مشروع تقوية الأمان

class SecurityAudit {\n  constructor() {\n    this.findings = [];\n    this.severity = { critical: 0, high: 0, medium: 0, low: 0 };\n  }\n\n  async runFullAudit() {\n    console.log('بدء التدقيق الأمني الشامل...');\n    \n    await this.auditAuthentication();\n    await this.auditAuthorization();\n    await this.auditInputValidation();\n    await this.auditDataProtection();\n    await this.auditSessionManagement();\n    await this.auditSecurityHeaders();\n    await this.auditDependencies();\n    await this.auditInfrastructure();\n    \n    return this.generateReport();\n  }\n\n  async auditAuthentication() {\n    const checks = [\n      {\n        name: 'تعقيد كلمة المرور',\n        test: () => this.checkPasswordPolicy(),\n        severity: 'high'\n      },\n      {\n        name: 'المصادقة متعددة العوامل',\n        test: () => this.checkMFAImplementation(),\n        severity: 'critical'\n      },\n      {\n        name: 'الحماية من القوة الغاشمة',\n        test: () => this.checkRateLimiting(),\n        severity: 'high'\n      },\n      {\n        name: 'إعادة تعيين كلمة المرور الآمنة',\n        test: () => this.checkPasswordResetFlow(),\n        severity: 'high'\n      },\n      {\n        name: 'سياسة قفل الحساب',\n        test: () => this.checkLockoutPolicy(),\n        severity: 'medium'\n      }\n    ];\n\n    for (const check of checks) {\n      try {\n        const result = await check.test();\n        if (!result.passed) {\n          this.addFinding(\n            'المصادقة',\n            check.name,\n            result.message,\n            check.severity\n          );\n        }\n      } catch (error) {\n        this.addFinding(\n          'المصادقة',\n          check.name,\n          `فشل الاختبار: ${error.message}`,\n          'high'\n        );\n      }\n    }\n  }\n\n  async auditAuthorization() {\n    const checks = [\n      {\n        name: 'تنفيذ RBAC',\n        test: () => this.checkRBACCompleteness(),\n        severity: 'critical'\n      },\n      {\n        name: 'تصعيد الامتيازات',\n        test: () => this.testPrivilegeEscalation(),\n        severity: 'critical'\n      },\n      {\n        name: 'ثغرات IDOR',\n        test: () => this.testIDORVulnerabilities(),\n        severity: 'high'\n      },\n      {\n        name: 'تفويض API',\n        test: () => this.checkAPIAuthorization(),\n        severity: 'high'\n      }\n    ];\n\n    for (const check of checks) {\n      const result = await check.test();\n      if (!result.passed) {\n        this.addFinding(\n          'التفويض',\n          check.name,\n          result.message,\n          check.severity\n        );\n      }\n    }\n  }\n\n  async auditInputValidation() {\n    const checks = [\n      {\n        name: 'حماية XSS',\n        test: () => this.testXSSVulnerabilities(),\n        severity: 'critical'\n      },\n      {\n        name: 'حقن SQL',\n        test: () => this.testSQLInjection(),\n        severity: 'critical'\n      },\n      {\n        name: 'حقن الأوامر',\n        test: () => this.testCommandInjection(),\n        severity: 'critical'\n      },\n      {\n        name: 'أمان رفع الملفات',\n        test: () => this.checkFileUploadSecurity(),\n        severity: 'high'\n      },\n      {\n        name: 'تنقية المدخلات',\n        test: () => this.checkInputSanitization(),\n        severity: 'high'\n      }\n    ];\n\n    for (const check of checks) {\n      const result = await check.test();\n      if (!result.passed) {\n        this.addFinding(\n          'التحقق من صحة المدخلات',\n          check.name,\n          result.message,\n          check.severity\n        );\n      }\n    }\n  }\n\n  addFinding(category, name, message, severity) {\n    this.findings.push({\n      category,\n      name,\n      message,\n      severity,\n      timestamp: new Date().toISOString()\n    });\n    this.severity[severity]++;\n  }\n\n  generateReport() {\n    const report = {\n      summary: {\n        totalFindings: this.findings.length,\n        critical: this.severity.critical,\n        high: this.severity.high,\n        medium: this.severity.medium,\n        low: this.severity.low,\n        riskScore: this.calculateRiskScore()\n      },\n      findings: this.groupFindingsByCategory(),\n      recommendations: this.generateRecommendations()\n    };\n\n    return report;\n  }\n\n  calculateRiskScore() {\n    return (\n      this.severity.critical * 10 +\n      this.severity.high * 5 +\n      this.severity.medium * 2 +\n      this.severity.low * 1\n    );\n  }\n\n  groupFindingsByCategory() {\n    const grouped = {};\n    this.findings.forEach(finding => {\n      if (!grouped[finding.category]) {\n        grouped[finding.category] = [];\n      }\n      grouped[finding.category].push(finding);\n    });\n    return grouped;\n  }\n\n  generateRecommendations() {\n    const recommendations = [];\n    \n    if (this.severity.critical > 0) {\n      recommendations.push({\n        priority: 'فوري',\n        action: 'معالجة جميع نقاط الضعف الحرجة قبل النشر'\n      });\n    }\n    \n    if (this.severity.high > 5) {\n      recommendations.push({\n        priority: 'عالي',\n        action: 'جدولة سباق مخصص لمعالجة الأمان'\n      });\n    }\n    \n    return recommendations;\n  }\n}\n\n// الاستخدام\nconst audit = new SecurityAudit();\nconst report = await audit.runFullAudit();\nconsole.log(JSON.stringify(report, null, 2));

// .github/workflows/security.yml\nname: Security Scanning\n\non:\n  push:\n    branches: [ main, develop ]\n  pull_request:\n    branches: [ main ]\n  schedule:\n    - cron: '0 0 * * 0'  # فحص أسبوعي\n\njobs:\n  sast:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v3\n      \n      - name: Run Semgrep\n        uses: returntocorp/semgrep-action@v1\n        with:\n          config: >\n            p/security-audit\n            p/owasp-top-ten\n            p/javascript\n            p/typescript\n      \n      - name: SonarCloud Scan\n        uses: SonarSource/sonarcloud-github-action@master\n        env:\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}\n\n  dependency-check:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v3\n      \n      - name: Run npm audit\n        run: npm audit --audit-level=high\n      \n      - name: Run Snyk\n        uses: snyk/actions/node@master\n        env:\n          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}\n        with:\n          command: test\n          args: --severity-threshold=high\n\n  secrets-scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v3\n        with:\n          fetch-depth: 0\n      \n      - name: TruffleHog Scan\n        uses: trufflesecurity/trufflehog@main\n        with:\n          path: ./\n          base: ${{ github.event.repository.default_branch }}\n          head: HEAD\n\n  container-scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v3\n      \n      - name: Build Docker image\n        run: docker build -t myapp:${{ github.sha }} .\n      \n      - name: Run Trivy vulnerability scanner\n        uses: aquasecurity/trivy-action@master\n        with:\n          image-ref: myapp:${{ github.sha }}\n          format: 'sarif'\n          output: 'trivy-results.sarif'\n      \n      - name: Upload results to GitHub Security\n        uses: github/codeql-action/upload-sarif@v2\n        with:\n          sarif_file: 'trivy-results.sarif'

