@clear-capabilities/agentic-security-scanner 0.195.7 → 0.195.9

package/src/language/haskell-web.js

@@ -20,7 +20,7 @@
 
 import { buildHaskellIR, lowerHandlerExpr, resolveName } from './haskell-ir.js';
 import { codeOfLine } from './haskell-comments.js';
-import { qualifyAmbiguous, HS_WEB_FRAMEWORKS, HS_WEB_MODEL_VERSION, modelStatus } from './haskell-models.js';
+import { qualifyAmbiguous, HS_WEB_FRAMEWORKS, HS_WEB_MODEL_VERSION, modelStatus, handlerFrameworkOf } from './haskell-models.js';
 
 export const HS_WEB_RULES_VERSION = 'haskell-web-rules/1';
 
@@ -38,11 +38,28 @@ const SCOTTY_METHODS = { get: 'GET', post: 'POST', put: 'PUT', delete: 'DELETE',
 const SENSITIVE_PREFIX = ['Database.', 'System.Process.', 'System.Directory.', 'Prelude.readFile', 'Prelude.writeFile', 'Prelude.appendFile', 'System.IO.', 'Network.HTTP.Simple.', 'Network.HTTP.Client.'];
 const PERSIST_FNS = new Set(['get', 'getBy', 'selectFirst', 'selectList', 'insert', 'insert_', 'update', 'updateWhere', 'delete', 'deleteWhere', 'replace', 'runDB', 'getJust', 'upsert']);
 const GUARD_PRIMITIVES = new Set(['Yesod.Core.requireAuthId', 'Yesod.Core.requireAuth', 'Yesod.Auth.requireAuthId', 'Yesod.Auth.requireAuth', 'Yesod.requireAuthId', 'Yesod.requireAuth', 'Network.Wai.Middleware.HttpAuth.basicAuth']);
-const CREDENTIAL_HEADER = /^(?:authorization|cookie|x-api-key|x-auth-token|x-access-token)$/i;
+// a header that carries the caller's credential: the standard two, and the custom names projects give a token or session header
+const CREDENTIAL_HEADER = /^(?:authorization|cookie|x-api-key|x-api-token|x-auth-token|x-auth|x-access-token|x-session(?:-(?:id|token|key))?|x-token|x-user-token|x-csrf-token|x-xsrf-token)$/i;
 const ADMIN_PATH = /(?:^|\/)(?:admin|internal|manage|superuser)(?:\/|$|:)/i;
+// an authentication endpoint (sign-in, registration, password reset, logout, an OAuth callback) is public by construction
+const AUTH_ENDPOINT_PATH = /(?:^|\/)(?:login|log-in|sign-?in|sign-?up|signup|register|registration|logout|log-out|sign-?out|password\/(?:reset|forgot)|reset-password|forgot-password|password-reset|oauth|callback|token|auth|authenticate|session)(?:\/|$|:|\.)/i;
+const AUTH_ENDPOINT_NAME = /(?:login|signin|signup|register|logout|signout|resetpassword|passwordreset|forgotpassword|authenticate)/i;
 const ROLE_CALL = /(?:^|\.)(?:isAdmin|hasRole|requireAdmin|checkRole|hasPermission|requireRole|requirePermission|isSuperuser)$/i;
 const OWNER_CALL = /(?:^|\.)(?:checkOwner|ownedBy|belongsTo|isOwner|requireOwner|authorizeOwner)$/i;
 const CSRF_CALL = /csrf|xsrf/i;
+// Evidence that an object HAS an owner, read from the data the handler touches, never from a route or file name: a column of the statement
+// it runs (`owner_id`, `tenant_id`, `created_by`) or a field of a record declared in the project (`invOwner`, `profileUser`). An id lookup that
+// selects such an object without consulting the owner (the column is not in the WHERE clause; the field is never read in the handler) is a
+// lookup the client steers, whether or not a principal was authenticated.
+const OWNER_COL = /\b(?:owner|tenant|account|customer|author|created_by|user)_?id\b|\bowner\b/i;
+const OWNER_FIELD = /(?:^|_)(?:owner|tenant|author|created_?by)(?:_?id)?$|(?:^|_)(?:user|account|customer)_?id$/i;
+const SQL_VERB = /\b(?:select|update|delete|insert)\b/i;
+// A container lookup by key (`M.lookup invoiceId m`, `HM.!? key`): not a sensitive operation (no database, file or process), but the step at which an
+// object is selected by a client-supplied id, so it counts for the ownership judgement only.
+const LOOKUP_CALL = /(?:^|\.)(?:lookup|!\?|!|find|findWithDefault|elemAt)$/;
+// A call that only builds the response or lays values out: a handler whose every call is one of these does nothing a client could abuse,
+// so a missing authentication check on it is a question about the route (its method and path), not a visible operation.
+const RESPONSE_ONLY = /^(?:Web\.Scotty(?:\.Trans)?\.(?:text|json|html|status|setHeader|addHeader|raw|redirect|finish|raise|raiseStatus|param|params|queryParam|captureParam|header|headers|body|jsonData)|Servant(?:\.Server)?\.(?:throwError|throwAll)|Yesod(?:\.Core)?\.(?:redirect|returnJson|defaultLayout|setTitle|sendResponse|notFound|permissionDenied|invalidArgs|requireJsonBody|lookupGetParam|lookupPostParam|toWidget|hamletToRepHtml)|Prelude\.(?:pure|return|fmap|map|concatMap|unlines|lines|show|length|not|maybe|either|fst|snd|const|id|flip|unwords|words|filter|zip|lookup|elem|notElem)|Control\.Monad\.(?:when|unless|void|forM|forM_|mapM|mapM_|guard)|Control\.Monad\.IO\.Class\.liftIO|Control\.Monad\.Trans\.Class\.lift|Data\.(?:Text|Text\.Lazy|Text\.Encoding|ByteString(?:\.Char8|\.Lazy|\.Lazy\.Char8)?|Aeson|Maybe|List|Map|Map\.Strict|Char|String|Functor|Foldable)\.[^.]+)$/;
 
 // ── AST helpers ──────────────────────────────────────────────────────────────
 function unparen(e) { while (e && e.t === 'paren') e = e.e; return e; }
@@ -360,9 +377,14 @@ function handlerFacts(ctx, fn, opts = {}) {
   for (const a of assigns) if (a.source.kind === 'call' && isGuardCall(a.source)) principals.add(a.target);
   // ids read from the request
   const idVars = new Set();
+  const SCOTTY_PARAM = /^Web\.Scotty(?:\.Trans)?\.(?:param|captureParam|queryParam|pathParam)$/;
+  // `docId <- param "id" :: ActionM Int` lowers to a source temporary (`$src0 <- param "id"`) and a number whose `hs.inner` names that temporary
+  const paramReads = new Map();
+  for (const a of assigns) if (a.source.kind === 'call' && SCOTTY_PARAM.test(a.source.callee)) paramReads.set(a.target, a.source);
   for (const a of assigns) {
-    const s = a.source;
-    if (s.kind === 'call' && /^Web\.Scotty(?:\.Trans)?\.(?:param|captureParam|queryParam|pathParam)$/.test(s.callee)) {
+    let s = a.source.kind === 'literal' && a.source.hs && a.source.hs.inner ? a.source.hs.inner : a.source;
+    if (s.kind === 'ident' && paramReads.has(s.name)) s = paramReads.get(s.name);
+    if (s.kind === 'call' && SCOTTY_PARAM.test(s.callee)) {
       const nm = headerArg(s);
       if (nm && /id$/i.test(nm)) idVars.add(a.target);
     }
@@ -388,6 +410,45 @@ function hasOwnership(ctx, facts) {
   return null;
 }
 
+// Owner evidence for the lookups of one handler (see OWNER_COL / OWNER_FIELD). Returns the first piece found, or null.
+function ownerEvidence(ctx, fn, facts, lookups) {
+  // 1. a statement literal handed to a lookup names an owner column outside its WHERE clause
+  for (const o of lookups) {
+    for (const a of o.call.args || []) for (const x of walkIr(a)) {
+      if (x.kind !== 'literal' || typeof x.value !== 'string' || !SQL_VERB.test(x.value)) continue;
+      const [head, ...tail] = x.value.split(/\bwhere\b/i);
+      const col = OWNER_COL.exec(head);
+      if (col && !OWNER_COL.test(tail.join(' '))) return { kind: 'owner-column-not-in-where', column: col[0], statement: x.value.slice(0, 120), line: o.line };
+    }
+  }
+  // 2. a record declared in the project has an owner field, and the handler never reads it
+  const recTypes = ctx.project && typeof ctx.project.recordTypes === 'function' ? ctx.project.recordTypes() : null;
+  if (!recTypes || !recTypes.size) return null;
+  const mentioned = new Set();
+  for (const n of Object.values(fn.cfg.nodes)) for (const root of exprsOfNode(n)) for (const e of walkIr(root)) {
+    if (e.kind === 'ident' && e.name) mentioned.add(e.name.replace(/^.*\./, ''));
+    if (e.kind === 'call' && typeof e.callee === 'string') mentioned.add(e.callee.replace(/^.*\./, ''));
+    if (e.kind === 'member' && e.prop) mentioned.add(String(e.prop));
+  }
+  for (const c of facts.conds) for (const e of walkIr(c)) { if (e.kind === 'ident' && e.name) mentioned.add(e.name.replace(/^.*\./, '')); if (e.kind === 'call' && typeof e.callee === 'string') mentioned.add(e.callee.replace(/^.*\./, '')); }
+  for (const [type, fields] of recTypes) {
+    const list = (Array.isArray(fields) ? fields : [...(fields || [])]).map((f) => (typeof f === 'string' ? f : f && f.name)).filter(Boolean);
+    const ownerField = list.find((f) => OWNER_FIELD.test(String(f).replace(/([a-z0-9])([A-Z])/g, '$1_$2')));
+    // the record must be the object the handler works with: it reads another of its fields (`invTotal inv`), or builds it. A record declared in the
+    // module that the handler never touches says nothing about what the lookup selected (a `Post` type beside a download handler).
+    const inPlay = list.some((f) => f !== ownerField && mentioned.has(f)) || mentioned.has(type);
+    if (ownerField && inPlay && !mentioned.has(ownerField)) return { kind: 'owner-field-unread', type, field: ownerField, line: lookups[0] ? lookups[0].line : fn.line };
+  }
+  return null;
+}
+
+// The first call of a handler that is neither a sensitive operation nor response plumbing: a project function, a parameter called as a function, a
+// console write. Its presence means the handler does something the engine cannot see into.
+function effectfulCall(facts) {
+  const o = facts.ordered.find((x) => !facts.isSensitive(x.call) && !RESPONSE_ONLY.test(x.call.callee || '') && !/^(?:>>=|>>|<\$>|<\*>|\$|\.|fmap|pure|return)$/.test(x.call.callee || ''));
+  return o ? { callee: o.call.callee, line: o.line } : null;
+}
+
 // ── structural order of an inline guard (WAI, Servant, Yesod) ──────────────────
 // For these frameworks the IR reports a call in tail position (the last statement, a case alternative) at the ENCLOSING line, so a line
 // number cannot say whether the rejection runs before the first sensitive operation. The handler's own syntax tree can: this walks it in
@@ -615,7 +676,13 @@ function analyzeRoute(ctx, route, handlerFn, opts) {
   R.sensitive = facts.sensIdx >= 0;
   // ownership / BOLA inputs
   R.ownership = hasOwnership(ctx, facts);
-  R.idLookups = facts.ordered.filter((o) => facts.isSensitive(o.call) && (o.call.args || []).some((a) => [...identsIr(a)].some((n) => facts.idVars.has(n))));
+  // a lookup's key sits in `hs.selector` (`M.lookup invoiceId m` keeps the key beside the container), so it is judged with the arguments
+  const operands = (c) => [...(c.args || []), ...(c.hs && c.hs.selector ? [c.hs.selector] : [])];
+  const byId = (c) => operands(c).some((a) => [...identsIr(a)].some((n) => facts.idVars.has(n)));
+  R.idLookups = facts.ordered.filter((o) => facts.isSensitive(o.call) && byId(o.call));
+  R.idSelections = facts.ordered.filter((o) => !facts.isSensitive(o.call) && LOOKUP_CALL.test(o.call.callee || '') && byId(o.call));
+  R.ownerEvidence = R.idLookups.length || R.idSelections.length ? ownerEvidence(ctx, handlerFn, facts, [...R.idLookups, ...R.idSelections]) : null;
+  R.effectful = facts.sensIdx >= 0 ? null : effectfulCall(facts);
 }
 
 // ── Scotty ─────────────────────────────────────────────────────────────────
@@ -762,7 +829,7 @@ function expandChain(chain, acc) {
   else if (name === 'ReqBody') a.order.push('body');
   else if (name === 'BasicAuth') { a.auth = { kind: 'basic', tag: 'BasicAuth' }; a.order.push('auth'); }
   else if (name === 'AuthProtect') { const nm = head.find((t) => t.t === 'str'); a.auth = { kind: 'token', tag: nm ? nm.v : 'AuthProtect' }; a.order.push('auth'); if (nm && /admin|role|perm/i.test(nm.v)) a.role = true; }
-  else if (name === 'Auth') { a.auth = { kind: 'token', tag: 'Auth' }; a.order.push('auth'); }
+  else if (name === 'Auth') { a.auth = { kind: 'token', tag: 'Auth' }; a.order.push('auth'); if (head.some((t) => t.t === 'con' && t.v !== 'Auth' && /admin|role|perm/i.test(t.v))) a.role = true; }   // `Auth '[JWT] Admin`: the principal type names the role, as an AuthProtect tag does
   else if (name && /^(?:Get|Post|Put|Delete|Patch)(?:NoContent)?$/.test(name)) return [finishServant(a, head)];
   return rest.length ? expandChain(rest, a) : [finishServant(a, head)];
 }
@@ -927,6 +994,27 @@ export function analyzeHaskellWeb(files, opts = {}) {
     }
   }
 
+  // Scotty handlers typed by the framework (`getDocument :: Connection -> ActionM ()`) that no `get`/`post` in an analysed file registers: the route
+  // table is elsewhere, so the method and path are unknown. They are analysed for object authorization only (the method decides nothing here):
+  // `UNKNOWN` is neither a write nor a privileged path, so no missing-authentication finding can come from one.
+  if (fw.has('scotty')) {
+    const registered = new Set();
+    for (const p of pending) if (p.framework === 'scotty' && p.handlerAst) { const sp = spine(p.handlerAst); const h = sp && sp.head ? sp.head : (p.handlerAst.t === 'var' ? p.handlerAst : null); if (h && h.name) registered.add(h.name); for (const n of walkAst(p.handlerAst)) if (n.t === 'var' && n.name) registered.add(n.name); }
+    for (const mod of ctx.modules) {
+      const mods = mod.imports.map((i) => i.module);
+      if (!mods.some((m) => /^Web\.Scotty(?:\.|$)/.test(m))) continue;
+      for (const fun of mod.groups.funs) {
+        const sig = mod.sigs.get(fun.name);
+        if (!sig || registered.has(fun.name)) continue;
+        const resultText = sig.resultText || String(sig.text || '').split('->').pop();
+        const h = handlerFrameworkOf(mods, resultText);
+        // a handler's result is unit (`ActionM ()`); a guard or helper returns a value (`requireUser :: ActionM User`) and is not a route
+        if (!h || h.framework !== 'scotty' || !/\(\s*\)\s*\)?\s*$/.test(resultText)) continue;
+        add({ framework: 'scotty', method: 'UNKNOWN', path: `<${fun.name}>`, file: mod.file, line: fun.line, mod, handlerName: fun.name, owner: `${mod.name}.${fun.name}`, conventional: true });
+      }
+    }
+  }
+
   // ── resolve handlers and analyse ─────────────────────────────────────────
   for (const p of pending) {
     const R = newRoute({ framework: p.framework, method: p.method, path: p.path, file: p.file, line: p.line, owner: p.owner });
@@ -967,11 +1055,14 @@ export function analyzeHaskellWeb(files, opts = {}) {
       const g = waiGlobals.find((w) => w.file === p.file && w.routers.has((p.routerFn || '').split('.').pop()));
       if (g) { o.globalAuth = g; if (g.role) o.globalRole = true; }
     }
+    // A handler written as a function may take closure arguments BEFORE the endpoint's values (`invoiceById store currentUser invoiceId` for
+    // `Capture "invoiceId" Int :> Get ..`): the endpoint's values are the LAST parameters, so they are paired from the end.
+    const servantOffset = p.framework === 'servant' ? Math.max(0, paramNames.length - (p.servant.order || []).length) : 0;
     if (p.framework === 'servant' && p.servant.auth) {
       o.typeAuth = p.servant.auth; if (p.servant.role) o.typeRole = true;
       o.principalVars = []; o.idVars = [];
       (p.servant.order || []).forEach((kind, i) => {
-        const nm = paramNames[i]; if (!nm) return;
+        const nm = paramNames[i + servantOffset]; if (!nm) return;
         if (kind === 'auth') o.principalVars.push(nm);
         else if (/^header:/.test(kind) && CREDENTIAL_HEADER.test(kind.slice(7))) (o.credentialParams ||= []).push({ name: nm, kind: /cookie/i.test(kind) ? 'cookie' : 'token' });
         else if (/^(?:capture|query):.*id$/i.test(kind)) o.idVars.push(nm);
@@ -979,7 +1070,7 @@ export function analyzeHaskellWeb(files, opts = {}) {
     } else if (p.framework === 'servant') {
       o.idVars = [];
       (p.servant.order || []).forEach((kind, i) => {
-        const nm = paramNames[i]; if (!nm) return;
+        const nm = paramNames[i + servantOffset]; if (!nm) return;
         if (/^(?:capture|query):.*id$/i.test(kind)) o.idVars.push(nm);
         else if (/^header:/.test(kind) && CREDENTIAL_HEADER.test(kind.slice(7))) (o.credentialParams ||= []).push({ name: nm, kind: /cookie/i.test(kind) ? 'cookie' : 'token' });
       });
@@ -1030,6 +1121,9 @@ function collectYesodAuthz(ctx) {
       const names = [];
       for (const n of walkAst(body)) if (n.t === 'var') names.push(n.name);
       if (names.some((n) => /^(?:requireAuthId|requireAuth|maybeAuthId|maybeAuth)$/.test(n)) || names.some((n) => { const q = ctx.qualify(mod, { name: n, qual: null }); return q && q.qid && guardSummary(ctx, ctx.fnFor(q)).auth; })) status = 'authenticated';
+      // A clause that can answer AuthenticationRequired or Unauthorized has a rejection path: it decides from something it read (a session
+      // key, a header), so the route is guarded. Only a clause that can ONLY answer Authorized is public.
+      else if (/\b(?:AuthenticationRequired|Unauthorized)\b/.test(text)) status = 'authenticated';
       else if (/"Authorized"/.test(text) || names.includes('Authorized')) status = 'public';
       if (names.some((n) => ROLE_CALL.test(n))) role = true;
       const rec = { status, role, file: mod.file, line: dcl.line || c.line };
@@ -1070,13 +1164,29 @@ function emitFindings(ctx, result, yesodAuthz) {
     if (!R.handler || R.handler.kind === 'unknown') continue;
     const writes = WRITE_METHODS.has(R.method) || R.method === 'ANY';
     const privileged = ADMIN_PATH.test(R.path) || /admin/i.test(R.handler.name || '');
+    // An authentication endpoint is public by construction: the request that signs in, registers or starts a password reset carries no
+    // session yet. Its own flaws (a weak hash, a predictable code) are other families' findings; a missing-auth finding on it is noise.
+    const authEndpoint = AUTH_ENDPOINT_PATH.test(R.path || '') || AUTH_ENDPOINT_NAME.test(R.handler.name || '');
     if (R.auth.status === 'late') emit('hs-route-late-auth', R, { detail: R.auth.evidence[0].order === 'unknown' ? `the rejection ${R.auth.evidence[0].callee} cannot be shown to run before the first sensitive operation (${R.auth.evidence[0].reason})` : `guard ${R.auth.evidence[0].callee} runs after the first sensitive operation`, evidence: R.auth.evidence });
-    else if (R.auth.status === 'none' && (writes || privileged) && R.sensitive !== false) {
-      if (!(R.framework === 'yesod' && R.yesodExplicitPublic && !writes)) emit('hs-route-missing-auth', R, { severity: writes ? 'high' : 'medium', detail: R.method === 'ANY' ? 'any method' : 'state-changing method' });
+    else if (R.auth.status === 'none' && (writes || privileged) && !authEndpoint && !(R.framework === 'yesod' && R.yesodExplicitPublic && !writes)) {
+      const how = R.method === 'ANY' ? 'any method' : writes ? 'state-changing method' : 'privileged path';
+      if (R.sensitive !== false) emit('hs-route-missing-auth', R, { severity: writes ? 'high' : 'medium', detail: how });
+      // No database, file or process call is visible, but the handler calls something the engine cannot see into (a project function, a
+      // parameter): on a PRIVILEGED path (admin, internal, manage) the route is privileged by its path, so the finding stands at a lower severity
+      // and says what it could not see. A plain write with no visible operation is NOT reported: on real projects that shape is an echo, an
+      // upload demo or a health check (23 such routes on four projects), and only the handler's own text claimed otherwise.
+      else if (privileged && R.effectful) emit('hs-route-missing-auth', R, { severity: 'medium', confidence: 0.55, detail: `${how}; no database, file or process operation is visible in the handler (it calls ${R.effectful.callee}), so the impact is judged from the path alone`, evidence: { unseen: R.effectful.callee, line: R.effectful.line } });
     }
     if ((R.auth.status === 'authenticated') && privileged && R.role.status !== 'present') emit('hs-route-bfla', R, { detail: 'authenticated but no role/permission check was found', evidence: { auth: R.auth.evidence } });
-    if (R.auth.status === 'authenticated' && R.idLookups && R.idLookups.length && !R.ownership) {
-      emit('hs-route-bola', R, { detail: 'the id from the request reaches a lookup with no ownership or tenant check', line: R.idLookups[0].line, evidence: { lookup: R.idLookups[0].call.callee } });
+    // Object authorization (BOLA). The lookups are the sensitive calls and the container selections the request id reaches.
+    const lookups = [...(R.idLookups || []), ...(R.idSelections || [])];
+    if (lookups.length && !R.ownership && R.auth.status !== 'late') {
+      const first = lookups[0];
+      if (R.auth.status === 'authenticated') emit('hs-route-bola', R, { detail: 'the id from the request reaches a lookup with no ownership or tenant check', line: first.line, evidence: { lookup: first.call.callee, ...(R.ownerEvidence ? { owner: R.ownerEvidence } : {}) } });
+      // Unauthenticated: a WRITE to an object the client selected is the client's to make only if it owns the object, and nothing checked; for a
+      // read, the finding needs evidence that the object has an owner at all (a public article by id is not an authorization matter).
+      else if (writes) emit('hs-route-bola', R, { detail: 'the id from the request selects the object that is modified, with no authenticated principal and no ownership check', line: first.line, evidence: { lookup: first.call.callee, ...(R.ownerEvidence ? { owner: R.ownerEvidence } : {}) } });
+      else if (R.ownerEvidence) emit('hs-route-bola', R, { detail: R.ownerEvidence.kind === 'owner-column-not-in-where' ? `the statement names an owner column (${R.ownerEvidence.column}) that its WHERE clause does not use: the object is selected by the client's id alone` : `the ${R.ownerEvidence.type} record has an owner field (${R.ownerEvidence.field}) the handler never reads: the object is selected by the client's id alone`, line: first.line, evidence: { lookup: first.call.callee, owner: R.ownerEvidence } });
     }
     const cookie = R.credentialKinds && (R.credentialKinds.has('cookie') || R.credentialKinds.has('session'));
     if (writes && R.auth.status === 'authenticated' && cookie && !R.csrf && R.framework !== 'yesod') emit('hs-route-csrf', R, { detail: 'cookie/session credential with no CSRF token check' });

package/src/language/nix-script-taint.js

@@ -818,8 +818,20 @@ export function analyzeNixScripts(opts = {}) {
       }
       const envMap = collectEnvironment(site, ev);
 
+      const emitted = new Map();
       const emit = (rule, o) => {
         const R = RULES[rule];
+        // One finding per rule, script line and origin class: `rsync ${cfg.source} ${cfg.destination}` is one unescaped command line
+        // with two configuration interpolations, not two findings. Origins of different classes on one line (an attacker value next
+        // to a configuration value) stay separate findings, as NIX-003.AC04 requires; the later same-class interpolations join the first.
+        const kinds = [...new Set((o.origins || []).map((x) => x.kind).filter((k) => k !== 'constant'))].sort().join('+');
+        const dupKey = `${rule}|${siteFile}|${o.line}|${kinds}`;
+        const prior = emitted.get(dupKey);
+        if (prior) {
+          for (const x of o.origins || []) if (!prior.origins.some((y) => y.kind === x.kind && y.detail === x.detail)) prior.origins.push({ kind: x.kind, detail: x.detail });
+          prior.alsoAt = [...(prior.alsoAt || []), { column: o.column }];
+          return prior;
+        }
         const f = {
           id: `NIX-SCRIPT-${rule}-${siteFile}:${o.line}:${o.column}`,
           severity: o.severity, file: siteFile, line: o.line, column: o.column, vuln: o.vuln || R.vuln, cwe: R.cwe,
@@ -832,6 +844,7 @@ export function analyzeNixScripts(opts = {}) {
           ...(o.uncertainty ? { uncertainty: o.uncertainty } : {}), ...(o.extra || {}),
         };
         findings.push(f);
+        emitted.set(dupKey, f);
         return f;
       };
 

package/src/language/nix-secrets.js

@@ -275,6 +275,20 @@ class Walker {
       }
       return;
     }
+    // `passwordFile = pkgs.writeText "x" "literal"`: an option that expects a RUNTIME path to a secret is handed a file the evaluation
+    // writes into the store, with the secret's text written here. The option name says what the file holds; the writer says where it lands.
+    if (v && v.type === 'app' && PATHISH_TAIL.test(last) && SECRET_NAME.test(last.replace(PATHISH_TAIL, ''))) {
+      const { fn, args } = this.ev.flatten(v);
+      const c = this.ev.calleeOf(fn);
+      const idx = c.name ? WRITERS.get(c.name) : undefined;
+      const content = Number.isInteger(idx) && args[idx] ? unparen(args[idx]) : null;
+      if (content && content.type === 'string' && !content.interpolated && plausibleSecret(content.literal)) {
+        this.scriptKeys.add(`${file}:${content.start}`);
+        const option = full.filter(Boolean).join('.');
+        this.emit('nix-secret-plaintext', { ...this.at(file, bspan), file, severity: 'high', exposure: 'store', description: `${option} expects a runtime path to a secret but is given a file that ${c.name} writes into the world-readable Nix store, with the value written here as a literal (value redacted).`, source: { kind: 'literal', file, line: content.span ? content.span.startLine : (bspan ? bspan.startLine : 1) }, destination: { kind: 'store', label: `${c.name} file`, exposure: 'store' }, evidence: { ...redact(content.literal), option, writer: c.name }, originalLocation: bspan, chain: [hop(file, content.span, 'literal'), hop(file, bspan, `${c.name} into ${last}`)].filter(Boolean), origins: [mkOrigin('secret', `literal handed to ${c.name}`)] });
+        return;
+      }
+    }
     // evaluate the value for secret origins
     if (!v || v.type === 'attrset' || v.type === 'lambda' || v.type === 'list') return;
     if (this.isRuntimeRef(v, env)) { this.safe.push({ file, line: bspan && bspan.startLine, attr: full.filter(Boolean).join('.'), reason: 'runtime secret reference' }); return; }

package/src/language/nixos-hardening.js

@@ -339,8 +339,11 @@ export function analyzeNixosHardening(opts, extra = {}) {
     const sv = view(sudoCfg);
     if (sv.state === 'known' && typeof sv.value === 'string' && sudoState !== 'inactive' && sudoState !== 'unknown') {
       const text = stripNixHash(sv.value);
-      if (/NOPASSWD\s*:\s*ALL\b/.test(text)) {
-        addFinding('sudo-nopasswd-all', { anchor: anchorOf(sudoCfg), scope: 'security.sudo.extraConfig', state: sudoState === 'conditional' ? 'conditional' : 'active', uncertain: !sv.definite, evidence: [evidenceOf(sudoCfg)] });
+      // `Defaults !authenticate` (optionally scoped, `Defaults:%wheel !authenticate`) turns the password off for every rule the
+      // scope matches, which is the same grant as NOPASSWD: ALL written as a default
+      const noAuth = /^\s*Defaults(?:[:>@!]\S+)?\s+(?:[\w,]+\s*,\s*)?!authenticate\b/m.test(text);
+      if (/NOPASSWD\s*:\s*ALL\b/.test(text) || noAuth) {
+        addFinding('sudo-nopasswd-all', { anchor: anchorOf(sudoCfg), scope: 'security.sudo.extraConfig', state: sudoState === 'conditional' ? 'conditional' : 'active', uncertain: !sv.definite, evidence: [evidenceOf(sudoCfg)], ...(noAuth ? { extra: { directive: 'Defaults !authenticate' } } : {}) });
         entryPoints.push({ id: 'sudo-nopasswd-all', kind: 'sudo-nopasswd', state: sudoState === 'conditional' ? 'conditional' : 'active', privilege: 'root', evidence: [evidenceOf(sudoCfg)] });
       }
     }
@@ -525,6 +528,18 @@ export function analyzeNixosHardening(opts, extra = {}) {
     }
   }
 
+  // ── TLS private keys of other services (postfix `sslKey`, dovecot `sslServerKey`, httpd `sslServerKey`, a `keyFile`/`tlsKey`/`privateKeyFile`)
+  // The same rule as nginx above: a path literal or a store-writer call puts the key in the store; a string is a runtime path.
+  for (const o of cfg.options.filter((x) => x.namespace === 'nixos' && /^services\.(?!nginx\.)[^.]+\.(?:.*\.)?(?:sslKey|sslServerKey|sslCertificateKey|tlsKey|keyFile|privateKeyFile|tlsKeyFile)$/.test(x.path))) {
+    const svc = o.path.split('.')[1];
+    const svcState = stateOf(nixos(`services.${svc}.enable`));
+    if (svcState !== 'active' && svcState !== 'conditional') continue;
+    const st = svcState === 'conditional' ? 'conditional' : 'active';
+    const node = rhsNodeOf(o, opts.files);
+    if (node && (hasPathNode(node) || isStoreCopy(node))) addFinding('tls-key-in-store', { anchor: anchorOf(o), scope: o.path, state: st, uncertain: false, evidence: [evidenceOf(o)] });
+    else if (view(o).state === 'known' && typeof view(o).value === 'string') controls.push({ control: 'tls-key-runtime-path', option: o.path, applies: true });
+  }
+
   // ── firewall ──
   const listeningNow = inventory.filter((i) => i.state === 'active' && i.listening !== 'no' && i.listening !== 'localhost-only');
   if (fwOff === 'yes' || fwOff === 'conditional') {
@@ -635,7 +650,9 @@ export function analyzeNixosHardening(opts, extra = {}) {
       const r = sc(key);
       if (!r) continue;
       const v = view(r);
-      const items = v.state === 'known' ? asList(v.value) : v.state === 'conditional' ? asList(v.definiteItems) : [];
+      // systemd accepts the capability set as a list or as one space-separated string (`AmbientCapabilities = "CAP_SYS_ADMIN"`)
+      const raw = v.state === 'known' ? v.value : v.state === 'conditional' ? v.definiteItems : [];
+      const items = typeof raw === 'string' ? raw.split(/\s+/).filter(Boolean) : asList(raw);
       const bad = items.filter((c) => typeof c === 'string' && !c.startsWith('~') && DANGEROUS_CAPS.has(c));
       // a bounding set only limits; an ambient set grants, so only Ambient is a hard finding for non-root-looking services
       if (bad.length && (key === 'AmbientCapabilities' || identity.state !== 'root-default')) {

package/src/lineage/source-registry.js

@@ -57,6 +57,7 @@ import { CATALOG } from '../dataflow/catalog.js';
 export const PROVENANCE_MAP = Object.freeze({
   'http-body':    Object.freeze({ category: 'http-body',             status: 'modeled', why: 'exact vocabulary match' }),
   'url-param':    Object.freeze({ category: 'http-query',            status: 'modeled', why: 'pure rename; the query string' }),
+  'upload':       Object.freeze({ category: 'http-upload',           status: 'modeled', why: 'a field of an uploaded file the client wrote into the multipart body (its name, content type or content); 0.195.8, Haskell wai-extra' }),
   'path-param':   Object.freeze({ category: 'http-route',            status: 'modeled', why: 'pure rename; a route/path segment' }),
   'header':       Object.freeze({ category: 'http-header',           status: 'modeled', why: 'pure rename' }),
   'cookie':       Object.freeze({ category: 'http-cookie',           status: 'modeled', why: 'pure rename' }),