)[\"\']?(cpf|rg)+[\"\']?\W?[:=]\W?[\"\']?[0-9.-]+[\"\']?`),
+		},
+	}
+
+}

internal/services/engines/leaks/rules_test.go

@@ -482,6 +482,38 @@ func TestRulesVulnerableCode(t *testing.T) {
 				},
 			},
 		},
+		{
+			Name:     "HS-PRIVACY-1",
+			Rule:     BrPrivacyLawExposureOfUserData(),
+			Src:      SampleVulnerableHSPRIVACY1,
+			Filename: filepath.Join(tempDir, "HS-PRIVACY-1.test"),
+			Findings: []engine.Finding{
+				{
+					CodeSample: `console.log("CPF: " + client.document);`,
+					SourceLocation: engine.Location{
+						Filename: filepath.Join(tempDir, "HS-PRIVACY-1.test"),
+						Line:     2,
+						Column:   11,
+					},
+				},
+			},
+		},
+		{
+			Name:     "HS-PRIVACY-2",
+			Rule:     BrPrivacyLawHardCodedUserData(),
+			Src:      SampleVulnerableHSPRIVACY2,
+			Filename: filepath.Join(tempDir, "HS-PRIVACY-2.test"),
+			Findings: []engine.Finding{
+				{
+					CodeSample: `"cpf": "123.456.789-10"`,
+					SourceLocation: engine.Location{
+						Filename: filepath.Join(tempDir, "HS-PRIVACY-2.test"),
+						Line:     3,
+						Column:   2,
+					},
+				},
+			},
+		},
 	}
 
 	testutil.TestVulnerableCode(t, testcases)
@@ -658,6 +690,18 @@ func TestRulesSafeCode(t *testing.T) {
 			Src:      SampleSafeHSLEAKS28,
 			Filename: filepath.Join(tempDir, "HS-LEAKS-28.test"),
 		},
+		{
+			Name:     "HS-PRIVACY-1",
+			Rule:     BrPrivacyLawExposureOfUserData(),
+			Src:      SampleSafeHSPRIVACY1,
+			Filename: filepath.Join(tempDir, "HS-PRIVACY-1.test"),
+		},
+		{
+			Name:     "HS-PRIVACY-2",
+			Rule:     BrPrivacyLawHardCodedUserData(),
+			Src:      SampleSafeHSPRIVACY2,
+			Filename: filepath.Join(tempDir, "HS-PRIVACY-2.test"),
+		},
 	}
 	testutil.TestSafeCode(t, testcases)
 }

internal/services/engines/leaks/samples.go

@@ -532,5 +532,23 @@ define('DB_PASSWORD', 'wen0221!');
 	SampleSafeHSLEAKS28 = `
 <?php
 define('AUTH_KEY', getenv("AUTH_KEY"));
+`
+
+	SampleVulnerableHSPRIVACY1 = `
+console.log("CPF: " + client.document);
+`
+
+	SampleSafeHSPRIVACY1 = `Don't log/print sensible data`
+
+	SampleVulnerableHSPRIVACY2 = `
+client = {
+  "cpf": "123.456.789-10"
+}
+`
+
+	SampleSafeHSPRIVACY2 = `
+client = {
+  "doc": json.loads(r.content)['doc']
+}
 `
 )

internal/services/engines/rules_test.go

@@ -52,7 +52,7 @@ func TestGetRules(t *testing.T) {
 		{
 			engine:             "Leaks",
 			manager:            leaks.NewRules(),
-			expectedTotalRules: 28,
+			expectedTotalRules: 30,
 		},
 		{
 			engine:             "Kubernetes",