// security-scan.js\nconst ZAP = require('zaproxy');\nconst fs = require('fs');\n\nclass DynamicSecurityScanner {\n  constructor(config) {\n    this.zap = new ZAP({\n      apiKey: config.zapApiKey,\n      proxy: config.proxy || 'http://localhost:8080'\n    });\n    this.targetUrl = config.targetUrl;\n    this.scanPolicy = config.scanPolicy || 'Default Policy';\n  }\n\n  async runScan() {\n    console.log(`بدء فحص DAST على ${this.targetUrl}`);\n    \n    try {\n      // الزحف على التطبيق\n      console.log('المرحلة 1: الزحف...');\n      const spiderScanId = await this.spider();\n      await this.waitForScan(spiderScanId, 'spider');\n      \n      // الفحص النشط\n      console.log('المرحلة 2: الفحص النشط...');\n      const activeScanId = await this.activeScan();\n      await this.waitForScan(activeScanId, 'ascan');\n      \n      // إنشاء التقرير\n      console.log('المرحلة 3: إنشاء التقرير...');\n      const report = await this.generateReport();\n      \n      return report;\n    } catch (error) {\n      console.error('فشل فحص DAST:', error);\n      throw error;\n    }\n  }\n\n  async spider() {\n    const response = await this.zap.spider.scan({\n      url: this.targetUrl,\n      maxChildren: 10,\n      recurse: true\n    });\n    return response.scan;\n  }\n\n  async activeScan() {\n    const response = await this.zap.ascan.scan({\n      url: this.targetUrl,\n      recurse: true,\n      inScopeOnly: false,\n      scanPolicyName: this.scanPolicy\n    });\n    return response.scan;\n  }\n\n  async waitForScan(scanId, scanType) {\n    let progress = 0;\n    while (progress < 100) {\n      await new Promise(resolve => setTimeout(resolve, 5000));\n      const status = await this.zap[scanType].status(scanId);\n      progress = parseInt(status.status);\n      console.log(`تقدم ${scanType}: ${progress}%`);\n    }\n  }\n\n  async generateReport() {\n    const alerts = await this.zap.core.alerts({\n      baseurl: this.targetUrl\n    });\n    \n    const report = {\n      targetUrl: this.targetUrl,\n      timestamp: new Date().toISOString(),\n      summary: this.summarizeAlerts(alerts.alerts),\n      alerts: alerts.alerts,\n      passed: !alerts.alerts.some(a => a.risk === 'High' || a.risk === 'Critical')\n    };\n    \n    // حفظ التقرير\n    fs.writeFileSync(\n      `dast-report-${Date.now()}.json`,\n      JSON.stringify(report, null, 2)\n    );\n    \n    return report;\n  }\n\n  summarizeAlerts(alerts) {\n    const summary = {\n      total: alerts.length,\n      critical: 0,\n      high: 0,\n      medium: 0,\n      low: 0,\n      informational: 0\n    };\n    \n    alerts.forEach(alert => {\n      const risk = alert.risk.toLowerCase();\n      if (summary.hasOwnProperty(risk)) {\n        summary[risk]++;\n      }\n    });\n    \n    return summary;\n  }\n}\n\n// الاستخدام في CI/CD\nconst scanner = new DynamicSecurityScanner({\n  zapApiKey: process.env.ZAP_API_KEY,\n  targetUrl: process.env.TARGET_URL || 'http://localhost:3000',\n  scanPolicy: 'OWASP Top 10'\n});\n\nconst report = await scanner.runScan();\n\nif (!report.passed) {\n  console.error('فشل فحص الأمان! تم اكتشاف نقاط ضعف عالية المخاطر.');\n  process.exit(1);\n}

class PenetrationTestingSuite {\n  constructor(targetUrl) {\n    this.targetUrl = targetUrl;\n    this.findings = [];\n  }\n\n  async runBasicTests() {\n    console.log('بدء اختبارات الاختراق الأساسية...');\n    \n    await this.testAuthenticationBypass();\n    await this.testSQLInjection();\n    await this.testXSS();\n    await this.testCSRF();\n    await this.testDirectoryTraversal();\n    await this.testSessionFixation();\n    await this.testSecurityHeaders();\n    \n    return this.generateFindings();\n  }\n\n  async testAuthenticationBypass() {\n    const tests = [\n      // اختبار 1: كلمة مرور فارغة\n      { username: 'admin', password: '' },\n      // اختبار 2: حقن SQL في اسم المستخدم\n      { username: \"admin' OR '1'='1\", password: 'anything' },\n      // اختبار 3: بيانات الاعتماد الافتراضية\n      { username: 'admin', password: 'admin' },\n      { username: 'admin', password: 'password' },\n      // اختبار 4: تعداد اسم المستخدم\n      { username: 'nonexistent_user_12345', password: 'test' }\n    ];\n\n    for (const test of tests) {\n      try {\n        const response = await fetch(`${this.targetUrl}/api/login`, {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify(test)\n        });\n\n        if (response.ok) {\n          this.addFinding(\n            'تجاوز المصادقة',\n            'حرج',\n            `تم تجاوز المصادقة بنجاح مع: ${JSON.stringify(test)}`\n          );\n        }\n\n        // التحقق من تعداد اسم المستخدم\n        const responseText = await response.text();\n        if (responseText.includes('user not found') || responseText.includes('incorrect password')) {\n          this.addFinding(\n            'تعداد اسم المستخدم',\n            'متوسط',\n            'تكشف نقطة تسجيل الدخول عما إذا كان اسم المستخدم موجودًا'\n          );\n        }\n      } catch (error) {\n        console.log(`فشل الاختبار: ${error.message}`);\n      }\n    }\n  }\n\n  async testSQLInjection() {\n    const payloads = [\n      \"1' OR '1'='1\",\n      \"1'; DROP TABLE users--\",\n      \"1' UNION SELECT NULL, username, password FROM users--\",\n      \"1' AND 1=0 UNION ALL SELECT NULL, CONCAT(username, ':', password), NULL FROM users--\"\n    ];\n\n    for (const payload of payloads) {\n      try {\n        const response = await fetch(\n          `${this.targetUrl}/api/users?id=${encodeURIComponent(payload)}`\n        );\n\n        const data = await response.text();\n        \n        // التحقق من رسائل خطأ SQL\n        if (data.match(/SQL syntax|mysql_fetch|pg_query|ORA-\d{5}|SQLite/i)) {\n          this.addFinding(\n            'حقن SQL',\n            'حرج',\n            `تعرض خطأ SQL مع الحمولة: ${payload}`\n          );\n        }\n\n        // التحقق من الحقن الناجح\n        if (response.ok && data.length > 1000) {\n          this.addFinding(\n            'حقن SQL محتمل',\n            'عالي',\n            `حجم استجابة مشبوه مع الحمولة: ${payload}`\n          );\n        }\n      } catch (error) {\n        console.log(`فشل اختبار حقن SQL: ${error.message}`);\n      }\n    }\n  }\n\n  async testXSS() {\n    const payloads = [\n      '<script>alert(document.cookie)</script>',\n      '<img src=x onerror=alert(document.domain)>',\n      '<svg/onload=alert(1)>',\n      'javascript:alert(document.cookie)',\n      '<iframe src=javascript:alert(1)></iframe>'\n    ];\n\n    for (const payload of payloads) {\n      try {\n        // اختبار XSS المنعكس\n        const response = await fetch(\n          `${this.targetUrl}/search?q=${encodeURIComponent(payload)}`\n        );\n\n        const html = await response.text();\n        \n        // التحقق مما إذا كانت الحمولة منعكسة بدون تخطي\n        if (html.includes(payload)) {\n          this.addFinding(\n            'XSS المنعكس',\n            'عالي',\n            `انعكاس مدخلات غير متخطاة مع الحمولة: ${payload}`\n          );\n        }\n\n        // اختبار XSS المخزن\n        const postResponse = await fetch(`${this.targetUrl}/api/comments`, {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({ comment: payload })\n        });\n\n        if (postResponse.ok) {\n          // استرجاع والتحقق مما إذا كانت الحمولة مخزنة\n          const getResponse = await fetch(`${this.targetUrl}/api/comments`);\n          const comments = await getResponse.text();\n          \n          if (comments.includes(payload)) {\n            