@clear-capabilities/agentic-security-scanner 0.172.0 → 0.173.0

package/dist/4142.index.js

@@ -2,245 +2,6 @@ export const id = 4142;
 export const ids = [4142];
 export const modules = {
 
-/***/ 25517:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   $: () => (/* binding */ ORACLE_TYPES),
-/* harmony export */   U: () => (/* binding */ evaluateOracle)
-/* harmony export */ });
-// Deterministic security oracles. A model may SELECT an oracle and propose its parameters; it may never decide that the
-// oracle succeeded. Each oracle is a pure function of an Observation gathered by the TRUSTED runner (never by the model):
-//
-//   Observation = {
-//     exitCode, signal, timedOut, stdout, stderr,
-//     canaries: { <name>: { exists, digestBefore, digestAfter } }      // checked by the runner on disk, after the run
-//     callbacks: [{ nonce }]                                            // hits recorded by the runner's loopback listener
-//     nonce                                                             // per-run random token the target cannot predict
-//   }
-//
-// An oracle returns { fired, reason }. `fired:false` with `inconclusive:true` means the observation could not decide
-// (for example a timeout); it is never treated as "not exploitable".
-const ORACLE_TYPES = Object.freeze([
-  'crash_sanitizer', 'command_execution', 'unauthorized_http_access', 'unauthorized_db_read', 'database_mutation',
-  'filesystem_mutation', 'outbound_callback', 'authentication_bypass', 'arbitrary_assertion',
-]);
-
-const SANITIZER_RE = /(AddressSanitizer|UndefinedBehaviorSanitizer|stack-buffer-overflow|heap-buffer-overflow|SEGV on unknown address|stack smashing detected|buffer overflow detected)/i;
-const CRASH_SIGNALS = new Set(['SIGSEGV', 'SIGABRT', 'SIGBUS', 'SIGILL', 'SIGFPE']);
-
-const out = (fired, reason, extra = {}) => ({ fired, reason, ...extra });
-const inconclusive = (reason) => ({ fired: false, inconclusive: true, reason });
-const has = (obs, text) => typeof text === 'string' && text.length > 0 && `${obs.stdout || ''}${obs.stderr || ''}`.includes(text);
-
-const IMPL = {
-  crash_sanitizer(obs) {
-    if (SANITIZER_RE.test(obs.stderr || '')) return out(true, 'sanitizer or runtime memory-safety report on stderr');
-    if (obs.signal && CRASH_SIGNALS.has(obs.signal)) return out(true, `process terminated by ${obs.signal}`);
-    if (obs.timedOut) return inconclusive('run timed out before a crash could be judged');
-    return out(false, 'no crash signal and no sanitizer report');
-  },
-  // The injected payload asks the shell/interpreter to create a file named after the per-run nonce inside the
-  // watched canary directory. The target cannot create it unless attacker data reached a command.
-  command_execution(obs, p) {
-    const c = obs.canaries?.[p.canary || 'command'];
-    if (!c) return inconclusive('command canary was not armed by the runner');
-    if (c.exists && !c.existedBefore) return out(true, 'nonce-named canary file created by an injected command');
-    if (obs.timedOut) return inconclusive('run timed out before the canary could be judged');
-    return out(false, 'canary file not created');
-  },
-  // A secret planted behind authorization (never shown to the exploit client). Seeing the nonce-bearing secret in the
-  // client's output while the actor held no credential is the violation.
