@qa-ai-stlc/runner-security 0.0.0-stage → 1.7.0

package/README.md

@@ -1,3 +1,53 @@
-# Temporary Holding Version
+# @qa-ai-stlc/runner-security
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The black-box security audit engine. It is an on-demand capability outside the regular pipeline:
+it runs only when `testing.security` is `in-scope` and only after the operator approved an
+authorization (environment, checks, identities, prohibited actions, the exact mutations allowed,
+rate limit and request budget). The approval is bound to the authorization's content and to the
+environment's address and allowlist, so editing either withdraws it.
+
+Every check reaches the application through one probe, which holds the authorized limits: nothing
+outside the authorized origin, no request that is not a read unless the authorization names that
+exact method and path, no faster than the rate limit, no more than the request budget, and no
+redirect followed. Every request, sent or refused, is logged in the audit result.
+
+## Checks
+
+| Class      | What it looks at                                                                                                                                                                                                                   |
+| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `headers`  | Content-Security-Policy, nosniff, framing protection, HSTS (HTTPS only), Referrer-Policy, a framework or version named in `Server` / `X-Powered-By`                                                                                |
+| `cookies`  | HttpOnly, Secure (HTTPS only) and SameSite on every cookie set for an anonymous visitor; cookie values are never recorded. A session cookie is usually set only by a sign-in, so without a cookie before sign-in this is `skipped` |
+| `cors`     | Whether a foreign origin or the `null` origin is allowed, and whether with credentials                                                                                                                                             |
+| `errors`   | Stack traces, database errors and framework banners in a missing-page and a malformed-escape response                                                                                                                              |
+| `encoding` | Whether the usual query parameters are written into a page unencoded. A clean result is `uncertain`: the parameters the application really reads are not discovered                                                                |
+
+| `csrf` | Replays each mutation the authorization names, with the identity's session, a foreign `Origin` and no anti-forgery token. The authorization should carry a complete request body the operator vouches for, otherwise a refusal is `uncertain`. The sign-out path is never replayed |
+| `authz` | Opens each restricted route as the identity that may, as the one that must not (role `low`), and with no session. First confirms the low identity's session is alive, because a dead one is refused everywhere |
+| `session` | Signs out and replays the old session cookie on a page that tells signed-in from anonymous; it ends the identity's session, so it runs after the checks that use it |
+
+Identities sign in through the saved storage state under `.qa/auth/`, or through `authenticate()` (a scripted login whose page must be inside the authorized origin, or an attached Chrome). An identity that cannot sign in makes the checks that need it `blocked`, not `passed`.
+
+## Code-assisted level
+
+When `source.path` is set, three more classes read the application's source checkout. They run only
+when the authorization names them, and they only read: the checkout is exposed without any write,
+directories such as `node_modules`, `dist` and `.git` are left out, and binary or oversized files are
+counted but not read. Findings carry `codeReferences` (project-relative file and line), which the
+defect draft lists under "Code references".
+
+| Class           | What it looks at                                                                                                                                                                                                                                                                                      |
+| --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `dependencies`  | `npm audit` over the lockfile (found at or above `source.path`; a workspace is audited on its own). It sends package names and versions to the configured package registry, so naming the class is also consent to that. Other package managers are `skipped`; an audit that cannot run is `blocked`  |
+| `secrets`       | Provider key shapes, private key headers, JWTs, bearer tokens, password and API key assignments, and secrets with a literal value or literal fallback. Only the kind of secret and where it is are reported, never the value. A match in test code or sample data has low confidence                  |
+| `configuration` | Debug and test-only routes, debug mode, cookies without HttpOnly or Secure, disabled certificate verification, a wildcard CORS origin. A setting beside an environment check (`NODE_ENV`) is not reported. These are patterns in text, so a clean result is `uncertain` and test code is not examined |
+
+Without `source.path`, or when it points at nothing, these classes are `skipped` with a note and the
+audit logs a notice that it ran black-box only.
+
+A check ends `passed`, `failed`, `skipped`, `blocked` or `uncertain`; the last three are never
+reported as `passed`, and an audit with a blocked check or an exhausted budget is `partial`.
+Findings become tracker-neutral defect drafts with `category: security`; accepting them is the
+ordinary defect gate.
+
+Part of [QA-AI-STLC](https://github.com/Klim-101/QA-AI-STLC). See the repository root for
+license, contributing and security information.

package/dist/checks/authz-check.d.ts

@@ -0,0 +1,9 @@
+import type { SecurityCheck } from '../security-check.js';
+/**
+ * Asks for each restricted route the authorization names, as the identity that may reach it, as
+ * the identity that must not, and with no session at all. A route the privileged identity cannot
+ * reach itself cannot be judged and makes the check `uncertain`. Only GET requests are sent.
+ * Reaching the route is read as: a 2xx answer on the page that was asked for, not a sign-in page.
+ */
+export declare const authzCheck: SecurityCheck;
+//# sourceMappingURL=authz-check.d.ts.map

package/dist/checks/authz-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-check.d.ts","sourceRoot":"","sources":["../../src/checks/authz-check.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAA4C,MAAM,sBAAsB,CAAC;AAYpG;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAAE,aA8DxB,CAAC"}

package/dist/checks/authz-check.js

@@ -0,0 +1,100 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { fetchPage } from '../fetch-page.js';
+import { buildFinding } from '../finding.js';
+import { isAccepted, reachedRoute, sessionHeaders } from './session-pages.js';
+const BASELINE_PAGE = '/';
+function unavailable(input, whatIsMissing) {
+    const failures = input.identities.describeFailures();
+    return failures === undefined
+        ? { status: 'skipped', note: whatIsMissing, findings: [] }
+        : { status: 'blocked', note: `${whatIsMissing} (${failures})`, findings: [] };
+}
+/**
+ * Asks for each restricted route the authorization names, as the identity that may reach it, as
+ * the identity that must not, and with no session at all. A route the privileged identity cannot
+ * reach itself cannot be judged and makes the check `uncertain`. Only GET requests are sent.
+ * Reaching the route is read as: a 2xx answer on the page that was asked for, not a sign-in page.
+ */
+export const authzCheck = {
+    checkClass: 'authz',
+    run: async (input) => {
+        const { probe, authorization, identities } = input;
+        const { baseUrl } = authorization.environment;
+        if (authorization.restrictedRoutes.length === 0) {
+            return { status: 'skipped', note: 'The authorization names no restricted route.', findings: [] };
+        }
+        const low = identities.byRole('low');
+        const high = identities.byRole('high');
+        if (low === undefined || high === undefined) {
+            return unavailable(input, 'The check needs one signed-in identity with role low and one with role high');
+        }
+        // A refusal only means something if the session was alive to be refused with. A signed-out or
+        // expired session is turned away from everything, so without this it would read as a pass.
+        const baseline = await fetchPage(probe, baseUrl, BASELINE_PAGE, { headers: sessionHeaders(low) });
+        if (!isAccepted(baseline)) {
+            return {
+                status: 'uncertain',
+                note: `The "${low.name}" session was not accepted on ${BASELINE_PAGE}, so a refusal elsewhere would prove nothing.`,
+                findings: [],
+            };
+        }
+        const findings = [];
+        const unverified = [];
+        for (const route of authorization.restrictedRoutes) {
+            const asHigh = await fetchPage(probe, baseUrl, route, { headers: sessionHeaders(high) });
+            if (!reachedRoute(asHigh, route)) {
+                unverified.push(route);
+                continue;
+            }
+            const asLow = await fetchPage(probe, baseUrl, route, { headers: sessionHeaders(low) });
+            const anonymous = await fetchPage(probe, baseUrl, route);
+            if (reachedRoute(asLow, route)) {
+                findings.push(finding(route, 'low-privilege', `"${low.name}" (role low)`, asLow, asHigh));
+            }
+            if (reachedRoute(anonymous, route)) {
+                findings.push(finding(route, 'anonymous', 'a visitor who is not signed in', anonymous, asHigh));
+            }
+        }
+        if (findings.length === 0 && unverified.length > 0) {
+            return {
+                status: 'uncertain',
+                note: `The privileged identity could not reach ${unverified.join(', ')}, so access to it could not be judged.`,
+                findings,
+            };
+        }
+        return {
+            status: 'passed',
+            note: unverified.length > 0
+                ? `Not judged, because the privileged identity could not reach them: ${unverified.join(', ')}.`
+                : `Checked ${String(authorization.restrictedRoutes.length)} restricted route(s).`,
+            findings,
+        };
+    },
+};
+function finding(route, who, description, actual, privileged) {
+    // The same page for both is conclusive; a different page that is still a 2xx is likely but could
+    // be a public variant of the route.
+    const isSameContent = actual.response.bodyText === privileged.response.bodyText;
+    return buildFinding({
+        idParts: ['authz', route, who],
+        checkClass: 'authz',
+        riskArea: who === 'anonymous' ? 'Access control: authentication' : 'Access control: privilege escalation',
+        confidence: isSameContent ? 'high' : 'medium',
+        severityProposal: 'critical',
+        title: who === 'anonymous'
+            ? `${route} can be opened without signing in`
+            : `${route} can be opened by an identity that should not reach it`,
+        steps: [
+            `Request ${route} as an identity that is allowed to reach it`,
+            `Request ${route} as ${description}`,
+            'Compare the two answers',
+        ],
+        expectedResult: `${route} refuses ${description}, or sends it to sign in`,
+        actualResult: `${description} received the page (status ${String(actual.response.status)})${isSameContent ? ', identical to what the privileged identity sees' : ''}`,
+        remediation: `Check the caller's role on the server before serving ${route}, not only in the navigation.`,
+        regressionCheck: `Assert that ${route} answers ${description} with 401 or 403, or a redirect to sign in`,
+        requestIndexes: [actual.response.requestIndex, privileged.response.requestIndex],
+    });
+}
+//# sourceMappingURL=authz-check.js.map

package/dist/checks/authz-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-check.js","sourceRoot":"","sources":["../../src/checks/authz-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAGtC,OAAO,EAAE,SAAS,EAAoB,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE9E,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,SAAS,WAAW,CAAC,KAAyB,EAAE,aAAqB;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;IACrD,OAAO,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC1D,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,aAAa,KAAK,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAkB;IACvC,UAAU,EAAE,OAAO;IACnB,GAAG,EAAE,KAAK,EAAE,KAAK,EAAiC,EAAE;QAClD,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QACnD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC;QAC9C,IAAI,aAAa,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,8CAA8C,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACnG,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,WAAW,CAChB,KAAK,EACL,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,QAAQ,GAAG,CAAC,IAAI,iCAAiC,aAAa,+CAA+C;gBACnH,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,gBAAgB,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBACjC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACzD,IAAI,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,GAAG,CAAC,IAAI,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,gCAAgC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,2CAA2C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;gBAC9G,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,IAAI,EACF,UAAU,CAAC,MAAM,GAAG,CAAC;gBACnB,CAAC,CAAC,qEAAqE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC/F,CAAC,CAAC,WAAW,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC,uBAAuB;YACrF,QAAQ;SACT,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAS,OAAO,CACd,KAAa,EACb,GAAkC,EAClC,WAAmB,EACnB,MAAmB,EACnB,UAAuB;IAEvB,iGAAiG;IACjG,oCAAoC;IACpC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAChF,OAAO,YAAY,CAAC;QAClB,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;QAC9B,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,sCAAsC;QACzG,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC7C,gBAAgB,EAAE,UAAU;QAC5B,KAAK,EACH,GAAG,KAAK,WAAW;YACjB,CAAC,CAAC,GAAG,KAAK,mCAAmC;YAC7C,CAAC,CAAC,GAAG,KAAK,wDAAwD;QACtE,KAAK,EAAE;YACL,WAAW,KAAK,6CAA6C;YAC7D,WAAW,KAAK,OAAO,WAAW,EAAE;YACpC,yBAAyB;SAC1B;QACD,cAAc,EAAE,GAAG,KAAK,YAAY,WAAW,0BAA0B;QACzE,YAAY,EAAE,GAAG,WAAW,8BAA8B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IACtF,aAAa,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,EACvE,EAAE;QACF,WAAW,EAAE,wDAAwD,KAAK,+BAA+B;QACzG,eAAe,EAAE,eAAe,KAAK,YAAY,WAAW,4CAA4C;QACxG,cAAc,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;KACjF,CAAC,CAAC;AACL,CAAC"}

package/dist/checks/code-check-support.d.ts

@@ -0,0 +1,9 @@
+export declare function isTestOrFixturePath(path: string): boolean;
+export interface SourceLine {
+    readonly number: number;
+    readonly text: string;
+}
+export declare function scannableLines(text: string): readonly SourceLine[];
+/** A finding cites at most this many lines of one file: the file is the subject, not every match. */
+export declare const MAX_CITED_LINES_PER_FILE = 5;
+//# sourceMappingURL=code-check-support.d.ts.map

package/dist/checks/code-check-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-check-support.d.ts","sourceRoot":"","sources":["../../src/checks/code-check-support.ts"],"names":[],"mappings":"AAQA,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAKD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,UAAU,EAAE,CAKlE;AAED,qGAAqG;AACrG,eAAO,MAAM,wBAAwB,IAAI,CAAC"}

package/dist/checks/code-check-support.js

@@ -0,0 +1,19 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+// Test code and sample data are not what reaches production, and the secrets and settings in them
+// are placeholders far more often than not, so findings there are weaker or left out.
+const TEST_PATH_PATTERN = /(?:^|\/)(?:tests?|__tests__|__mocks__|fixtures?|mocks?|examples?|e2e|spec)\/|\.(?:test|spec)\.[a-z]+$/iu;
+export function isTestOrFixturePath(path) {
+    return TEST_PATH_PATTERN.test(path);
+}
+// Longer lines are minified or generated output, where a line number would point nowhere.
+const MAX_SCANNED_LINE_LENGTH = 1000;
+export function scannableLines(text) {
+    return text
+        .split(/\r?\n/u)
+        .map((lineText, index) => ({ number: index + 1, text: lineText }))
+        .filter(({ text: lineText }) => lineText.length > 0 && lineText.length <= MAX_SCANNED_LINE_LENGTH);
+}
+/** A finding cites at most this many lines of one file: the file is the subject, not every match. */
+export const MAX_CITED_LINES_PER_FILE = 5;
+//# sourceMappingURL=code-check-support.js.map

package/dist/checks/code-check-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-check-support.js","sourceRoot":"","sources":["../../src/checks/code-check-support.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,kGAAkG;AAClG,sFAAsF;AACtF,MAAM,iBAAiB,GACrB,yGAAyG,CAAC;AAE5G,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,0FAA0F;AAC1F,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAOrC,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI;SACR,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;SACjE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,IAAI,uBAAuB,CAAC,CAAC;AACvG,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC"}

package/dist/checks/configuration-check.d.ts

@@ -0,0 +1,10 @@
+import type { SecurityCheck } from '../security-check.js';
+/**
+ * Looks in the source checkout for settings and routes that should not reach a production build:
+ * debug and test-only endpoints, debug mode, cookies without HttpOnly or Secure, disabled
+ * certificate verification, a wildcard CORS origin. Test code is not examined. These are patterns
+ * in text, not an analysis of what runs, so a clean result is `uncertain` and a match keeps a
+ * confidence that says how often the pattern is wrong.
+ */
+export declare const configurationCheck: SecurityCheck;
+//# sourceMappingURL=configuration-check.d.ts.map

package/dist/checks/configuration-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-check.d.ts","sourceRoot":"","sources":["../../src/checks/configuration-check.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,sBAAsB,CAAC;AAuFhF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAsDhC,CAAC"}

package/dist/checks/configuration-check.js

@@ -0,0 +1,128 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { buildFinding } from '../finding.js';
+import { MAX_CITED_LINES_PER_FILE, isTestOrFixturePath, scannableLines } from './code-check-support.js';
+// A debug or test-only route, by the names such routes usually carry. The route prefix is anchored
+// to the start of the path so `/debuggable-things` is not mistaken for `/debug`.
+const DEBUG_ROUTE = /(?:\.(?:get|post|put|patch|delete|all|use)\(|@\w+\.(?:route|get|post)\()\s*["'`]\/(?:_{0,2}(?:debug|test|testing|reset|seed|phpinfo|console)|test-only|internal\/test|heapdump)(?:[/"'`?]|$)/iu;
+const RULES = [
+    {
+        name: 'debug-endpoint',
+        title: 'A debug or test-only endpoint is registered',
+        riskArea: 'Debug and test-only code in production builds',
+        regex: DEBUG_ROUTE,
+        severity: 'major',
+        confidence: 'medium',
+        remediation: 'Register debug and test-only routes only when the environment is not production, or remove them.',
+    },
+    {
+        name: 'cookie-http-only-disabled',
+        title: 'Cookies are configured without HttpOnly',
+        riskArea: 'Session management configuration',
+        regex: /\bhttpOnly["']?\s*[:=]\s*false\b/iu,
+        severity: 'major',
+        confidence: 'high',
+        remediation: 'Leave HttpOnly on for session cookies so a script injected into a page cannot read them.',
+    },
+    {
+        name: 'cookie-secure-disabled',
+        title: 'Cookies are configured without Secure',
+        riskArea: 'Session management configuration',
+        regex: /\bsecure["']?\s*[:=]\s*false\b/iu,
+        severity: 'major',
+        confidence: 'medium',
+        remediation: 'Set Secure on session cookies so they are never sent over plain HTTP.',
+    },
+    {
+        name: 'debug-mode-enabled',
+        title: 'Debug mode is switched on in configuration',
+        riskArea: 'Debug and test-only code in production builds',
+        regex: /\bdebug["']?\s*[:=]\s*(?:true|True)\b|\bDEBUG\s*=\s*True\b|\.run\([^)]*\bdebug\s*=\s*True/u,
+        severity: 'minor',
+        confidence: 'low',
+        remediation: 'Switch debug mode off in production configuration, or derive it from the environment.',
+    },
+    {
+        name: 'tls-verification-disabled',
+        title: 'Certificate verification is switched off',
+        riskArea: 'Transport security configuration',
+        regex: /\brejectUnauthorized["']?\s*[:=]\s*false\b|NODE_TLS_REJECT_UNAUTHORIZED["']?\s*[:=]\s*["']?0\b|\bverify\s*=\s*False\b/u,
+        severity: 'major',
+        confidence: 'medium',
+        remediation: 'Keep certificate verification on; trust a private authority explicitly instead.',
+    },
+    {
+        name: 'cors-any-origin',
+        title: 'Any origin is allowed by the CORS configuration',
+        riskArea: 'Cross-origin access configuration',
+        regex: /\borigin["']?\s*:\s*["'`]\*["'`]|Access-Control-Allow-Origin["']?\s*[:,=]\s*["'`]\*["'`]/iu,
+        severity: 'minor',
+        confidence: 'medium',
+        remediation: 'Allow the origins that need access by name, and never combine a wildcard with credentials.',
+    },
+];
+const CONFIGURATION_EXTENSIONS = /\.(?:[cm]?[jt]sx?|py|rb|php|java|kt|cs|go|json|ya?ml|toml|ini|env|properties|config|xml)$/iu;
+// A setting wrapped in an environment test (`if (process.env.NODE_ENV !== 'production')`) is the
+// intended way to keep development behavior out of a production build. The words are looked for in
+// the same line and the few above it; a deeper nesting is a limitation, so those findings keep their
+// stated confidence and the remediation says to guard the setting.
+const ENVIRONMENT_GUARD = /NODE_ENV|APP_ENV|\bisProd|\bisDev|\bis_prod|\bis_dev|FLASK_ENV|RAILS_ENV/u;
+const GUARD_WINDOW_LINES = 6;
+/**
+ * Looks in the source checkout for settings and routes that should not reach a production build:
+ * debug and test-only endpoints, debug mode, cookies without HttpOnly or Secure, disabled
+ * certificate verification, a wildcard CORS origin. Test code is not examined. These are patterns
+ * in text, not an analysis of what runs, so a clean result is `uncertain` and a match keeps a
+ * confidence that says how often the pattern is wrong.
+ */
+export const configurationCheck = {
+    checkClass: 'configuration',
+    run: async ({ source }) => {
+        if (source === undefined) {
+            return { status: 'skipped', note: 'No source.path is configured.', findings: [] };
+        }
+        const scan = await source.scan();
+        const findings = [];
+        let examinedCount = 0;
+        for (const file of scan.files) {
+            if (isTestOrFixturePath(file.path) || !CONFIGURATION_EXTENSIONS.test(file.path)) {
+                continue;
+            }
+            examinedCount += 1;
+            const lines = scannableLines(file.text);
+            const allLines = file.text.split(/\r?\n/u);
+            for (const rule of RULES) {
+                const matched = lines.filter((line) => rule.regex.test(line.text) &&
+                    !allLines
+                        .slice(Math.max(0, line.number - 1 - GUARD_WINDOW_LINES), line.number)
+                        .some((candidate) => ENVIRONMENT_GUARD.test(candidate)));
+                if (matched.length === 0) {
+                    continue;
+                }
+                findings.push(buildFinding({
+                    idParts: ['configuration', rule.name, file.path],
+                    checkClass: 'configuration',
+                    riskArea: rule.riskArea,
+                    confidence: rule.confidence,
+                    severityProposal: rule.severity,
+                    title: `${rule.title} in ${file.path}`,
+                    steps: [`Open ${file.path}`, `Read line ${String(matched[0]?.number)}`],
+                    expectedResult: 'Production builds carry no debug or test-only behavior and use safe defaults',
+                    actualResult: `${file.path} contains this setting on ${String(matched.length)} line(s) with no environment check beside it`,
+                    remediation: rule.remediation,
+                    regressionCheck: `Assert that ${file.path} no longer matches this setting, or that it is guarded by an environment check`,
+                    requestIndexes: [],
+                    codeReferences: matched
+                        .slice(0, MAX_CITED_LINES_PER_FILE)
+                        .map((line) => ({ path: file.path, line: line.number })),
+                }));
+            }
+        }
+        return {
+            status: 'uncertain',
+            note: `Matched ${String(RULES.length)} patterns in ${String(examinedCount)} configuration or code file(s). Patterns in text do not show what a production build runs.${scan.isTruncated ? ' The file limit stopped the scan early.' : ''}`,
+            findings,
+        };
+    },
+};
+//# sourceMappingURL=configuration-check.js.map

package/dist/checks/configuration-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-check.js","sourceRoot":"","sources":["../../src/checks/configuration-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAGtC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAYxG,mGAAmG;AACnG,iFAAiF;AACjF,MAAM,WAAW,GACf,gMAAgM,CAAC;AAEnM,MAAM,KAAK,GAAiC;IAC1C;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,6CAA6C;QACpD,QAAQ,EAAE,+CAA+C;QACzD,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,QAAQ;QACpB,WAAW,EACT,kGAAkG;KACrG;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,yCAAyC;QAChD,QAAQ,EAAE,kCAAkC;QAC5C,KAAK,EAAE,oCAAoC;QAC3C,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,MAAM;QAClB,WAAW,EAAE,0FAA0F;KACxG;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,uCAAuC;QAC9C,QAAQ,EAAE,kCAAkC;QAC5C,KAAK,EAAE,kCAAkC;QACzC,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,QAAQ;QACpB,WAAW,EAAE,uEAAuE;KACrF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,4CAA4C;QACnD,QAAQ,EAAE,+CAA+C;QACzD,KAAK,EAAE,4FAA4F;QACnG,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,KAAK;QACjB,WAAW,EAAE,uFAAuF;KACrG;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,0CAA0C;QACjD,QAAQ,EAAE,kCAAkC;QAC5C,KAAK,EACH,wHAAwH;QAC1H,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,QAAQ;QACpB,WAAW,EAAE,iFAAiF;KAC/F;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,iDAAiD;QACxD,QAAQ,EAAE,mCAAmC;QAC7C,KAAK,EAAE,4FAA4F;QACnG,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,QAAQ;QACpB,WAAW,EAAE,4FAA4F;KAC1G;CACF,CAAC;AAEF,MAAM,wBAAwB,GAC5B,6FAA6F,CAAC;AAEhG,iGAAiG;AACjG,mGAAmG;AACnG,qGAAqG;AACrG,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,2EAA2E,CAAC;AACtG,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAkB;IAC/C,UAAU,EAAE,eAAe;IAC3B,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAiC,EAAE;QACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,+BAA+B,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChF,SAAS;YACX,CAAC;YACD,aAAa,IAAI,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC1B,CAAC,QAAQ;yBACN,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,kBAAkB,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC;yBACrE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAC5D,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,SAAS;gBACX,CAAC;gBACD,QAAQ,CAAC,IAAI,CACX,YAAY,CAAC;oBACX,OAAO,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;oBAChD,UAAU,EAAE,eAAe;oBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,gBAAgB,EAAE,IAAI,CAAC,QAAQ;oBAC/B,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,IAAI,EAAE;oBACtC,KAAK,EAAE,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,EAAE,aAAa,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;oBACvE,cAAc,EAAE,8EAA8E;oBAC9F,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,6BAA6B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,8CAA8C;oBAC3H,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,eAAe,EAAE,eAAe,IAAI,CAAC,IAAI,gFAAgF;oBACzH,cAAc,EAAE,EAAE;oBAClB,cAAc,EAAE,OAAO;yBACpB,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC;yBAClC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;iBAC3D,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,WAAW,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,MAAM,CAAC,aAAa,CAAC,6FAA6F,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1O,QAAQ;SACT,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/checks/cookies-check.d.ts

@@ -0,0 +1,10 @@
+import type { SecurityCheck } from '../security-check.js';
+/**
+ * Checks the protective attributes (HttpOnly, Secure, SameSite) of every cookie the application
+ * sets for an anonymous visitor and of every cookie a signed-in identity's session holds, which
+ * is where a session cookie shows up. A cookie value is never read into a finding. The attributes are
+ * facts about the header, so confidence is high; severity is higher for a cookie whose name looks
+ * like a session, because that is the one worth stealing.
+ */
+export declare const cookiesCheck: SecurityCheck;
+//# sourceMappingURL=cookies-check.d.ts.map

package/dist/checks/cookies-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies-check.d.ts","sourceRoot":"","sources":["../../src/checks/cookies-check.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,sBAAsB,CAAC;AA+ChF;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,aA8E1B,CAAC"}

package/dist/checks/cookies-check.js

@@ -0,0 +1,113 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { looksLikeSessionCookie, parseSetCookie } from '../cookie-flags.js';
+import { fetchPage } from '../fetch-page.js';
+import { buildFinding } from '../finding.js';
+// Pages a visitor reaches before signing in. A session cookie is usually set only by a sign-in, so
+// the cookies an anonymous visitor receives are checked here and the ones a signed-in identity's
+// browser session holds are checked from its saved state.
+const PAGE_PATHS = ['/', '/login'];
+const RULES = [
+    {
+        flag: 'httponly',
+        isViolated: (cookie) => !cookie.isHttpOnly,
+        explain: (name) => `The "${name}" cookie can be read by scripts running in the page`,
+        remediation: 'Set HttpOnly on the cookie.',
+        regression: 'Assert that the Set-Cookie header of the cookie contains HttpOnly',
+    },
+    {
+        flag: 'secure',
+        isViolated: (cookie, isHttps) => isHttps && !cookie.isSecure,
+        explain: (name) => `The "${name}" cookie can be sent over an unencrypted connection`,
+        remediation: 'Set Secure on the cookie.',
+        regression: 'Assert that the Set-Cookie header of the cookie contains Secure',
+    },
+    {
+        flag: 'samesite',
+        isViolated: (cookie) => cookie.sameSite === undefined || cookie.sameSite === 'none',
+        explain: (name) => `The "${name}" cookie is sent on cross-site requests`,
+        remediation: 'Set SameSite=Lax, or Strict where the application allows it.',
+        regression: 'Assert that the Set-Cookie header of the cookie names SameSite=Lax or Strict',
+    },
+];
+/**
+ * Checks the protective attributes (HttpOnly, Secure, SameSite) of every cookie the application
+ * sets for an anonymous visitor and of every cookie a signed-in identity's session holds, which
+ * is where a session cookie shows up. A cookie value is never read into a finding. The attributes are
+ * facts about the header, so confidence is high; severity is higher for a cookie whose name looks
+ * like a session, because that is the one worth stealing.
+ */
+export const cookiesCheck = {
+    checkClass: 'cookies',
+    run: async ({ probe, authorization, identities }) => {
+        const { baseUrl } = authorization.environment;
+        const isHttps = new URL(baseUrl).protocol === 'https:';
+        const observed = new Map();
+        for (const path of PAGE_PATHS) {
+            const page = await fetchPage(probe, baseUrl, path);
+            for (const response of page.chain) {
+                for (const header of response.setCookies) {
+                    const flags = parseSetCookie(header);
+                    if (flags !== undefined) {
+                        observed.set(flags.name, {
+                            flags,
+                            requestIndex: response.requestIndex,
+                            holder: 'anonymous visitors',
+                        });
+                    }
+                }
+            }
+        }
+        for (const session of identities.all()) {
+            for (const flags of session.cookies) {
+                observed.set(flags.name, {
+                    flags,
+                    requestIndex: undefined,
+                    holder: `the signed-in identity "${session.name}"`,
+                });
+            }
+        }
+        const failures = identities.describeFailures();
+        if (observed.size === 0) {
+            return failures === undefined
+                ? {
+                    status: 'skipped',
+                    note: 'The application set no cookie for an anonymous visitor and no identity was signed in to hold a session cookie.',
+                    findings: [],
+                }
+                : {
+                    status: 'blocked',
+                    note: `No cookie was seen, and an identity could not sign in (${failures})`,
+                    findings: [],
+                };
+        }
+        const findings = [];
+        for (const { flags, requestIndex, holder } of observed.values()) {
+            const isSession = looksLikeSessionCookie(flags.name);
+            for (const rule of RULES.filter((candidate) => candidate.isViolated(flags, isHttps))) {
+                findings.push(buildFinding({
+                    idParts: ['cookies', flags.name, rule.flag],
+                    checkClass: 'cookies',
+                    riskArea: 'Session management',
+                    confidence: 'high',
+                    severityProposal: isSession && rule.flag !== 'samesite' ? 'major' : 'minor',
+                    title: `The "${flags.name}" cookie lacks ${rule.flag === 'samesite' ? 'a SameSite policy' : rule.flag === 'httponly' ? 'HttpOnly' : 'Secure'}`,
+                    steps: requestIndex === undefined
+                        ? [`Sign in as ${holder}`, 'Read the attributes of the cookies the browser session holds']
+                        : ['Request the page that sets the cookie', 'Read its Set-Cookie header'],
+                    expectedResult: `The "${flags.name}" cookie carries the ${rule.flag} protection`,
+                    actualResult: rule.explain(flags.name),
+                    remediation: rule.remediation,
+                    regressionCheck: rule.regression,
+                    requestIndexes: requestIndex === undefined ? [] : [requestIndex],
+                }));
+            }
+        }
+        const note = `Checked ${String(observed.size)} cookie(s) held by anonymous visitors and signed-in identities.`;
+        if (failures !== undefined && findings.length === 0) {
+            return { status: 'uncertain', note: `${note} An identity could not sign in (${failures}).`, findings };
+        }
+        return { status: 'passed', note, findings };
+    },
+};
+//# sourceMappingURL=cookies-check.js.map

package/dist/checks/cookies-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies-check.js","sourceRoot":"","sources":["../../src/checks/cookies-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAGtC,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAoB,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,mGAAmG;AACnG,iGAAiG;AACjG,0DAA0D;AAC1D,MAAM,UAAU,GAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAkBtD,MAAM,KAAK,GAA0B;IACnC;QACE,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU;QAC1C,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,qDAAqD;QACpF,WAAW,EAAE,6BAA6B;QAC1C,UAAU,EAAE,mEAAmE;KAChF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ;QAC5D,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,qDAAqD;QACpF,WAAW,EAAE,2BAA2B;QACxC,UAAU,EAAE,iEAAiE;KAC9E;IACD;QACE,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;QACnF,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,yCAAyC;QACxE,WAAW,EAAE,8DAA8D;QAC3E,UAAU,EAAE,8EAA8E;KAC3F;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAkB;IACzC,UAAU,EAAE,SAAS;IACrB,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,EAAiC,EAAE;QACjF,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACnD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAClC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;oBACzC,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;oBACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;4BACvB,KAAK;4BACL,YAAY,EAAE,QAAQ,CAAC,YAAY;4BACnC,MAAM,EAAE,oBAAoB;yBAC7B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;oBACvB,KAAK;oBACL,YAAY,EAAE,SAAS;oBACvB,MAAM,EAAE,2BAA2B,OAAO,CAAC,IAAI,GAAG;iBACnD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,gBAAgB,EAAE,CAAC;QAE/C,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,QAAQ,KAAK,SAAS;gBAC3B,CAAC,CAAC;oBACE,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,gHAAgH;oBACtH,QAAQ,EAAE,EAAE;iBACb;gBACH,CAAC,CAAC;oBACE,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,0DAA0D,QAAQ,GAAG;oBAC3E,QAAQ,EAAE,EAAE;iBACb,CAAC;QACR,CAAC;QAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,KAAK,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;gBACrF,QAAQ,CAAC,IAAI,CACX,YAAY,CAAC;oBACX,OAAO,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;oBAC3C,UAAU,EAAE,SAAS;oBACrB,QAAQ,EAAE,oBAAoB;oBAC9B,UAAU,EAAE,MAAM;oBAClB,gBAAgB,EAAE,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;oBAC3E,KAAK,EAAE,QAAQ,KAAK,CAAC,IAAI,kBAAkB,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;oBAC9I,KAAK,EACH,YAAY,KAAK,SAAS;wBACxB,CAAC,CAAC,CAAC,cAAc,MAAM,EAAE,EAAE,8DAA8D,CAAC;wBAC1F,CAAC,CAAC,CAAC,uCAAuC,EAAE,4BAA4B,CAAC;oBAC7E,cAAc,EAAE,QAAQ,KAAK,CAAC,IAAI,wBAAwB,IAAI,CAAC,IAAI,aAAa;oBAChF,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;oBACtC,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,eAAe,EAAE,IAAI,CAAC,UAAU;oBAChC,cAAc,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;iBACjE,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,iEAAiE,CAAC;QAC/G,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,mCAAmC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;QACzG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;CACF,CAAC"}

package/dist/checks/cors-check.d.ts

@@ -0,0 +1,10 @@
+import type { SecurityCheck } from '../security-check.js';
+/**
+ * Sends the landing page request with a foreign `Origin` and reads the CORS answer. Allowing the
+ * foreign origin together with credentials lets any site read signed-in responses, which is the
+ * serious case; allowing it without credentials only exposes what an anonymous visitor sees.
+ * `Access-Control-Allow-Origin: *` is not reported: it is the normal setting of a public resource,
+ * and browsers refuse it together with credentials.
+ */
+export declare const corsCheck: SecurityCheck;
+//# sourceMappingURL=cors-check.d.ts.map

package/dist/checks/cors-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-check.d.ts","sourceRoot":"","sources":["../../src/checks/cors-check.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,sBAAsB,CAAC;AAQhF;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,EAAE,aA4CvB,CAAC"}

package/dist/checks/cors-check.js

@@ -0,0 +1,55 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { fetchPage } from '../fetch-page.js';
+import { buildFinding } from '../finding.js';
+const PAGE_PATH = '/';
+// Origins the application has no reason to trust. `.test` is reserved (RFC 6761) and `null` is what
+// sandboxed documents send, so neither can be a real caller of this application.
+const FOREIGN_ORIGINS = ['https://qa-audit-untrusted.example.test', 'null'];
+/**
+ * Sends the landing page request with a foreign `Origin` and reads the CORS answer. Allowing the
+ * foreign origin together with credentials lets any site read signed-in responses, which is the
+ * serious case; allowing it without credentials only exposes what an anonymous visitor sees.
+ * `Access-Control-Allow-Origin: *` is not reported: it is the normal setting of a public resource,
+ * and browsers refuse it together with credentials.
+ */
+export const corsCheck = {
+    checkClass: 'cors',
+    run: async ({ probe, authorization }) => {
+        const { baseUrl } = authorization.environment;
+        const findings = [];
+        for (const origin of FOREIGN_ORIGINS) {
+            const page = await fetchPage(probe, baseUrl, PAGE_PATH, { headers: { origin } });
+            const { headers } = page.response;
+            if (headers['access-control-allow-origin'] !== origin) {
+                continue;
+            }
+            const hasCredentials = headers['access-control-allow-credentials']?.toLowerCase() === 'true';
+            findings.push(buildFinding({
+                idParts: [
+                    'cors',
+                    origin === 'null' ? 'null-origin' : 'reflected-origin',
+                    hasCredentials ? 'credentials' : 'anonymous',
+                ],
+                checkClass: 'cors',
+                riskArea: 'Cross-origin access',
+                confidence: 'high',
+                severityProposal: hasCredentials ? 'major' : 'minor',
+                title: hasCredentials
+                    ? `Any origin is allowed to read responses with credentials ("${origin}")`
+                    : `An untrusted origin is allowed to read responses ("${origin}")`,
+                steps: [
+                    `Request ${PAGE_PATH} with the header Origin: ${origin}`,
+                    'Read the Access-Control-Allow-* headers',
+                ],
+                expectedResult: 'The response does not allow an origin the application has no reason to trust',
+                actualResult: `The response allowed "${origin}"${hasCredentials ? ' and sent Access-Control-Allow-Credentials: true' : ''}`,
+                remediation: 'Allow only an explicit list of trusted origins; never reflect the request Origin, and never combine it with credentials.',
+                regressionCheck: `Assert that a request with Origin: ${origin} gets no Access-Control-Allow-Origin for that origin`,
+                requestIndexes: [page.response.requestIndex],
+            }));
+        }
+        return { status: 'passed', note: 'Tried a foreign origin and the null origin.', findings };
+    },
+};
+//# sourceMappingURL=cors-check.js.map

package/dist/checks/cors-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-check.js","sourceRoot":"","sources":["../../src/checks/cors-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAGtC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,oGAAoG;AACpG,iFAAiF;AACjF,MAAM,eAAe,GAAsB,CAAC,yCAAyC,EAAE,MAAM,CAAC,CAAC;AAE/F;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAkB;IACtC,UAAU,EAAE,MAAM;IAClB,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAiC,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC;QAC9C,MAAM,QAAQ,GAAsB,EAAE,CAAC;QAEvC,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACjF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;YAClC,IAAI,OAAO,CAAC,6BAA6B,CAAC,KAAK,MAAM,EAAE,CAAC;gBACtD,SAAS;YACX,CAAC;YACD,MAAM,cAAc,GAAG,OAAO,CAAC,kCAAkC,CAAC,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;YAC7F,QAAQ,CAAC,IAAI,CACX,YAAY,CAAC;gBACX,OAAO,EAAE;oBACP,MAAM;oBACN,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB;oBACtD,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW;iBAC7C;gBACD,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,qBAAqB;gBAC/B,UAAU,EAAE,MAAM;gBAClB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;gBACpD,KAAK,EAAE,cAAc;oBACnB,CAAC,CAAC,8DAA8D,MAAM,IAAI;oBAC1E,CAAC,CAAC,sDAAsD,MAAM,IAAI;gBACpE,KAAK,EAAE;oBACL,WAAW,SAAS,4BAA4B,MAAM,EAAE;oBACxD,yCAAyC;iBAC1C;gBACD,cAAc,EAAE,8EAA8E;gBAC9F,YAAY,EAAE,yBAAyB,MAAM,IAC3C,cAAc,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,EACxE,EAAE;gBACF,WAAW,EACT,0HAA0H;gBAC5H,eAAe,EAAE,sCAAsC,MAAM,sDAAsD;gBACnH,cAAc,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;aAC7C,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6CAA6C,EAAE,QAAQ,EAAE,CAAC;IAC7F,CAAC;CACF,CAAC"}

package/dist/checks/csrf-check.d.ts

@@ -0,0 +1,10 @@
+import type { SecurityCheck } from '../security-check.js';
+/**
+ * Replays each mutation the authorization names with a valid session, a foreign `Origin`, and no
+ * anti-forgery token. A server that checks for forgery refuses it. Only the mutations the
+ * operator named can be sent (the probe enforces it), and a complete request body the operator
+ * vouched for is what makes a refusal mean something: an empty body is refused for reasons that
+ * have nothing to do with CSRF, so without a body a refusal is `uncertain`, not `passed`.
+ */
+export declare const csrfCheck: SecurityCheck;
+//# sourceMappingURL=csrf-check.d.ts.map

package/dist/checks/csrf-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-check.d.ts","sourceRoot":"","sources":["../../src/checks/csrf-check.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,sBAAsB,CAAC;AAoBhF;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,EAAE,aAgEvB,CAAC"}