id: cakefile-exposure

info:
  name: Cakefile - Exposure
  author: 0x_Akoko
  severity: info
  description: |
    Detected CoffeeScript Cakefile was exposing build tasks and project structure.
  reference:
    - https://coffeescript.org/v2/#cake
  classification:
    cwe-id: CWE-538
  metadata:
    verified: true
    max-request: 7
  tags: exposure,config,coffeescript,cakefile

http:
  - method: GET
    path:
      - "{{BaseURL}}/Cakefile"
      - "{{BaseURL}}/src/Cakefile"
      - "{{BaseURL}}/app/Cakefile"
      - "{{BaseURL}}/lib/Cakefile"
      - "{{BaseURL}}/build/Cakefile"
      - "{{BaseURL}}/node_modules/whet.extend/Cakefile"
      - "{{BaseURL}}/node_modules/Cakefile"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "task "
          - "require "
          - "->"
        condition: and

      - type: word
        words:
          - "<!DOCTYPE"
          - "<html"
          - '{"props"'
          - "<script"
        negative: true

      - type: word
        words:
          - "coffee"
          - "spawn"
          - "exec"
          - "invoke"
          - "fs.readFileSync"
        condition: or

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100f82600ea5dbfc2305c0d346ba3013a73337b078657d69af9cf8acc6082bfeae9022100d1b6b92ffa0050f679f610eec3c89248a7a6ac4d8d539118b3aac49650077cad:922c64590222798bb761d5b6d8e72950