@claude-flow/shared 3.0.0-alpha.7 → 3.0.0-alpha.8

package/.claude-flow/logs/headless/audit_1777380440097_621y8m_result.log

@@ -0,0 +1,75 @@
+[2026-04-28T12:47:54.421Z] RESULT
+============================================================
+{
+  "success": true,
+  "output": "```json\n{\n  \"vulnerabilities\": [\n    {\n      \"severity\": \"medium\",\n      \"file\": \"src/core/config/loader.ts\",\n      \"line\": 68,\n      \"description\": \"Environment variable MCP_PORT parsed without bounds validation. parseInt(process.env.CLAUDE_FLOW_MCP_PORT, 10) could result in NaN or invalid port number (0-65535). No range validation present.\"\n    },\n    {\n      \"severity\": \"medium\",\n      \"file\": \"src/core/config/loader.ts\",\n      \"line\": 48,\n      \"description\": \"Environment variable MAX_AGENTS parsed without bounds validation. Missing range check allows invalid values (negative numbers, zero, or extremely large numbers). Should validate: 1 ≤ value ≤ 1000.\"\n    },\n    {\n      \"severity\": \"medium\",\n      \"file\": \"src/core/event-bus.ts\",\n      \"line\": 148,\n      \"description\": \"Error objects logged directly to console without sanitization. Event handlers pass unfiltered errors to console.error(), potentially exposing file paths, stack traces, and sensitive information. Should use SecureLogger.\"\n    },\n    {\n      \"severity\": \"medium\",\n      \"file\": \"src/core/event-bus.ts\",\n      \"line\": 137,\n      \"description\": \"Async handler errors logged to console without sanitization. Error object from rejected promise logged directly: `result.catch((error) => console.error(...))`. Uses same vector as line 148.\"\n    },\n    {\n      \"severity\": \"low\",\n      \"file\": \"src/utils/secure-logger.js\",\n      \"line\": 51,\n      \"description\": \"Base64 detection regex `/[a-zA-Z0-9+/]{40,}={0,2}/g` is overly broad and may fail to redact keys with different lengths or padding. Attackers could obfuscate secrets as 39-char strings to bypass redaction.\"\n    },\n    {\n      \"severity\": \"low\",\n      \"file\": \"src/core/config/schema.ts\",\n      \"line\": 145,\n      \"description\": \"Redis password field has no maximum length constraint. Extremely long password strings (>10MB) could cause memory exhaustion or parsing delays. Should add: `z.string().max(512).optional()`\"\n    },\n    {\n      \"severity\": \"low\",\n      \"file\": \"src/core/config/loader.ts\",\n      \"line\": 35,\n      \"description\": \"JSON config file loaded with JSON.parse() without size limit. Malicious config files can cause ReDoS or memory exhaustion. Should validate file size before parsing (recommend <5MB limit).\"\n    },\n    {\n      \"severity\": \"low\",\n      \"file\": \"src/core/config/schema.ts\",\n      \"line\": 110,\n      \"description\": \"Orchestrator session.dataDir accepts any string path. No validation that path is within expected directories. Could allow writing session data outside intended location if configurable.\"\n    }\n  ],\n  \"riskScore\": 38,\n  \"recommendations\": [\n    \"ADD BOUNDS VALIDATION: Validate all environment variable integers with min/max checks. Use helper: `function validatePort(val) { const p = parseInt(val, 10); if (p < 1 || p > 65535) throw new Error('Invalid port'); return p; }`\",\n    \"IMPLEMENT ERROR SANITIZATION: Replace all console.error() calls in event-bus.ts with SecureLogger.error(). Create logger instance in EventBus constructor.\",\n    \"FIX ENVIRONMENT PARSING: Wrap parseInt() in try/catch or use Number.isInteger() validation. Example: `const port = Number(env); if (!Number.isInteger(port) || port < 1) throw new Error('Invalid port');`\",\n    \"STRENGTHEN REGEX REDACTION: Use length-agnostic patterns. Add specific patterns for: API keys (alphanumeric >32 chars), JWTs (3-part base64), SSH keys (-----BEGIN-type headers).\",\n    \"ADD FILE SIZE LIMITS: In loadJsonConfig(), check file size before parsing: `if (stat.size > 5_000_000) throw new Error('Config too large');`\",\n    \"VALIDATE DIRECTORY PATHS: In ConfigLoader, use path.resolve() + path.relative() to ensure configurable paths don't escape root: `if (relative.startsWith('..')) throw new Error('Invalid path');`\",\n    \"ADD STRING LENGTH CONSTRAINTS: In schema.ts, add `.max()` validators to all string fields in redis config (password, host: max 256, etc).\",\n    \"CREATE ERROR HANDLER POLICY: Define allowed error properties in event handlers to prevent sensitive data leakage. Only log: type, code, message. Redact: stack, file paths, values.\"\n  ]\n}\n```\n\n**Summary**: The codebase has solid security foundations with input validation via Zod schemas and a secure logger utility. However, three medium-severity gaps exist: (1) environment variables bypass validation bounds, (2) event error logging bypasses the secure logger, and (3) missing file size limits on JSON config loading. The low-severity findings are regex overbreadth and missing string constraints. **Risk is manageable** — fix the medium issues (30 min) and add validation helpers as shown above.\n",
+  "parsedOutput": {
+    "vulnerabilities": [
+      {
+        "severity": "medium",
+        "file": "src/core/config/loader.ts",
+        "line": 68,
+        "description": "Environment variable MCP_PORT parsed without bounds validation. parseInt(process.env.CLAUDE_FLOW_MCP_PORT, 10) could result in NaN or invalid port number (0-65535). No range validation present."
+      },
+      {
+        "severity": "medium",
+        "file": "src/core/config/loader.ts",
+        "line": 48,
+        "description": "Environment variable MAX_AGENTS parsed without bounds validation. Missing range check allows invalid values (negative numbers, zero, or extremely large numbers). Should validate: 1 ≤ value ≤ 1000."
+      },
+      {
+        "severity": "medium",
+        "file": "src/core/event-bus.ts",
+        "line": 148,
+        "description": "Error objects logged directly to console without sanitization. Event handlers pass unfiltered errors to console.error(), potentially exposing file paths, stack traces, and sensitive information. Should use SecureLogger."
+      },
+      {
+        "severity": "medium",
+        "file": "src/core/event-bus.ts",
+        "line": 137,
+        "description": "Async handler errors logged to console without sanitization. Error object from rejected promise logged directly: `result.catch((error) => console.error(...))`. Uses same vector as line 148."
+      },
+      {
+        "severity": "low",
+        "file": "src/utils/secure-logger.js",
+        "line": 51,
+        "description": "Base64 detection regex `/[a-zA-Z0-9+/]{40,}={0,2}/g` is overly broad and may fail to redact keys with different lengths or padding. Attackers could obfuscate secrets as 39-char strings to bypass redaction."
+      },
+      {
+        "severity": "low",
+        "file": "src/core/config/schema.ts",
+        "line": 145,
+        "description": "Redis password field has no maximum length constraint. Extremely long password strings (>10MB) could cause memory exhaustion or parsing delays. Should add: `z.string().max(512).optional()`"
+      },
+      {
+        "severity": "low",
+        "file": "src/core/config/loader.ts",
+        "line": 35,
+        "description": "JSON config file loaded with JSON.parse() without size limit. Malicious config files can cause ReDoS or memory exhaustion. Should validate file size before parsing (recommend <5MB limit)."
+      },
+      {
+        "severity": "low",
+        "file": "src/core/config/schema.ts",
+        "line": 110,
+        "description": "Orchestrator session.dataDir accepts any string path. No validation that path is within expected directories. Could allow writing session data outside intended location if configurable."
+      }
+    ],
+    "riskScore": 38,
+    "recommendations": [
+      "ADD BOUNDS VALIDATION: Validate all environment variable integers with min/max checks. Use helper: `function validatePort(val) { const p = parseInt(val, 10); if (p < 1 || p > 65535) throw new Error('Invalid port'); return p; }`",
+      "IMPLEMENT ERROR SANITIZATION: Replace all console.error() calls in event-bus.ts with SecureLogger.error(). Create logger instance in EventBus constructor.",
+      "FIX ENVIRONMENT PARSING: Wrap parseInt() in try/catch or use Number.isInteger() validation. Example: `const port = Number(env); if (!Number.isInteger(port) || port < 1) throw new Error('Invalid port');`",
+      "STRENGTHEN REGEX REDACTION: Use length-agnostic patterns. Add specific patterns for: API keys (alphanumeric >32 chars), JWTs (3-part base64), SSH keys (-----BEGIN-type headers).",
+      "ADD FILE SIZE LIMITS: In loadJsonConfig(), check file size before parsing: `if (stat.size > 5_000_000) throw new Error('Config too large');`",
+      "VALIDATE DIRECTORY PATHS: In ConfigLoader, use path.resolve() + path.relative() to ensure configurable paths don't escape root: `if (relative.startsWith('..')) throw new Error('Invalid path');`",
+      "ADD STRING LENGTH CONSTRAINTS: In schema.ts, add `.max()` validators to all string fields in redis config (password, host: max 256, etc).",
+      "CREATE ERROR HANDLER POLICY: Define allowed error properties in event handlers to prevent sensitive data leakage. Only log: type, code, message. Redact: stack, file paths, values."
+    ]
+  },
+  "durationMs": 34324,
+  "model": "haiku",
+  "sandboxMode": "strict",
+  "workerType": "audit",
+  "timestamp": "2026-04-28T12:47:54.421Z",
+  "executionId": "audit_1777380440097_621y8m"
+}