@clear-capabilities/agentic-security-scanner 0.144.0 → 0.147.0

package/dist/6944.index.js

@@ -0,0 +1,130 @@
+export const id = 6944;
+export const ids = [6944];
+export const modules = {
+
+/***/ 6944:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   HO: () => (/* binding */ isValidHost),
+/* harmony export */   SK: () => (/* binding */ constantTimeEqual),
+/* harmony export */   Xv: () => (/* binding */ CSP_HEADER_VALUE),
+/* harmony export */   generateSessionToken: () => (/* binding */ generateSessionToken)
+/* harmony export */ });
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
+// security.js — Milestone 3, sub-project Server, increment 1.
+//
+// Security primitives for the `explore` loopback HTTP server: session-token
+// generation/comparison and Host-header validation (the T2 DNS-rebinding
+// defense — see docs/DATA_FLOW_EXPLORER_THREAT_MODEL.md). No node:http
+// usage here — this module is pure and independently unit-testable.
+
+
+
+/** 32 random bytes, hex-encoded (64 hex chars) — the per-session token. */
+function generateSessionToken() {
+  return node_crypto__WEBPACK_IMPORTED_MODULE_0__.randomBytes(32).toString('hex');
+}
+
+/**
+ * Constant-time string comparison. Wraps crypto.timingSafeEqual, which
+ * THROWS on unequal-length buffers — guarded here the same way
+ * posture/integrity.js's verifyLastScan guards its own HMAC comparison
+ * (`stored.length !== expected.length`), which this function mirrors as
+ * its template. Never throws; returns false on any malformed input.
+ */
+function constantTimeEqual(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') return false;
+  const bufA = Buffer.from(a, 'utf8');
+  const bufB = Buffer.from(b, 'utf8');
+  if (bufA.length !== bufB.length) return false;
+  try {
+    return node_crypto__WEBPACK_IMPORTED_MODULE_0__.timingSafeEqual(bufA, bufB);
+  } catch {
+    return false;
+  }
+}
+
+// Loopback hostnames this server ever legitimately answers to. Anything
+// else in a Host header is either a stray/misconfigured client or a
+// DNS-rebinding attempt from a hostile page — reject it (T2).
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);
+
+/**
+ * Validates a request's `Host` header against the port the server is
+ * actually listening on. Accepts only `127.0.0.1`/`localhost`/`::1`
+ * (`::1` written either bare or bracketed, `[::1]`), each carrying the
+ * expected port explicitly — this is the ENTIRE T2 (DNS rebinding)
+ * defense: a hostile page that points a fetch() at 127.0.0.1:<port> still
+ * sends the ATTACKER'S origin's Host header value (its own hostname), not
+ * "127.0.0.1", so this check rejects it regardless of same-origin policy
+ * quirks in any particular browser.
+ *
+ * A bare host with no port suffix is accepted ONLY when expectedPort is
+ * the default HTTP port (80) — browsers omit :80 for a default-port
+ * http:// request. In practice this server always listens on a
+ * non-default port, so that branch is effectively unreachable but is kept
+ * for RFC-correctness rather than special-cased away.
+ *
+ * @param {string|undefined} hostHeader
+ * @param {number} expectedPort
+ * @returns {boolean}
+ */
+function isValidHost(hostHeader, expectedPort) {
+  if (typeof hostHeader !== 'string' || hostHeader.length === 0) return false;
+  if (typeof expectedPort !== 'number' || !Number.isInteger(expectedPort) || expectedPort <= 0) return false;
+
+  const host = hostHeader.trim();
+  if (host.length !== hostHeader.length) return false; // reject leading/trailing whitespace outright
+  if (/\s/.test(host)) return false; // no embedded whitespace/control chars in a well-formed Host header
+
+  let hostname;
+  let port = null;
+
+  if (host.startsWith('[')) {
+    // Bracketed IPv6 literal form: [::1] or [::1]:port
+    const closeIdx = host.indexOf(']');
+    if (closeIdx === -1) return false;
+    hostname = host.slice(1, closeIdx); // strip brackets
+    const rest = host.slice(closeIdx + 1);
+    if (rest.length) {
+      if (!rest.startsWith(':')) return false;
+      const portStr = rest.slice(1);
+      if (!/^\d+$/.test(portStr)) return false;
+      port = Number(portStr);
+    }
+  } else {
+    const parts = host.split(':');
+    if (parts.length === 1) {
+      hostname = parts[0];
+    } else if (parts.length === 2) {
+      hostname = parts[0];
+      if (!/^\d+$/.test(parts[1])) return false;
+      port = Number(parts[1]);
+    } else {
+      // More than one colon with no brackets: either a malformed header or
+      // a bare (unbracketed) IPv6 literal, which is not valid Host syntax
+      // (RFC 7230 §5.4 requires brackets for an IPv6 literal). Reject.
+      return false;
+    }
+  }
+
+  hostname = hostname.toLowerCase();
+  if (!LOOPBACK_HOSTS.has(hostname)) return false;
+
+  if (port === null) return expectedPort === 80;
+  return port === expectedPort;
+}
+
+// This server serves JSON only in this increment (no HTML, no inline
+// script/style, no static assets) — `frontend/`'s own static assets are a
+// later increment's (Wire's) job, not S1's. `default-src 'none'` is
+// therefore the correct, maximally-restrictive policy: nothing this
+// server ever returns should load or execute ANY sub-resource. Revisit
+// only when a future increment starts serving HTML/JS itself.
+const CSP_HEADER_VALUE = "default-src 'none'; frame-ancestors 'none'";
+
+
+/***/ })
+
+};

package/dist/{178.index.js → 7178.index.js}

@@ -1,5 +1,5 @@
-export const id = 178;
-export const ids = [178];
+export const id = 7178;
+export const ids = [7178];
 export const modules = {
 
 /***/ 7178:
@@ -13,7 +13,8 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(7087);
+/* harmony import */ var _util_git_hardening_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8844);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(9753);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:
@@ -36,10 +37,14 @@ export const modules = {
 
 
 
+
 const MAX_FILES_PER_SCAN = 5000;
 
+// `root` is the scan target's repository, not this project's own trusted
+// checkout — hardened per FR-PROV-024 / the second Finding Provenance PRD
+// audit (same exposure class as provenance/git-evidence.js's `_run`).
 function _git(root, args) {
-  const r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)('git', args, { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  const r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)('git', (0,_util_git_hardening_js__WEBPACK_IMPORTED_MODULE_3__/* .hardenGitArgs */ .Ax)(args), { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, env: (0,_util_git_hardening_js__WEBPACK_IMPORTED_MODULE_3__/* .hardenGitEnv */ .Si)() });
   return { ok: r.status === 0, stdout: r.stdout || '', stderr: r.stderr || '' };
 }
 
@@ -99,7 +104,10 @@ function _listFilesAtRef(root, ref) {
 }
 
 function _readFileAtRef(root, ref, file) {
-  const r = _git(root, ['show', `${ref}:${file}`]);
+  // `--no-textconv`: this blob-cat form of `show` was verified NOT
+  // reachable via a hostile textconv driver in current git — kept for
+  // defense-in-depth/uniformity, same as pr-delta.js's equivalent.
+  const r = _git(root, ['show', '--no-textconv', `${ref}:${file}`]);
   if (!r.ok) return null;
   return r.stdout;
 }
@@ -111,7 +119,13 @@ async function _scanAtRef(root, ref) {
     const c = _readFileAtRef(root, ref, f);
     if (c != null) fileContents[f] = c;
   }
-  const scan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_3__/* .runFullScan */ .wW)({ fileContents, scanRoot: root }, () => {});
+  // `provenance:false` — this is a HISTORICAL ref, not "the state of this repo
+  // right now". Two things must not happen here: resolving git provenance for
+  // findings that already are a point in history (pure waste), and letting
+  // updateLifecycle see this partial, historical finding set as the current
+  // one — it marks every open stableId NOT in the set as `remediated`, so one
+  // per-ref scan would mass-remediate the whole project's real open findings.
+  const scan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_4__/* .runFullScan */ .wW)({ fileContents, scanRoot: root, provenance: false }, () => {});
   return {
     ref,
     fileCount: Object.keys(fileContents).length,
@@ -193,8 +207,12 @@ async function runWhatIf(root, { overlays = [], remove = [] } = {}) {
     }
   }
   // Baseline (without overlays) for delta computation.
-  const baseScan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_3__/* .runFullScan */ .wW)({ fileContents: _baselineFor(fileContents, overlays, remove, root), scanRoot: root }, () => {});
-  const whatIfScan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_3__/* .runFullScan */ .wW)({ fileContents, scanRoot: root }, () => {});
+  // Both legs are hypothetical snapshots being differenced against each other,
+  // never the repo's current state — `provenance:false` for the same reason as
+  // _scanAtRef above (no provenance to resolve, and updateLifecycle must not
+  // treat either snapshot as "what is open right now").
+  const baseScan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_4__/* .runFullScan */ .wW)({ fileContents: _baselineFor(fileContents, overlays, remove, root), scanRoot: root, provenance: false }, () => {});
+  const whatIfScan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_4__/* .runFullScan */ .wW)({ fileContents, scanRoot: root, provenance: false }, () => {});
   const baseIds = new Set((baseScan.findings || []).map(f => f.stableId || f.id));
   const wIds = new Set((whatIfScan.findings || []).map(f => f.stableId || f.id));
   const introduced = (whatIfScan.findings || []).filter(f => !baseIds.has(f.stableId || f.id)).map(_compact);

package/dist/{227.index.js → 7227.index.js}

@@ -1,5 +1,5 @@
-export const id = 227;
-export const ids = [227];
+export const id = 7227;
+export const ids = [7227];
 export const modules = {
 
 /***/ 7227: