@clear-capabilities/agentic-security-scanner 0.195.8 → 0.195.10

package/src/language/nix-script-taint.js

@@ -818,8 +818,20 @@ export function analyzeNixScripts(opts = {}) {
       }
       const envMap = collectEnvironment(site, ev);
 
+      const emitted = new Map();
       const emit = (rule, o) => {
         const R = RULES[rule];
+        // One finding per rule, script line and origin class: `rsync ${cfg.source} ${cfg.destination}` is one unescaped command line
+        // with two configuration interpolations, not two findings. Origins of different classes on one line (an attacker value next
+        // to a configuration value) stay separate findings, as NIX-003.AC04 requires; the later same-class interpolations join the first.
+        const kinds = [...new Set((o.origins || []).map((x) => x.kind).filter((k) => k !== 'constant'))].sort().join('+');
+        const dupKey = `${rule}|${siteFile}|${o.line}|${kinds}`;
+        const prior = emitted.get(dupKey);
+        if (prior) {
+          for (const x of o.origins || []) if (!prior.origins.some((y) => y.kind === x.kind && y.detail === x.detail)) prior.origins.push({ kind: x.kind, detail: x.detail });
+          prior.alsoAt = [...(prior.alsoAt || []), { column: o.column }];
+          return prior;
+        }
         const f = {
           id: `NIX-SCRIPT-${rule}-${siteFile}:${o.line}:${o.column}`,
           severity: o.severity, file: siteFile, line: o.line, column: o.column, vuln: o.vuln || R.vuln, cwe: R.cwe,
@@ -832,6 +844,7 @@ export function analyzeNixScripts(opts = {}) {
           ...(o.uncertainty ? { uncertainty: o.uncertainty } : {}), ...(o.extra || {}),
         };
         findings.push(f);
+        emitted.set(dupKey, f);
         return f;
       };
 

package/src/language/nix-secrets.js

@@ -275,6 +275,20 @@ class Walker {
       }
       return;
     }
+    // `passwordFile = pkgs.writeText "x" "literal"`: an option that expects a RUNTIME path to a secret is handed a file the evaluation
+    // writes into the store, with the secret's text written here. The option name says what the file holds; the writer says where it lands.
+    if (v && v.type === 'app' && PATHISH_TAIL.test(last) && SECRET_NAME.test(last.replace(PATHISH_TAIL, ''))) {
+      const { fn, args } = this.ev.flatten(v);
+      const c = this.ev.calleeOf(fn);
+      const idx = c.name ? WRITERS.get(c.name) : undefined;
+      const content = Number.isInteger(idx) && args[idx] ? unparen(args[idx]) : null;
+      if (content && content.type === 'string' && !content.interpolated && plausibleSecret(content.literal)) {
+        this.scriptKeys.add(`${file}:${content.start}`);
+        const option = full.filter(Boolean).join('.');
+        this.emit('nix-secret-plaintext', { ...this.at(file, bspan), file, severity: 'high', exposure: 'store', description: `${option} expects a runtime path to a secret but is given a file that ${c.name} writes into the world-readable Nix store, with the value written here as a literal (value redacted).`, source: { kind: 'literal', file, line: content.span ? content.span.startLine : (bspan ? bspan.startLine : 1) }, destination: { kind: 'store', label: `${c.name} file`, exposure: 'store' }, evidence: { ...redact(content.literal), option, writer: c.name }, originalLocation: bspan, chain: [hop(file, content.span, 'literal'), hop(file, bspan, `${c.name} into ${last}`)].filter(Boolean), origins: [mkOrigin('secret', `literal handed to ${c.name}`)] });
+        return;
+      }
+    }
     // evaluate the value for secret origins
     if (!v || v.type === 'attrset' || v.type === 'lambda' || v.type === 'list') return;
     if (this.isRuntimeRef(v, env)) { this.safe.push({ file, line: bspan && bspan.startLine, attr: full.filter(Boolean).join('.'), reason: 'runtime secret reference' }); return; }

package/src/language/nixos-hardening.js

@@ -339,8 +339,11 @@ export function analyzeNixosHardening(opts, extra = {}) {
     const sv = view(sudoCfg);
     if (sv.state === 'known' && typeof sv.value === 'string' && sudoState !== 'inactive' && sudoState !== 'unknown') {
       const text = stripNixHash(sv.value);
-      if (/NOPASSWD\s*:\s*ALL\b/.test(text)) {
-        addFinding('sudo-nopasswd-all', { anchor: anchorOf(sudoCfg), scope: 'security.sudo.extraConfig', state: sudoState === 'conditional' ? 'conditional' : 'active', uncertain: !sv.definite, evidence: [evidenceOf(sudoCfg)] });
+      // `Defaults !authenticate` (optionally scoped, `Defaults:%wheel !authenticate`) turns the password off for every rule the
+      // scope matches, which is the same grant as NOPASSWD: ALL written as a default
+      const noAuth = /^\s*Defaults(?:[:>@!]\S+)?\s+(?:[\w,]+\s*,\s*)?!authenticate\b/m.test(text);
+      if (/NOPASSWD\s*:\s*ALL\b/.test(text) || noAuth) {
+        addFinding('sudo-nopasswd-all', { anchor: anchorOf(sudoCfg), scope: 'security.sudo.extraConfig', state: sudoState === 'conditional' ? 'conditional' : 'active', uncertain: !sv.definite, evidence: [evidenceOf(sudoCfg)], ...(noAuth ? { extra: { directive: 'Defaults !authenticate' } } : {}) });
         entryPoints.push({ id: 'sudo-nopasswd-all', kind: 'sudo-nopasswd', state: sudoState === 'conditional' ? 'conditional' : 'active', privilege: 'root', evidence: [evidenceOf(sudoCfg)] });
       }
     }
@@ -525,6 +528,18 @@ export function analyzeNixosHardening(opts, extra = {}) {
     }
   }
 
+  // ── TLS private keys of other services (postfix `sslKey`, dovecot `sslServerKey`, httpd `sslServerKey`, a `keyFile`/`tlsKey`/`privateKeyFile`)
+  // The same rule as nginx above: a path literal or a store-writer call puts the key in the store; a string is a runtime path.
+  for (const o of cfg.options.filter((x) => x.namespace === 'nixos' && /^services\.(?!nginx\.)[^.]+\.(?:.*\.)?(?:sslKey|sslServerKey|sslCertificateKey|tlsKey|keyFile|privateKeyFile|tlsKeyFile)$/.test(x.path))) {
+    const svc = o.path.split('.')[1];
+    const svcState = stateOf(nixos(`services.${svc}.enable`));
+    if (svcState !== 'active' && svcState !== 'conditional') continue;
+    const st = svcState === 'conditional' ? 'conditional' : 'active';
+    const node = rhsNodeOf(o, opts.files);
+    if (node && (hasPathNode(node) || isStoreCopy(node))) addFinding('tls-key-in-store', { anchor: anchorOf(o), scope: o.path, state: st, uncertain: false, evidence: [evidenceOf(o)] });
+    else if (view(o).state === 'known' && typeof view(o).value === 'string') controls.push({ control: 'tls-key-runtime-path', option: o.path, applies: true });
+  }
+
   // ── firewall ──
   const listeningNow = inventory.filter((i) => i.state === 'active' && i.listening !== 'no' && i.listening !== 'localhost-only');
   if (fwOff === 'yes' || fwOff === 'conditional') {
@@ -635,7 +650,9 @@ export function analyzeNixosHardening(opts, extra = {}) {
       const r = sc(key);
       if (!r) continue;
       const v = view(r);
-      const items = v.state === 'known' ? asList(v.value) : v.state === 'conditional' ? asList(v.definiteItems) : [];
+      // systemd accepts the capability set as a list or as one space-separated string (`AmbientCapabilities = "CAP_SYS_ADMIN"`)
+      const raw = v.state === 'known' ? v.value : v.state === 'conditional' ? v.definiteItems : [];
+      const items = typeof raw === 'string' ? raw.split(/\s+/).filter(Boolean) : asList(raw);
       const bad = items.filter((c) => typeof c === 'string' && !c.startsWith('~') && DANGEROUS_CAPS.has(c));
       // a bounding set only limits; an ambient set grants, so only Ambient is a hard finding for non-root-looking services
       if (bad.length && (key === 'AmbientCapabilities' || identity.state !== 'root-default')) {

package/src/language/support-registry.js

@@ -243,6 +243,8 @@ export function evaluateSupport(language, input) {
   for (const [cap, req] of Object.entries(REQUIRES_TOOL[language] || {})) {
     const r = out.rows[cap];
     if (r && !tools[req.tool]) out.rows[cap] = { ...r, status: 'blocked', reasons: [`${req.tool} is not available on the measuring host: ${req.why}`, ...r.reasons] };
+    // a GHC other than the recorded toolchain compiles the fixtures against an empty package set: not a verdict on the engine
+    else if (r && req.tool === 'ghc' && tools.ghcMatchesRecorded === false && r.status !== 'supported') out.rows[cap] = { ...r, status: 'blocked', reasons: [`ghc ${tools.ghcVersion} on the measuring host is not the recorded toolchain (${tools.ghcRecorded}); the criterion that needs it could not be judged`, ...r.reasons] };
   }
   const rows = Object.values(out.rows);
   out.summary = { required: rows.length, supported: rows.filter((r) => r.status === 'supported').length, notSupported: rows.filter((r) => r.status !== 'supported').map((r) => `${r.capability}:${r.status}`), dataOk: dataOk.ok };