@claude-flow/shared 3.0.0-alpha.7 → 3.0.0-alpha.8

package/.claude-flow/logs/headless/audit_1777379186972_h5un5x_result.log

@@ -0,0 +1,117 @@
+[2026-04-28T12:26:56.433Z] RESULT
+============================================================
+{
+  "success": true,
+  "output": "# Security Vulnerability Analysis Report\n\nI've analyzed the provided codebase and identified several security vulnerabilities. Here's my detailed assessment:\n\n```json\n{\n  \"vulnerabilities\": [\n    {\n      \"severity\": \"high\",\n      \"file\": \"src/core/config/loader.ts\",\n      \"line\": 47,\n      \"description\": \"Unsafe JSON parsing without size limits. loadJsonConfig() reads files without validating content length, making it vulnerable to denial-of-service attacks via large config files. Could also be exploited by path traversal if config paths are user-controlled.\",\n      \"cwe\": \"CWE-400: Uncontrolled Resource Consumption\"\n    },\n    {\n      \"severity\": \"high\",\n      \"file\": \"src/core/config/loader.ts\",\n      \"line\": 73,\n      \"description\": \"Environment variable used in path construction without validation. process.env.HOME could be manipulated to read configs from unintended locations. No symlink attack prevention.\",\n      \"cwe\": \"CWE-426: Untrusted Search Path\"\n    },\n    {\n      \"severity\": \"high\",\n      \"file\": \"src/core/config/loader.ts\",\n      \"line\": 90,\n      \"description\": \"Integer overflow risk: process.env.CLAUDE_FLOW_MAX_AGENTS and CLAUDE_FLOW_MCP_PORT are parsed without bounds checking. No validation that values are within safe ranges.\",\n      \"cwe\": \"CWE-190: Integer Overflow or Wraparound\"\n    },\n    {\n      \"severity\": \"medium\",\n      \"file\": \"src/utils/secure-logger.js\",\n      \"line\": 45,\n      \"description\": \"Regex-based redaction is insufficient. Pattern `/[a-zA-Z0-9+/]{40,}={0,2}/g` for detecting base64 keys may match legitimate content and cause false positives/negatives. Legitimate base64 strings could be incorrectly redacted.\",\n      \"cwe\": \"CWE-1104: Use of Unmaintained Third Party Components\"\n    },\n    {\n      \"severity\": \"medium\",\n      \"file\": \"src/utils/secure-logger.js\",\n      \"line\": 64,\n      \"description\": \"Missing circular reference handling in sanitizeObject(). Recursive object sanitization without cycle detection could cause stack overflow on circular data structures.\",\n      \"cwe\": \"CWE-674: Uncontrolled Recursion\"\n    },\n    {\n      \"severity\": \"medium\",\n      \"file\": \"src/core/event-bus.ts\",\n      \"line\": 90,\n      \"description\": \"No input validation on event payloads. Events are dispatched with arbitrary payloads without type checking or sanitization. Could allow injection attacks through event data.\",\n      \"cwe\": \"CWE-20: Improper Input Validation\"\n    },\n    {\n      \"severity\": \"medium\",\n      \"file\": \"src/core/event-bus.ts\",\n      \"line\": 110,\n      \"description\": \"Async error handling doesn't prevent further event processing. Errors in async event handlers are logged but don't propagate, potentially hiding security issues.\",\n      \"cwe\": \"CWE-248: Uncaught Exception\"\n    },\n    {\n      \"severity\": \"medium\",\n      \"file\": \"src/core/interfaces/memory.interface.ts\",\n      \"line\": 15,\n      \"description\": \"Arbitrary value storage without encryption. IMemoryEntry stores values without encryption or sanitization. Sensitive data (tokens, passwords) could be exposed if memory backend is compromised.\",\n      \"cwe\": \"CWE-312: Cleartext Storage of Sensitive Information\"\n    },\n    {\n      \"severity\": \"medium\",\n      \"file\": \"src/core/interfaces/task.interface.ts\",\n      \"line\": 25,\n      \"description\": \"Error objects stored directly without sanitization. Task errors could contain sensitive stack traces or system information even with secure logger present.\",\n      \"cwe\": \"CWE-209: Information Exposure Through an Error Message\"\n    },\n    {\n      \"severity\": \"low\",\n      \"file\": \"src/core/interfaces/agent.interface.ts\",\n      \"line\": 26,\n      \"description\": \"No field size limits on agent metadata. Arbitrary metadata objects could grow unbounded, causing memory exhaustion.\",\n      \"cwe\": \"CWE-400: Uncontrolled Resource Consumption\"\n    },\n    {\n      \"severity\": \"low\",\n      \"file\": \"src/core/config/loader.ts\",\n      \"line\": 88,\n      \"description\": \"No validation of topology string enum values. While Zod schemas validate, the direct assignment from environment variables could bypass schema validation if not properly integrated.\",\n      \"cwe\": \"CWE-116: Improper Encoding or Escaping of Output\"\n    },\n    {\n      \"severity\": \"low\",\n      \"file\": \"src/utils/secure-logger.js\",\n      \"line\": 72,\n      \"description\": \"Path sanitization regex may not cover all sensitive paths. Windows UNC paths and network locations are not handled.\",\n      \"cwe\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"\n    }\n  ],\n  \"riskScore\": 68,\n  \"recommendations\": [\n    \"Implement file size limits in loadJsonConfig() - maximum 1MB for config files, validate before parsing\",\n    \"Add path validation in ConfigLoader - use path.resolve() with validation against a whitelist of allowed directories, check for symlinks with fs.realpathSync()\",\n    \"Validate all environment variables at startup - use strict bounds checking (0 < CLAUDE_FLOW_MAX_AGENTS <= 1000, port 1024-65535)\",\n    \"Replace regex-based sanitization with dedicated security library (e.g., @snyk/protect) or use a whitelist approach for known sensitive patterns\",\n    \"Add WeakMap-based circular reference tracking to sanitizeObject() to prevent infinite recursion\",\n    \"Implement strict event payload validation - use TypeScript interfaces + runtime validation (Zod) for all event types\",\n    \"Add rate limiting to EventBus.emit() to prevent event flooding/DoS attacks\",\n    \"Encrypt sensitive data in memory - use crypto.subtle for in-memory encryption of password/token/secret fields\",\n    \"Sanitize error objects before storing in tasks - use secure-logger for all error handling\",\n    \"Add resource quotas - implement maximum sizes for metadata objects, task inputs/outputs (e.g., 10MB limit)\",\n    \"Validate UUID/ID formats with strict regex patterns to prevent injection\",\n    \"Update path sanitization regex to handle Windows UNC paths: `/^\\\\\\\\\\\\\\\\[^\\\\\\\\]+\\\\\\\\[^\\\\\\\\]+/`\",\n    \"Add comprehensive security audit logging - log all configuration loads, environment variable access, sensitive data sanitization events\",\n    \"Implement secrets scanning in pre-commit hooks to prevent accidental commits of API keys/credentials\"\n  ]\n}\n```\n\n## Key Findings Summary\n\n**Critical Areas:**\n- **Configuration Loading**: Lacks input validation and bounds checking\n- **Environment Variables**: Not sanitized or validated before use\n- **Data Sanitization**: Regex-based approach is brittle and insufficient\n- **Memory Storage**: No encryption for sensitive data\n\n**Recommendations Priority:**\n1. ⚠️ Implement strict file size and path validation in config loader\n2. ⚠️ Validate all environment variable inputs with bounds checking\n3. ⚠️ Add circular reference detection to prevent DoS via deep objects\n4. ⚠️ Encrypt sensitive data in memory backend\n\nThe codebase has good security-conscious design (secure logger, sanitization functions), but implementation gaps could lead to information disclosure and DoS vulnerabilities.\n",
+  "parsedOutput": {
+    "vulnerabilities": [
+      {
+        "severity": "high",
+        "file": "src/core/config/loader.ts",
+        "line": 47,
+        "description": "Unsafe JSON parsing without size limits. loadJsonConfig() reads files without validating content length, making it vulnerable to denial-of-service attacks via large config files. Could also be exploited by path traversal if config paths are user-controlled.",
+        "cwe": "CWE-400: Uncontrolled Resource Consumption"
+      },
+      {
+        "severity": "high",
+        "file": "src/core/config/loader.ts",
+        "line": 73,
+        "description": "Environment variable used in path construction without validation. process.env.HOME could be manipulated to read configs from unintended locations. No symlink attack prevention.",
+        "cwe": "CWE-426: Untrusted Search Path"
+      },
+      {
+        "severity": "high",
+        "file": "src/core/config/loader.ts",
+        "line": 90,
+        "description": "Integer overflow risk: process.env.CLAUDE_FLOW_MAX_AGENTS and CLAUDE_FLOW_MCP_PORT are parsed without bounds checking. No validation that values are within safe ranges.",
+        "cwe": "CWE-190: Integer Overflow or Wraparound"
+      },
+      {
+        "severity": "medium",
+        "file": "src/utils/secure-logger.js",
+        "line": 45,
+        "description": "Regex-based redaction is insufficient. Pattern `/[a-zA-Z0-9+/]{40,}={0,2}/g` for detecting base64 keys may match legitimate content and cause false positives/negatives. Legitimate base64 strings could be incorrectly redacted.",
+        "cwe": "CWE-1104: Use of Unmaintained Third Party Components"
+      },
+      {
+        "severity": "medium",
+        "file": "src/utils/secure-logger.js",
+        "line": 64,
+        "description": "Missing circular reference handling in sanitizeObject(). Recursive object sanitization without cycle detection could cause stack overflow on circular data structures.",
+        "cwe": "CWE-674: Uncontrolled Recursion"
+      },
+      {
+        "severity": "medium",
+        "file": "src/core/event-bus.ts",
+        "line": 90,
+        "description": "No input validation on event payloads. Events are dispatched with arbitrary payloads without type checking or sanitization. Could allow injection attacks through event data.",
+        "cwe": "CWE-20: Improper Input Validation"
+      },
+      {
+        "severity": "medium",
+        "file": "src/core/event-bus.ts",
+        "line": 110,
+        "description": "Async error handling doesn't prevent further event processing. Errors in async event handlers are logged but don't propagate, potentially hiding security issues.",
+        "cwe": "CWE-248: Uncaught Exception"
+      },
+      {
+        "severity": "medium",
+        "file": "src/core/interfaces/memory.interface.ts",
+        "line": 15,
+        "description": "Arbitrary value storage without encryption. IMemoryEntry stores values without encryption or sanitization. Sensitive data (tokens, passwords) could be exposed if memory backend is compromised.",
+        "cwe": "CWE-312: Cleartext Storage of Sensitive Information"
+      },
+      {
+        "severity": "medium",
+        "file": "src/core/interfaces/task.interface.ts",
+        "line": 25,
+        "description": "Error objects stored directly without sanitization. Task errors could contain sensitive stack traces or system information even with secure logger present.",
+        "cwe": "CWE-209: Information Exposure Through an Error Message"
+      },
+      {
+        "severity": "low",
+        "file": "src/core/interfaces/agent.interface.ts",
+        "line": 26,
+        "description": "No field size limits on agent metadata. Arbitrary metadata objects could grow unbounded, causing memory exhaustion.",
+        "cwe": "CWE-400: Uncontrolled Resource Consumption"
+      },
+      {
+        "severity": "low",
+        "file": "src/core/config/loader.ts",
+        "line": 88,
+        "description": "No validation of topology string enum values. While Zod schemas validate, the direct assignment from environment variables could bypass schema validation if not properly integrated.",
+        "cwe": "CWE-116: Improper Encoding or Escaping of Output"
+      },
+      {
+        "severity": "low",
+        "file": "src/utils/secure-logger.js",
+        "line": 72,
+        "description": "Path sanitization regex may not cover all sensitive paths. Windows UNC paths and network locations are not handled.",
+        "cwe": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+      }
+    ],
+    "riskScore": 68,
+    "recommendations": [
+      "Implement file size limits in loadJsonConfig() - maximum 1MB for config files, validate before parsing",
+      "Add path validation in ConfigLoader - use path.resolve() with validation against a whitelist of allowed directories, check for symlinks with fs.realpathSync()",
+      "Validate all environment variables at startup - use strict bounds checking (0 < CLAUDE_FLOW_MAX_AGENTS <= 1000, port 1024-65535)",
+      "Replace regex-based sanitization with dedicated security library (e.g., @snyk/protect) or use a whitelist approach for known sensitive patterns",
+      "Add WeakMap-based circular reference tracking to sanitizeObject() to prevent infinite recursion",
+      "Implement strict event payload validation - use TypeScript interfaces + runtime validation (Zod) for all event types",
+      "Add rate limiting to EventBus.emit() to prevent event flooding/DoS attacks",
+      "Encrypt sensitive data in memory - use crypto.subtle for in-memory encryption of password/token/secret fields",
+      "Sanitize error objects before storing in tasks - use secure-logger for all error handling",
+      "Add resource quotas - implement maximum sizes for metadata objects, task inputs/outputs (e.g., 10MB limit)",
+      "Validate UUID/ID formats with strict regex patterns to prevent injection",
+      "Update path sanitization regex to handle Windows UNC paths: `/^\\\\\\\\[^\\\\]+\\\\[^\\\\]+/`",
+      "Add comprehensive security audit logging - log all configuration loads, environment variable access, sensitive data sanitization events",
+      "Implement secrets scanning in pre-commit hooks to prevent accidental commits of API keys/credentials"
+    ]
+  },
+  "durationMs": 29461,
+  "model": "haiku",
+  "sandboxMode": "strict",
+  "workerType": "audit",
+  "timestamp": "2026-04-28T12:26:56.433Z",
+  "executionId": "audit_1777379186972_h5un5x"
+}