-  unauthorized_http_access(obs, p) {
-    const secret = obs.secrets?.[p.secret || 'http'];
-    if (!secret) return inconclusive('protected secret was not armed by the runner');
-    if (has(obs, secret)) return out(true, 'protected resource content returned to an unauthenticated actor');
-    if (obs.timedOut) return inconclusive('run timed out');
-    return out(false, 'protected content not observed');
-  },
-  unauthorized_db_read(obs, p) {
-    const secret = obs.secrets?.[p.secret || 'db'];
-    if (!secret) return inconclusive('database canary row was not armed by the runner');
-    if (has(obs, secret)) return out(true, 'row the actor may not read was returned');
-    if (obs.timedOut) return inconclusive('run timed out');
-    return out(false, 'canary row value not observed');
-  },
-  database_mutation(obs, p) {
-    const c = obs.canaries?.[p.canary || 'db'];
-    if (!c) return inconclusive('database canary was not armed by the runner');
-    if (c.digestBefore && c.digestAfter && c.digestBefore !== c.digestAfter) return out(true, 'protected database state changed');
-    if (obs.timedOut) return inconclusive('run timed out');
-    return out(false, 'protected database state unchanged');
-  },
-  filesystem_mutation(obs, p) {
-    const c = obs.canaries?.[p.canary || 'fs'];
-    if (!c) return inconclusive('filesystem canary was not armed by the runner');
-    if ((c.exists && !c.existedBefore) || (c.digestBefore && c.digestAfter && c.digestBefore !== c.digestAfter)) return out(true, 'file outside the permitted area was created or modified');
-    if (obs.timedOut) return inconclusive('run timed out');
-    return out(false, 'protected path unchanged');
-  },
-  outbound_callback(obs) {
-    if (obs.callbackUnavailable) return { fired: false, unsupported: true, reason: 'loopback callback listener is not available on this backend' };
-    const hit = (obs.callbacks || []).some((c) => c && c.nonce && c.nonce === obs.nonce);
-    if (hit) return out(true, 'nonce-bearing request reached the runner-controlled listener');
-    if (obs.timedOut) return inconclusive('run timed out');
-    return out(false, 'no nonce-bearing callback received');
-  },
-  authentication_bypass(obs, p) {
-    const secret = obs.secrets?.[p.secret || 'auth'];
-    if (!secret) return inconclusive('protected secret was not armed by the runner');
-    if (has(obs, secret)) return out(true, 'privileged content returned without valid credentials');
-    if (obs.timedOut) return inconclusive('run timed out');
-    return out(false, 'privileged content not observed without credentials');
-  },
-  // Declarative only: no code, no regex supplied by a model. Operators are a closed set.
-  arbitrary_assertion(obs, p) {
-    const a = p.assert;
-    if (!a || typeof a !== 'object') return inconclusive('assertion missing');
-    if (obs.timedOut) return inconclusive('run timed out');
-    if ('exitCode' in a) return a.exitCode === obs.exitCode ? out(true, `exit code was ${obs.exitCode}`) : out(false, `exit code was ${obs.exitCode}`);
-    if ('stdoutIncludes' in a) return has({ stdout: obs.stdout }, String(a.stdoutIncludes)) ? out(true, 'stdout contained the asserted text') : out(false, 'stdout did not contain the asserted text');
-    if ('stderrIncludes' in a) return has({ stderr: obs.stderr }, String(a.stderrIncludes)) ? out(true, 'stderr contained the asserted text') : out(false, 'stderr did not contain the asserted text');
-    return inconclusive('unsupported assertion operator');
-  },
-};
-
-function evaluateOracle(spec, observation) {
-  if (!spec || !ORACLE_TYPES.includes(spec.type)) return { fired: false, unsupported: true, reason: `unknown oracle type: ${String(spec?.type)}` };
-  if (!observation || typeof observation !== 'object') return inconclusive('no observation');
-  try { return IMPL[spec.type](observation, spec.params || {}); } catch (e) { return inconclusive(`oracle error: ${e.message}`); }
-}
-
-
-/***/ }),
-
-/***/ 37055:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   IW: () => (/* binding */ verifierView),
-/* harmony export */   V2: () => (/* binding */ substitute),
-/* harmony export */   Yj: () => (/* binding */ LANGUAGES),
-/* harmony export */   dw: () => (/* binding */ canonicalize),
-/* harmony export */   mC: () => (/* binding */ validateReproducer),
-/* harmony export */   sc: () => (/* binding */ sha256),
-/* harmony export */   we: () => (/* binding */ reproducerDigest)
-/* harmony export */ });
-/* unused harmony exports MAX_FILES, MAX_FILE_BYTES, isSafeRelPath */
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
-/* harmony import */ var _oracles_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(25517);
-// Serialized reproducer: the ONLY thing an independent verifier receives (besides revision, finding id and oracle).