this.addFinding(\n              'XSS المخزن',\n              'حرج',\n              `تم تخزين الحمولة بدون تنقية: ${payload}`\n            );\n          }\n        }\n      } catch (error) {\n        console.log(`فشل اختبار XSS: ${error.message}`);\n      }\n    }\n  }\n\n  async testCSRF() {\n    try {\n      // اختبار ما إذا كانت عملية تغيير الحالة تعمل بدون رمز CSRF\n      const response = await fetch(`${this.targetUrl}/api/settings`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ email: 'attacker@evil.com' }),\n        credentials: 'include'\n      });\n\n      if (response.ok) {\n        this.addFinding(\n          'ثغرة CSRF',\n          'عالي',\n          'تنجح عملية تغيير الحالة بدون رمز CSRF'\n        );\n      }\n    } catch (error) {\n      console.log(`فشل اختبار CSRF: ${error.message}`);\n    }\n  }\n\n  async testDirectoryTraversal() {\n    const payloads = [\n      '../../../etc/passwd',\n      '..\\..\\..\\windows\\system32\\config\\sam',\n      '....//....//....//etc/passwd',\n      '%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd'\n    ];\n\n    for (const payload of payloads) {\n      try {\n        const response = await fetch(\n          `${this.targetUrl}/files?path=${encodeURIComponent(payload)}`\n        );\n\n        const content = await response.text();\n        \n        if (content.includes('root:x:') || content.includes('Administrator')) {\n          this.addFinding(\n            'اجتياز الدليل',\n            'حرج',\n            `ملف حساس يمكن الوصول إليه مع الحمولة: ${payload}`\n          );\n        }\n      } catch (error) {\n        console.log(`فشل اختبار اجتياز الدليل: ${error.message}`);\n      }\n    }\n  }\n\n  addFinding(vulnerability, severity, description) {\n    this.findings.push({\n      vulnerability,\n      severity,\n      description,\n      timestamp: new Date().toISOString()\n    });\n  }\n\n  generateFindings() {\n    return {\n      totalFindings: this.findings.length,\n      criticalFindings: this.findings.filter(f => f.severity === 'حرج').length,\n      findings: this.findings,\n      passed: this.findings.filter(f => f.severity === 'حرج' || f.severity === 'عالي').length === 0\n    };\n  }\n}\n\n// الاستخدام\nconst pentest = new PenetrationTestingSuite('https://staging.example.com');\nconst results = await pentest.runBasicTests();\nconsole.log(JSON.stringify(results, null, 2));

// security-documentation.md structure\n\n# توثيق أمان التطبيق\n\n## 1. بنية الأمان\n- رسم تخطيطي لبنية الشبكة\n- مخططات تدفق البيانات\n- حدود الثقة ومناطق الأمان\n- بنية المصادقة والتفويض\n\n## 2. نموذج التهديد\n- الأصول وتقييمها\n- الجهات الفاعلة للتهديد وقدراتها\n- ناقلات الهجوم وسيناريوهات التهديد\n- مصفوفة تقييم المخاطر\n\n## 3. ضوابط الأمان\n- آليات المصادقة\n- التفويض والتحكم في الوصول\n- تشفير البيانات (في حالة الراحة والعبور)\n- التحقق من صحة المدخلات وترميز المخرجات\n- إدارة الجلسة\n- تسجيل ومراقبة الأمان\n- الكشف عن الحوادث والاستجابة لها\n\n## 4. ممارسات التطوير الآمن\n- متطلبات الأمان في SDLC\n- إرشادات الترميز الآمن\n- إجراءات مراجعة الكود\n- اختبار الأمان (SAST، DAST، اختبار الاختراق)\n- إدارة التبعيات\n- متطلبات التدريب الأمني\n\n## 5. متطلبات الامتثال\n- تدابير الامتثال لـ GDPR\n- الامتثال لـ PCI-DSS (إن أمكن)\n- الامتثال لـ HIPAA (إن أمكن)\n- ضوابط SOC 2\n- التوافق مع ISO 27001\n\n## 6. حماية البيانات\n- مخطط تصنيف البيانات\n- سياسات الاحتفاظ بالبيانات والتخلص منها\n- تقييمات تأثير الخصوصية\n- إجراءات الاستجابة لخرق البيانات\n\n## 7. أمان الطرف الثالث\n- إجراءات تقييم أمان البائع\n- إدارة مخاطر الطرف الثالث\n- أمان سلسلة التوريد\n\n## 8. مقاييس الأمان\n- مؤشرات الأداء الرئيسية ومقاييس الأمان\n- مقاييس إدارة الثغرات\n- مقاييس الاستجابة للحوادث\n- معدلات إكمال التدريب الأمني