cleartoship 0.10.1 → 0.10.2

package/README.md

@@ -98,7 +98,7 @@ runtimes, React Native, Go and shell.
 
 27 upstream rules are **superseded** where ClearToShip's own AST check is more
 precise, 6 are **withheld** as measurably noisy, 10 React Native rules are
-**skipped as inapplicable** on a project that is not React Native, 9 carry a
+**skipped as inapplicable** on a project that is not React Native, 11 carry a
 **match guard** for a
 shape their regex cannot exclude (a `"link": true` lockfile entry has no
 integrity hash by design; `querySelectorAll` is not a SQL call; `eval()` inside
@@ -218,7 +218,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.10.1
+      - uses: murtazaozdemir/cleartoship@v0.10.2
         with:
           fail-on: critical
           comment: true
@@ -240,7 +240,7 @@ above `fail-on`) for use in later steps. The comment is *sticky* — re-runs edi
 the same comment instead of piling up.
 
 By default the action runs the scanner version its own ref declares, so
-`@v0.10.1` runs `cleartoship@0.10.1` and pinning the ref pins the behaviour. If
+`@v0.10.2` runs `cleartoship@0.10.2` and pinning the ref pins the behaviour. If
 that version is not on the registry, it builds from its own checkout instead, so
 `uses: …@ref` works against an unpublished commit.
 
@@ -290,6 +290,12 @@ uploaded, and no database is connected to.
   excluded: one is a published CLI's entry point, the other is production schema.
   Across five dogfooded repos this moved 21 findings out of `critical` without
   hiding one of them.
+- **A CVE that only runs on a build machine is not a shipping vulnerability.**
+  CTS024 already split those when OSV answers; the vendored CVE rules — what
+  runs under `--offline` — now make the same split, dropping a match under
+  `devDependencies` (or a lockfile entry marked `"dev": true`) to `low` with the
+  reason attached. The same advisory against a dependency your users run keeps
+  its full severity.
 - **A bound parameter is not an injection.** `db.prepare(\`UPDATE ${table} SET
   csv = ? WHERE id = ?\`).bind(...)` interpolates an identifier while its values
   go through placeholders — the correct pattern, and the one a SQL-injection

package/action.yml

@@ -29,7 +29,7 @@ inputs:
   version:
     description: >-
       Version of the cleartoship npm package to run. Defaults to the version this
-      action's own ref declares, so `uses: …@v0.10.1` runs cleartoship@0.10.1. Set
+      action's own ref declares, so `uses: …@v0.10.2` runs cleartoship@0.10.2. Set
       `latest` to always track the newest release, or `local` to build from the checkout.
     required: false
     default: ''
@@ -76,7 +76,7 @@ runs:
       run: |
         # With no version pinned, run the exact version this action's checkout
         # declares. That keeps the action ref and the scanner in lockstep:
-        # `uses: <owner>/cleartoship@v0.10.1` runs cleartoship@0.10.1 instead of
+        # `uses: <owner>/cleartoship@v0.10.2` runs cleartoship@0.10.2 instead of
         # whatever npm happens to tag `latest` at the time.
         ver="$INPUT_VERSION"
         if [ -z "$ver" ]; then