-// It carries no reasoning, no model output and no prior results. Everything per-run (nonce, secrets, canary paths,
-// callback URL) is a placeholder substituted fresh by the trusted runner, so a replay can never reuse a stale value
-// and a target cannot learn the values in advance.
-
-
-
-const REPRODUCER_SCHEMA = 'agentic-security/reproducer';
-const REPRODUCER_VERSION = 1;
-const LANGUAGES = Object.freeze(['javascript', 'typescript', 'python', 'java', 'c', 'cpp', 'csharp']);
-const MAX_FILES = 64;
-const MAX_FILE_BYTES = 256 * 1024;
-const MAX_TOTAL_BYTES = 1024 * 1024;
-const PLACEHOLDER_RE = /\{\{([A-Z_]+)(?::([a-z0-9_-]{1,32}))?\}\}/g;
-const ALLOWED_PLACEHOLDERS = new Set(['NONCE', 'SECRET', 'CANARY', 'CALLBACK_URL', 'CALLBACK_PORT', 'ROOT', 'NODE', 'PYTHON', 'JAVA', 'JAVAC', 'CC']);
-
-function isSafeRelPath(rel) {
-  if (typeof rel !== 'string' || !rel || rel.length > 200) return false;
-  if (rel.startsWith('/') || rel.includes('\0') || rel.includes('\\')) return false;
-  if (['canary', 'tmp'].includes(rel.split('/')[0])) return false;
-  return rel.split('/').every((seg) => seg && seg !== '.' && seg !== '..' && !seg.startsWith('__oracle_'));
-}
-
-/** Canonical JSON (sorted keys) so identical reproducers hash identically regardless of key order. */
-function canonicalize(v) {
-  if (Array.isArray(v)) return `[${v.map(canonicalize).join(',')}]`;
-  if (v && typeof v === 'object') return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonicalize(v[k])}`).join(',')}}`;
-  return JSON.stringify(v);
-}
-const sha256 = (s) => (0,node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash)('sha256').update(s).digest('hex');
-const reproducerDigest = (r) => sha256(canonicalize(r));
-
-function validateReproducer(r) {
-  const errs = [];
-  if (!r || typeof r !== 'object' || Array.isArray(r)) return ['reproducer must be an object'];
-  if (r.schema !== REPRODUCER_SCHEMA) errs.push('unknown schema');
-  if (r.version !== REPRODUCER_VERSION) errs.push('unsupported reproducer version');
-  if (typeof r.findingId !== 'string' || !r.findingId || r.findingId.length > 200) errs.push('findingId required');
-  if (!LANGUAGES.includes(r.lang)) errs.push(`unsupported language: ${String(r.lang)}`);
-  if (!r.oracle || !_oracles_js__WEBPACK_IMPORTED_MODULE_1__/* .ORACLE_TYPES */ .$.includes(r.oracle.type)) errs.push(`unknown oracle: ${String(r.oracle?.type)}`);
-  const files = r.files ?? {};
-  if (typeof files !== 'object' || Array.isArray(files)) errs.push('files must be an object');
-  else {
-    const names = Object.keys(files);
-    if (names.length > MAX_FILES) errs.push(`file count must be at most ${MAX_FILES}`);
-    let total = 0;
-    for (const n of names) {
-      if (!isSafeRelPath(n)) { errs.push(`unsafe file path: ${n}`); continue; }
-      if (typeof files[n] !== 'string') { errs.push(`file ${n} must be a string`); continue; }
-      const b = Buffer.byteLength(files[n]);
-      total += b;
-      if (b > MAX_FILE_BYTES) errs.push(`file ${n} exceeds ${MAX_FILE_BYTES} bytes`);
-    }
-    if (total > MAX_TOTAL_BYTES) errs.push('reproducer exceeds total size limit');
