@clear-capabilities/agentic-security-scanner 0.153.0 → 0.153.2

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-1e727ef20f7fd2c897af4598b51db75771cc0b75e07dd00a30bd840d34736b10  agentic-security.mjs
+dce16625abaef7a52aad4a8d0ca0402d22ea681c9a1479f7378401458e38d55e  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.153.0",
+  "version": "0.153.2",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -52,7 +52,7 @@
     "z3-solver": "^5.2.0"
   },
   "devDependencies": {
-    "@types/node": "^26.5.1",
+    "@types/node": "^26.6.4",
     "@vercel/ncc": "^0.45.0",
     "java-parser": "^3.0.1"
   },

package/src/engine.js

@@ -5700,19 +5700,29 @@ function _isLikelyUnsafeRegex(body){
   // the first required literal). redos-nfa.js is consulted as a second
   // opinion for the intrinsic case only, since it does not model the
   // polynomial one.
-  if (!_hasNestedQuantifier(body) && !_hasLeadingUnboundedQuantifier(body)) return false;
+  const ambiguousAlt = _hasOverlappingQuantifiedAlternation(body);
+  if (!_hasNestedQuantifier(body) && !_hasLeadingUnboundedQuantifier(body) && !ambiguousAlt) return false;
   // FIX-DISCRIMINATION (GHSA-29g2-3rmr-qm68): an anchored pattern with no
   // nested quantifier has neither failure mode — no start-offset multiplier,
   // no intrinsic catastrophe. safe-regex's star-height heuristic cannot see
   // anchoring at all and flagged the fixed revision identically to the
   // vulnerable one, so the finding survived its own fix.
-  if (_isAnchoredRegex(body) && !_hasNestedQuantifier(body)) return false;
+  if (_isAnchoredRegex(body) && !_hasNestedQuantifier(body) && !ambiguousAlt) return false;
   if (_safeRegex) {
     try { if (!_safeRegex(body)) return true; } catch (_) { /* fall through */ }
   }
-  // safe-regex's star-height analysis misses `(a|aa)*` — the alternatives
-  // overlap on their first character, which causes catastrophic backtracking
-  // even at star-height 1. Add a first-char overlap check on `(X|Y…)[*+]` shapes.
+  // safe-regex's star-height analysis misses `(a|aa)*` (see the helper below).
+  return ambiguousAlt;
+}
+/**
+ * `(X|Y…)[*+]` whose alternatives can start with the same character — `(a|aa)*`.
+ * The overlap makes the engine fork on every iteration, which is catastrophic
+ * backtracking even at star-height 1, and like a nested quantifier it is
+ * intrinsic: anchoring does not cure it. A third mechanism alongside nested
+ * quantifiers and scan-and-retry; the gate in _isLikelyUnsafeRegex must admit
+ * it, or `/^(a|aa)*$/` is rejected before this check is ever reached.
+ */
+function _hasOverlappingQuantifiedAlternation(body){
   const altQuantRe = /\((?:\?:)?([^()]+)\)[*+]/g;
   let am;
   while ((am = altQuantRe.exec(body)) !== null) {

package/src/sast/code-injection-multilang.js

@@ -123,6 +123,20 @@ function _lang(fp) {
   return null;
 }
 
+// True when `idx` sits inside a '…' or "…" literal on its own line. A sink name
+// quoted in a string (a rule library's `fix:`/`example:` text, a log message) is
+// prose, not a call. Backticks are deliberately not tracked: a template literal's
+// `${…}` holds real code, and erring toward "this is code" is the safe direction.
+function _insideQuote(code, idx) {
+  let q = null;
+  for (let i = code.lastIndexOf('\n', idx - 1) + 1; i < idx; i++) {
+    const c = code[i];
+    if (q) { if (c === '\\') i++; else if (c === q) q = null; }
+    else if (c === '\'' || c === '"') q = c;
+  }
+  return q !== null;
+}
+
 export function scanCodeInjectionMultilang(fp, raw) {
   if (!raw || raw.length > 500_000) return [];
   const lang = _lang(fp);
@@ -137,6 +151,7 @@ export function scanCodeInjectionMultilang(fp, raw) {
     const r = new RegExp(re.source, re.flags);
     let m;
     while ((m = r.exec(code))) {
+      if (_insideQuote(code, m.index + Math.max(0, m[0].search(/\w/)))) continue;
       const line = lineOf(code, m.index);
       const id = `code-injection-ml:${fp}:${line}:${key}`;
       if (seen.has(id)) continue;

package/src/sast/go-extended.js

@@ -5,6 +5,9 @@
 //   - exec.Command shell-form        exec.Command("sh", "-c", <var>) vs argv-form
 //   - http.Client custom-transport   http.Get(<var>) or http.NewRequest with
 //                                    user-controlled URL and no allowlist
+//   - package-level http.Get/Post    runs on http.DefaultClient, which has no
+//                                    timeout (DoS: one stalled upstream pins
+//                                    the goroutine and its connection forever)
 //
 // These patterns are narrow and complement the existing regex-based Go rules
 // (GORM raw SQL, source patterns for net/http, Echo, Chi, Gin).
@@ -38,6 +41,14 @@ const FINDINGS = [
     vuln: 'SSRF — http.Get/Post with variable URL',
     remediation: 'Allowlist the destination host before any net/http call. Use `net/url.Parse(target)` then check `parsed.Host` against an explicit allowlist. Reject RFC1918 (10/8, 172.16/12, 192.168/16) and the cloud metadata addresses (169.254.169.254, fd00:ec2::254).',
   },
+  {
+    id: 'go-http-no-timeout', severity: 'medium', cwe: 'CWE-400', family: 'dos-no-timeout',
+    // Only the package-level helpers. `client.Get(...)` is the caller's own
+    // client, which may well set Timeout, so it is deliberately not matched.
+    re: /\bhttp\.(?:Get|Post|Head|PostForm)\s*\(/g,
+    vuln: 'Missing Timeout on Outbound HTTP Request (DoS)',
+    remediation: 'http.Get/Post/Head/PostForm use http.DefaultClient, which never times out. Build a client instead: `c := &http.Client{Timeout: 10 * time.Second}` and call `c.Get(...)`, or pass a context with a deadline to http.NewRequestWithContext.',
+  },
   {
     id: 'go-newrequest-user-url', severity: 'high', cwe: 'CWE-918', family: 'ssrf',
     re: /\bhttp\.NewRequest(?:WithContext)?\s*\(\s*[^,]+,\s*(?!"[^"]*"\s*[,)])[a-zA-Z_]\w*/g,