@clear-capabilities/agentic-security-scanner 0.195.8 → 0.195.9

package/src/language/haskell-trust.js

@@ -10,7 +10,11 @@
 //                         is lowered to `info`, never dropped
 //   api-contract          the value is a parameter of an exported function that nothing in the analysed code calls, and the function
 //                         hands it WHOLE (or as the root it appends fixed text to) to a path or command operation: a thin wrapper.
-//                         The caller chose what to read or run, and the wrapper has no fixed part to escape from. Lowered to `info`
+//                         The caller chose what to read or run, and the wrapper has no fixed part to escape from. Lowered to `info`.
+//                         Path operations joined this way since 0.195.9: `renderFile path = responseFile .. path` and
+//                         `store path = readFile (cs path)` were 2 of the 29 flagged path sites on the real-code sets and no true
+//                         positive had that shape; a parameter spliced UNDER a fixed directory (`"/srv/" ++ name`) is still kept,
+//                         because the function chose the directory and lets the caller leave it
 //   entry-parameter       a parameter of such a function used inside a larger value the function builds: its own construction, kept
 //   data-input            standard input or a file's content in a service or a library: data the program processes, kept
 //   unattributed          the engine recorded no origin: kept
@@ -30,10 +34,13 @@ const EXTERNAL = new Set(['http-body', 'url-param', 'path-param', 'header', 'coo
 const DATA = new Set(['stdin', 'file-read']);
 const WEAK_PARAM_LABEL = /\(caller-controlled\)$/;
 // CWE-918 is deliberately NOT a wrapper family: `fetch url = parseRequest url >>= httpNoBody` is pinned as a finding in
-// test/haskell/haskell-generalization.test.js (a URL the caller chooses is the SSRF shape of the development sets), the same way path
-// wrappers are kept. unseen-v4 labels that shape safe when the URL is configuration; that disagreement is recorded, not decided here.
-const WRAPPER_FAMILIES = new Set(['CWE-78', 'CWE-88']);
-const CONVERSIONS = /(?:^|\.)(?:pack|unpack|fromString|toString|show|encodeUtf8|decodeUtf8|toStrict|fromStrict|toText|unpackFS|fromText)$/;
+// test/haskell/haskell-generalization.test.js (a URL the caller chooses is the SSRF shape of the development sets). unseen-v4 labels
+// that shape safe when the URL is configuration; that disagreement is recorded, not decided here. CWE-22 joined the set in 0.195.9
+// (see the header): the synthetic development sets label `load name = readFile name` vulnerable, the real-code sets label every such
+// site a false positive, and the real code won; a parameter under a fixed directory is still `entry-parameter`.
+const WRAPPER_FAMILIES = new Set(['CWE-78', 'CWE-88', 'CWE-22']);
+// `cs`/`convertString` (string-conversions) and `toS` (protolude) change the type of a text value and nothing else
+const CONVERSIONS = /(?:^|\.)(?:pack|unpack|fromString|toString|show|encodeUtf8|decodeUtf8|toStrict|fromStrict|toText|unpackFS|fromText|cs|convertString|toS|toSL|toST)$/;
 const PATH_JOIN = /(?:^|\.)(?:<\/>|combine|joinPath|<\.>)$/;
 // list plumbing that only lays the parameters out as text (`unwords args`, `concatMap (' ':) args`): no fixed words are added
 const LIST_LAYOUT = /(?:^|\.)(?:unwords|unlines|intercalate|concatMap|concat|map|fmap)$/;
@@ -261,9 +268,14 @@ export function applyTrustBoundary(findings, perFile) {
     else if (roots.length && [...classes].every((c) => c === 'operator')) {
       verdict = 'operator-controlled';
       reason = 'only command-line arguments or environment variables supply the value; whoever starts the program chooses them, so no trust boundary is crossed';
-    } else if (roots.length && role === 'cli' && roots.every((r) => r.provenance === 'file-read' || OPERATOR.has(r.provenance))) {
+    } else if (roots.length && role === 'cli' && roots.every((r) => r.provenance === 'file-read' || OPERATOR.has(r.provenance) || (f.cwe === 'CWE-22' && r.provenance === 'stdin'))) {
+      // Standard input counts here for a PATH operation only: a command-line program reading a file name from its own standard input
+      // is the person at the keyboard naming a file (14 of the 29 flagged path sites on the real-code sets, every one a false positive).
+      // A command built from standard input stays reported (`getLine >>= callCommand`, pinned in test/haskell/haskell-trust-boundary.test.js).
       verdict = 'operator-controlled';
-      reason = 'the function belongs to a command-line program (reached from a main that imports no server framework) and the value comes from files the person running it pointed the program at, or from its arguments and environment; standard input is not covered by this rule';
+      reason = f.cwe === 'CWE-22' && roots.some((r) => r.provenance === 'stdin')
+        ? 'the function belongs to a command-line program (reached from a main that imports no server framework) and the file it works on is named by the person running it: on its standard input, in files it was pointed at, or in its arguments and environment'
+        : 'the function belongs to a command-line program (reached from a main that imports no server framework) and the value comes from files the person running it pointed the program at, or from its arguments and environment; standard input is covered by this rule only for a path operation';
     } else if (classes.has('data')) { verdict = 'data-input'; reason = 'standard input or file content supplies the value'; }
     else if (classes.has('weak-param')) {
       verdict = 'entry-parameter';

package/src/language/haskell-web.js

@@ -38,8 +38,12 @@ const SCOTTY_METHODS = { get: 'GET', post: 'POST', put: 'PUT', delete: 'DELETE',
 const SENSITIVE_PREFIX = ['Database.', 'System.Process.', 'System.Directory.', 'Prelude.readFile', 'Prelude.writeFile', 'Prelude.appendFile', 'System.IO.', 'Network.HTTP.Simple.', 'Network.HTTP.Client.'];
 const PERSIST_FNS = new Set(['get', 'getBy', 'selectFirst', 'selectList', 'insert', 'insert_', 'update', 'updateWhere', 'delete', 'deleteWhere', 'replace', 'runDB', 'getJust', 'upsert']);
 const GUARD_PRIMITIVES = new Set(['Yesod.Core.requireAuthId', 'Yesod.Core.requireAuth', 'Yesod.Auth.requireAuthId', 'Yesod.Auth.requireAuth', 'Yesod.requireAuthId', 'Yesod.requireAuth', 'Network.Wai.Middleware.HttpAuth.basicAuth']);
-const CREDENTIAL_HEADER = /^(?:authorization|cookie|x-api-key|x-auth-token|x-access-token)$/i;
+// a header that carries the caller's credential: the standard two, and the custom names projects give a token or session header
+const CREDENTIAL_HEADER = /^(?:authorization|cookie|x-api-key|x-api-token|x-auth-token|x-auth|x-access-token|x-session(?:-(?:id|token|key))?|x-token|x-user-token|x-csrf-token|x-xsrf-token)$/i;
 const ADMIN_PATH = /(?:^|\/)(?:admin|internal|manage|superuser)(?:\/|$|:)/i;
+// an authentication endpoint (sign-in, registration, password reset, logout, an OAuth callback) is public by construction
+const AUTH_ENDPOINT_PATH = /(?:^|\/)(?:login|log-in|sign-?in|sign-?up|signup|register|registration|logout|log-out|sign-?out|password\/(?:reset|forgot)|reset-password|forgot-password|password-reset|oauth|callback|token|auth|authenticate|session)(?:\/|$|:|\.)/i;
+const AUTH_ENDPOINT_NAME = /(?:login|signin|signup|register|logout|signout|resetpassword|passwordreset|forgotpassword|authenticate)/i;
 const ROLE_CALL = /(?:^|\.)(?:isAdmin|hasRole|requireAdmin|checkRole|hasPermission|requireRole|requirePermission|isSuperuser)$/i;
 const OWNER_CALL = /(?:^|\.)(?:checkOwner|ownedBy|belongsTo|isOwner|requireOwner|authorizeOwner)$/i;
 const CSRF_CALL = /csrf|xsrf/i;
@@ -1160,8 +1164,11 @@ function emitFindings(ctx, result, yesodAuthz) {
     if (!R.handler || R.handler.kind === 'unknown') continue;
     const writes = WRITE_METHODS.has(R.method) || R.method === 'ANY';
     const privileged = ADMIN_PATH.test(R.path) || /admin/i.test(R.handler.name || '');
+    // An authentication endpoint is public by construction: the request that signs in, registers or starts a password reset carries no
+    // session yet. Its own flaws (a weak hash, a predictable code) are other families' findings; a missing-auth finding on it is noise.
+    const authEndpoint = AUTH_ENDPOINT_PATH.test(R.path || '') || AUTH_ENDPOINT_NAME.test(R.handler.name || '');
     if (R.auth.status === 'late') emit('hs-route-late-auth', R, { detail: R.auth.evidence[0].order === 'unknown' ? `the rejection ${R.auth.evidence[0].callee} cannot be shown to run before the first sensitive operation (${R.auth.evidence[0].reason})` : `guard ${R.auth.evidence[0].callee} runs after the first sensitive operation`, evidence: R.auth.evidence });
-    else if (R.auth.status === 'none' && (writes || privileged) && !(R.framework === 'yesod' && R.yesodExplicitPublic && !writes)) {
+    else if (R.auth.status === 'none' && (writes || privileged) && !authEndpoint && !(R.framework === 'yesod' && R.yesodExplicitPublic && !writes)) {
       const how = R.method === 'ANY' ? 'any method' : writes ? 'state-changing method' : 'privileged path';
       if (R.sensitive !== false) emit('hs-route-missing-auth', R, { severity: writes ? 'high' : 'medium', detail: how });
       // No database, file or process call is visible, but the handler calls something the engine cannot see into (a project function, a

package/src/language/nix-script-taint.js

@@ -818,8 +818,20 @@ export function analyzeNixScripts(opts = {}) {
       }
       const envMap = collectEnvironment(site, ev);
 
+      const emitted = new Map();
       const emit = (rule, o) => {
         const R = RULES[rule];
+        // One finding per rule, script line and origin class: `rsync ${cfg.source} ${cfg.destination}` is one unescaped command line
+        // with two configuration interpolations, not two findings. Origins of different classes on one line (an attacker value next
+        // to a configuration value) stay separate findings, as NIX-003.AC04 requires; the later same-class interpolations join the first.
+        const kinds = [...new Set((o.origins || []).map((x) => x.kind).filter((k) => k !== 'constant'))].sort().join('+');
+        const dupKey = `${rule}|${siteFile}|${o.line}|${kinds}`;
+        const prior = emitted.get(dupKey);
+        if (prior) {
+          for (const x of o.origins || []) if (!prior.origins.some((y) => y.kind === x.kind && y.detail === x.detail)) prior.origins.push({ kind: x.kind, detail: x.detail });
+          prior.alsoAt = [...(prior.alsoAt || []), { column: o.column }];
+          return prior;
+        }
         const f = {
           id: `NIX-SCRIPT-${rule}-${siteFile}:${o.line}:${o.column}`,
           severity: o.severity, file: siteFile, line: o.line, column: o.column, vuln: o.vuln || R.vuln, cwe: R.cwe,
@@ -832,6 +844,7 @@ export function analyzeNixScripts(opts = {}) {
           ...(o.uncertainty ? { uncertainty: o.uncertainty } : {}), ...(o.extra || {}),
         };
         findings.push(f);
+        emitted.set(dupKey, f);
         return f;
       };
 

package/src/language/nix-secrets.js

@@ -275,6 +275,20 @@ class Walker {
       }
       return;
     }
+    // `passwordFile = pkgs.writeText "x" "literal"`: an option that expects a RUNTIME path to a secret is handed a file the evaluation
+    // writes into the store, with the secret's text written here. The option name says what the file holds; the writer says where it lands.
+    if (v && v.type === 'app' && PATHISH_TAIL.test(last) && SECRET_NAME.test(last.replace(PATHISH_TAIL, ''))) {
+      const { fn, args } = this.ev.flatten(v);
+      const c = this.ev.calleeOf(fn);
+      const idx = c.name ? WRITERS.get(c.name) : undefined;
+      const content = Number.isInteger(idx) && args[idx] ? unparen(args[idx]) : null;
+      if (content && content.type === 'string' && !content.interpolated && plausibleSecret(content.literal)) {
+        this.scriptKeys.add(`${file}:${content.start}`);
+        const option = full.filter(Boolean).join('.');
+        this.emit('nix-secret-plaintext', { ...this.at(file, bspan), file, severity: 'high', exposure: 'store', description: `${option} expects a runtime path to a secret but is given a file that ${c.name} writes into the world-readable Nix store, with the value written here as a literal (value redacted).`, source: { kind: 'literal', file, line: content.span ? content.span.startLine : (bspan ? bspan.startLine : 1) }, destination: { kind: 'store', label: `${c.name} file`, exposure: 'store' }, evidence: { ...redact(content.literal), option, writer: c.name }, originalLocation: bspan, chain: [hop(file, content.span, 'literal'), hop(file, bspan, `${c.name} into ${last}`)].filter(Boolean), origins: [mkOrigin('secret', `literal handed to ${c.name}`)] });
+        return;
+      }
+    }
     // evaluate the value for secret origins
     if (!v || v.type === 'attrset' || v.type === 'lambda' || v.type === 'list') return;
     if (this.isRuntimeRef(v, env)) { this.safe.push({ file, line: bspan && bspan.startLine, attr: full.filter(Boolean).join('.'), reason: 'runtime secret reference' }); return; }

package/src/language/nixos-hardening.js

@@ -339,8 +339,11 @@ export function analyzeNixosHardening(opts, extra = {}) {
     const sv = view(sudoCfg);
     if (sv.state === 'known' && typeof sv.value === 'string' && sudoState !== 'inactive' && sudoState !== 'unknown') {
       const text = stripNixHash(sv.value);
-      if (/NOPASSWD\s*:\s*ALL\b/.test(text)) {
-        addFinding('sudo-nopasswd-all', { anchor: anchorOf(sudoCfg), scope: 'security.sudo.extraConfig', state: sudoState === 'conditional' ? 'conditional' : 'active', uncertain: !sv.definite, evidence: [evidenceOf(sudoCfg)] });
+      // `Defaults !authenticate` (optionally scoped, `Defaults:%wheel !authenticate`) turns the password off for every rule the
+      // scope matches, which is the same grant as NOPASSWD: ALL written as a default
+      const noAuth = /^\s*Defaults(?:[:>@!]\S+)?\s+(?:[\w,]+\s*,\s*)?!authenticate\b/m.test(text);
+      if (/NOPASSWD\s*:\s*ALL\b/.test(text) || noAuth) {
+        addFinding('sudo-nopasswd-all', { anchor: anchorOf(sudoCfg), scope: 'security.sudo.extraConfig', state: sudoState === 'conditional' ? 'conditional' : 'active', uncertain: !sv.definite, evidence: [evidenceOf(sudoCfg)], ...(noAuth ? { extra: { directive: 'Defaults !authenticate' } } : {}) });
         entryPoints.push({ id: 'sudo-nopasswd-all', kind: 'sudo-nopasswd', state: sudoState === 'conditional' ? 'conditional' : 'active', privilege: 'root', evidence: [evidenceOf(sudoCfg)] });
       }
     }
@@ -525,6 +528,18 @@ export function analyzeNixosHardening(opts, extra = {}) {
     }
   }
 
+  // ── TLS private keys of other services (postfix `sslKey`, dovecot `sslServerKey`, httpd `sslServerKey`, a `keyFile`/`tlsKey`/`privateKeyFile`)
+  // The same rule as nginx above: a path literal or a store-writer call puts the key in the store; a string is a runtime path.
+  for (const o of cfg.options.filter((x) => x.namespace === 'nixos' && /^services\.(?!nginx\.)[^.]+\.(?:.*\.)?(?:sslKey|sslServerKey|sslCertificateKey|tlsKey|keyFile|privateKeyFile|tlsKeyFile)$/.test(x.path))) {
+    const svc = o.path.split('.')[1];
+    const svcState = stateOf(nixos(`services.${svc}.enable`));
+    if (svcState !== 'active' && svcState !== 'conditional') continue;
+    const st = svcState === 'conditional' ? 'conditional' : 'active';
+    const node = rhsNodeOf(o, opts.files);
+    if (node && (hasPathNode(node) || isStoreCopy(node))) addFinding('tls-key-in-store', { anchor: anchorOf(o), scope: o.path, state: st, uncertain: false, evidence: [evidenceOf(o)] });
+    else if (view(o).state === 'known' && typeof view(o).value === 'string') controls.push({ control: 'tls-key-runtime-path', option: o.path, applies: true });
+  }
+
   // ── firewall ──
   const listeningNow = inventory.filter((i) => i.state === 'active' && i.listening !== 'no' && i.listening !== 'localhost-only');
   if (fwOff === 'yes' || fwOff === 'conditional') {
@@ -635,7 +650,9 @@ export function analyzeNixosHardening(opts, extra = {}) {
       const r = sc(key);
       if (!r) continue;
       const v = view(r);
-      const items = v.state === 'known' ? asList(v.value) : v.state === 'conditional' ? asList(v.definiteItems) : [];
+      // systemd accepts the capability set as a list or as one space-separated string (`AmbientCapabilities = "CAP_SYS_ADMIN"`)
+      const raw = v.state === 'known' ? v.value : v.state === 'conditional' ? v.definiteItems : [];
+      const items = typeof raw === 'string' ? raw.split(/\s+/).filter(Boolean) : asList(raw);
       const bad = items.filter((c) => typeof c === 'string' && !c.startsWith('~') && DANGEROUS_CAPS.has(c));
       // a bounding set only limits; an ambient set grants, so only Ambient is a hard finding for non-root-looking services
       if (bad.length && (key === 'AmbientCapabilities' || identity.state !== 'root-default')) {