-  }
-  const sourceNames = r.sources && typeof r.sources === 'object' && !Array.isArray(r.sources) ? Object.keys(r.sources) : [];
-  if (Object.keys(files).length + sourceNames.length === 0) errs.push('reproducer must declare at least one file or source');
-  for (const key of ['build', 'run']) {
-    const a = r[key];
-    if (a == null && key === 'build') continue;
-    if (!Array.isArray(a) || !a.length || !a.every((x) => typeof x === 'string' && x.length < 2000 && !x.includes('\0'))) errs.push(`${key} must be a non-empty argv array of strings (no shell string)`);
-  }
-  for (const text of [...Object.values(files || {}), ...(r.build || []), ...(r.run || [])]) {
-    if (typeof text !== 'string') continue;
-    for (const m of text.matchAll(PLACEHOLDER_RE)) if (!ALLOWED_PLACEHOLDERS.has(m[1])) errs.push(`unknown placeholder {{${m[1]}}}`);
-  }
-  if (r.watch != null) {
-    if (typeof r.watch !== 'object' || Array.isArray(r.watch)) errs.push('watch must be an object');
-    else for (const [k, v] of Object.entries(r.watch)) if (!/^[a-z0-9_-]{1,32}$/.test(k) || !isSafeRelPath(v)) errs.push(`bad watch entry: ${k}`);
-  }
-  if (r.env != null) {
-    if (typeof r.env !== 'object' || Array.isArray(r.env)) errs.push('env must be an object');
-    else for (const [k, v] of Object.entries(r.env)) {
-      if (!/^[A-Z][A-Z0-9_]{0,63}$/.test(k)) errs.push(`bad env var name: ${k}`);
-      if (typeof v !== 'string' || v.length > 4096) errs.push(`env value for ${k} must be a short string`);
-    }
-  }
-  if (r.sources != null) {
-    if (typeof r.sources !== 'object' || Array.isArray(r.sources)) errs.push('sources must be an object');
-    else for (const [dest, src] of Object.entries(r.sources)) if (!isSafeRelPath(dest) || !isSafeRelPath(src)) errs.push(`bad sources entry: ${dest}`);
-  }
-  if (r.network != null && !['none', 'callback'].includes(r.network)) errs.push('network must be none or callback');
-  return errs;
-}
-
-/** The view handed to an independent verifier: exactly the reproducer, plus identifiers. Nothing else. */
-function verifierView({ revision, reproducer, findingId, oracle }) {
-  return Object.freeze({ revision: revision ?? null, findingId, oracle, reproducer: structuredClone(reproducer) });
-}
-
-function substitute(text, ctx) {
-  return text.replace(PLACEHOLDER_RE, (whole, name, arg) => {
-    switch (name) {
-      case 'NONCE': return ctx.nonce;
-      case 'SECRET': return ctx.secret(arg || 'default');
-      case 'CANARY': return ctx.canary(arg || 'default');
-      case 'CALLBACK_URL': return ctx.callbackUrl ?? whole;
-      case 'CALLBACK_PORT': return String(ctx.callbackPort ?? '');
-      case 'ROOT': return ctx.root;
-      case 'NODE': return ctx.tools.node;
-      case 'PYTHON': return ctx.tools.python ?? whole;
-      case 'JAVA': return ctx.tools.java ?? whole;
-      case 'JAVAC': return ctx.tools.javac ?? whole;
-      case 'CC': return ctx.tools.cc ?? whole;
-      default: return whole;
-    }
-  });
-}
-
-
-/***/ }),
-
 /***/ 12090:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {