@cdxgen/cdxgen 13.0.0 → 13.1.0

package/lib/stages/pregen/envAudit.js

@@ -47,8 +47,44 @@ const RISKY_PRESENCE_VARS = [
 // SSH_AUTH_SOCK (ends with _SOCK) and __CF_USER_TEXT_ENCODING (ends with _ENCODING)
 // are NOT flagged as false positives.
 // `cred` is kept alongside `credential(?:s)?` to also catch short-form names like MY_CRED.
+// `session` must be followed by an id qualifier (SESSION_ID, SESSIONID, SESSION-ID):
+// a bare _SESSION suffix names a session/desktop type (DESKTOP_SESSION, GDM_SESSION),
+// not a secret-bearing session identifier.
 const CREDENTIAL_VAR_PATTERN =
-  /_(?:token|key|secret|pass(?:word)?|credential(?:s)?|cred|user|email|auth|session)$/i;
+  /_(?:token|key|secret|pass(?:word)?|credential(?:s)?|cred|user|email|auth|session[_-]?id)$/i;
+
+// OS/desktop-layer variables whose names match CREDENTIAL_VAR_PATTERN but whose
+// values are public session or identity identifiers, never secrets. Each entry
+// is set automatically by the operating system or desktop environment, so
+// flagging it would warn on nearly every desktop/developer machine:
+// - GNOME_DESKTOP_SESSION_ID: deprecated gnome-session marker, always the
+//   literal string "this-is-deprecated" (kept by GNOME ≤ 3.28 and RHEL 8).
+// - KDE_SESSION_ID: numeric KDE session identifier (legacy ksmserver-era KDE).
+// - SHELL_SESSION_ID: UUID assigned to each Konsole (KDE terminal) tab/session.
+// - TERM_SESSION_ID: window/tab/process indices plus a UUID, set by Apple
+//   Terminal (documented in /etc/zshrc_Apple_Terminal) and iTerm2.
+// - ITERM_SESSION_ID: iTerm2 per-pane identifier in the same format.
+// - XDG_SESSION_ID: numeric logind audit-session id set by pam_systemd on
+//   every systemd login.
+// - SUDO_USER / DOAS_USER: login name of the invoking user, set by sudo/doas.
+// - XDG_ACTIVATION_TOKEN: single-use Wayland xdg-activation focus token set
+//   by GNOME/GLib and KDE launchers; only grants a newly launched app the
+//   right to focus its own window.
+// Native Windows variables (USERNAME, SESSIONNAME, USERDOMAIN, …) use
+// non-underscored names and cannot match the pattern, so none appear here.
+// SSH_USER_AUTH is deliberately NOT exempted: sshd only sets it with the
+// non-default `ExposeAuthInfo yes` and it points at key-fingerprint data.
+const CREDENTIAL_VAR_EXCEPTIONS = new Set([
+  "GNOME_DESKTOP_SESSION_ID",
+  "KDE_SESSION_ID",
+  "SHELL_SESSION_ID",
+  "TERM_SESSION_ID",
+  "ITERM_SESSION_ID",
+  "XDG_SESSION_ID",
+  "SUDO_USER",
+  "DOAS_USER",
+  "XDG_ACTIVATION_TOKEN",
+]);
 
 // Proxy variables — NO_PROXY is a bypass-list and should not trigger a finding on its own.
 const PROXY_VARS = ["HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"];
@@ -283,7 +319,11 @@ export function auditEnvironment(env = process.env, options = {}) {
 
   // Credential exposure — detect any env var whose name follows a credential-naming convention.
   for (const [varName, varValue] of Object.entries(env)) {
-    if (varValue && CREDENTIAL_VAR_PATTERN.test(varName)) {
+    if (
+      varValue &&
+      CREDENTIAL_VAR_PATTERN.test(varName) &&
+      !CREDENTIAL_VAR_EXCEPTIONS.has(varName)
+    ) {
       recordEnvironmentRead(varName, { source: envSource });
       findings.push({
         type: "credential-exposure",