package/dist/scanners/community.js

@@ -1,7 +1,7 @@
 import { read, rel, lineAt, snippetAt, languagesFor } from '../utils/files.js';
 import { Suppressions } from '../utils/suppress.js';
 import { adjustForPath } from '../utils/paths.js';
-import { GUARDVIBE_RULES, GUARDVIBE_ATTRIBUTION, GUARDVIBE_REACT_NATIVE_RULE_IDS, } from '../vendor/guardvibe/index.js';
+import { GUARDVIBE_RULES, GUARDVIBE_ATTRIBUTION, GUARDVIBE_REACT_NATIVE_RULE_IDS, GUARDVIBE_CVE_RULE_IDS, } from '../vendor/guardvibe/index.js';
 import { emptyResult } from '../types.js';
 /**
  * Upstream rules that restate a check ClearToShip already performs against the
@@ -229,6 +229,30 @@ const MATCH_GUARDS = {
     // interpolated expression may read from the request.
     VG010: (match, source, index) => sqlGuard(match, source, index),
     VG123: (_match, source, index) => !isParameterized(statementAround(source, index)),
+    // The "base64 payload" test is a run of 20+ characters from the base64
+    // alphabet, which any long camelCase identifier satisfies:
+    // `description: \`${pct(clusteredAroundMedian, …)}\`` matched on the
+    // identifier. Interpolated expressions are code, not the description text,
+    // and real encoded content is not purely alphabetic.
+    VG881: (match) => {
+        const text = match.replace(/\$\{[^}]*\}/g, ' ');
+        if (/(?:\\x[0-9a-f]{2}){4,}|(?:\\u[0-9a-f]{4}){4,}|(?:&#\d{2,4};){4,}/i.test(text))
+            return true;
+        const run = /[A-Za-z0-9+/]{20,}={0,2}/.exec(text)?.[0];
+        // A slash is not evidence: "new/used/refurbished" is twenty characters of
+        // the base64 alphabet and a sentence. Real encoded content carries digits
+        // or padding.
+        return run !== undefined && /[0-9+=]/.test(run);
+    },
+    // `eval("require")` is the documented escape hatch for keeping a bundler from
+    // statically resolving a require — a constant the author typed, with no input
+    // reaching it. Dynamic code execution is about the dynamic part.
+    VG014: (match, source, index) => {
+        if (insideStringLiteral(source, index))
+            return false;
+        const after = source.slice(index, index + 60);
+        return !/^(?:eval|new\s+Function)\s*\(\s*(['"])[A-Za-z_$][\w$]*\1\s*\)/.test(after);
+    },
     // SSRF is a *server* being made to fetch a URL it should not. A module marked
     // `'use client'` runs in the browser, where the request leaves the user's own
     // machine and crosses no trust boundary of yours.
@@ -245,11 +269,6 @@ const MATCH_GUARDS = {
     // query filtered to the caller's own rows does not let them. An unbounded
     // fetch of your own data is a scalability question, not a security finding.
     VG955: (match) => !/\bwhere\b[\s\S]{0,200}?\b(userId|user_id|ownerId|owner_id|orgId|org_id|organizationId|tenantId|tenant_id|workspaceId|workspace_id|accountId|account_id|teamId|team_id|shop|shopDomain|storeId|store_id)\b/i.test(match),
-    // `description: 'eval() executes arbitrary code…'` is prose about eval, not a
-    // call to it — and security tooling, which is a good deal of what gets
-    // scanned, is full of that prose. Code held in a string is not code running
-    // here; the eval that would run it is its own match, outside the quotes.
-    VG014: (_match, source, index) => !insideStringLiteral(source, index),
 };
 /** Regexes over very large files are where catastrophic backtracking bites. */
 const MAX_BYTES = 400_000;
@@ -280,6 +299,38 @@ function inapplicable(ctx) {
     }
     return { ids, why };
 }
+/**
+ * Whether a dependency-manifest match sits under `devDependencies`, or in a
+ * lockfile entry marked `"dev": true`. Both mean the package is a build-time
+ * tool that no user ever runs — the split CTS024 already makes for CVEs found
+ * through OSV, applied to the vendored CVE rules that run when offline.
+ */
+function inDevDependencies(source, index) {
+    const before = source.slice(Math.max(0, index - 4000), index);
+    if (/"dev"\s*:\s*true[\s\S]{0,600}$/.test(before))
+        return true;
+    const nearest = /"(dev|peer|optional)?[dD]ependencies"\s*:\s*\{(?![\s\S]*"[a-z]*[dD]ependencies"\s*:\s*\{)/.exec(before);
+    return nearest?.[1] === 'dev';
+}
+/**
+ * Rules whose upstream severity is right for one shape they match and wrong for
+ * another. Returning null leaves the rule's own severity alone.
+ */
+const SEVERITY_ADJUSTERS = {
+    // The rule matches two different things. Explicitly accepting `alg: none` is
+    // the critical it is named for. Merely calling `jwt.verify(token, secret)`
+    // without pinning `algorithms` is not: jsonwebtoken has rejected `none` on a
+    // keyed verify since v9, so what is left is defence against algorithm
+    // confusion — worth doing, not worth blocking a deploy over.
+    VG105: (match) => /algorithms\s*:\s*\[\s*['"]none['"]/i.test(match)
+        ? null
+        : {
+            severity: 'medium',
+            note: ' (Reported at medium: no `algorithms` option is pinned, but nothing here accepts ' +
+                '`alg: none` — a keyed `jwt.verify` rejects it. Pinning the algorithm is defence ' +
+                'against algorithm confusion, which matters most when the key could be a public key.)',
+        },
+};
 export const communityScanner = {
     name: `Community ruleset (${GUARDVIBE_RULES.length - SUPERSEDED.size - WITHHELD.size} rules)`,
     applies() {
@@ -329,12 +380,27 @@ export const communityScanner = {
                     const key = `${relPath}:${line}:${rule.id}`;
                     if (!seen.has(key) && !suppress.suppressed(line, rule.id)) {
                         seen.add(key);
-                        const placed = adjustForPath(severityOf(rule.severity), relPath);
+                        let adjusted = SEVERITY_ADJUSTERS[rule.id]?.(m[0], source, m.index) ?? null;
+                        // A CVE in something that only ever runs on a build machine is not
+                        // a shipping vulnerability. OSV-sourced findings are already split
+                        // this way (CTS024); this is the same split for the vendored CVE
+                        // rules, which are what runs with --offline.
+                        if (!adjusted &&
+                            GUARDVIBE_CVE_RULE_IDS.has(rule.id) &&
+                            (lockfile || /(^|\/)package\.json$/.test(relPath)) &&
+                            inDevDependencies(source, m.index)) {
+                            adjusted = {
+                                severity: 'low',
+                                note: ' (Reported at low: this version is declared under devDependencies, so it is a ' +
+                                    'build-time tool rather than something your users run.)',
+                            };
+                        }
+                        const placed = adjustForPath(adjusted?.severity ?? severityOf(rule.severity), relPath);
                         result.findings.push({
                             id: rule.id,
                             severity: placed.severity,
                             title: rule.name,
-                            detail: rule.description + placed.note,
+                            detail: rule.description + (adjusted?.note ?? '') + placed.note,
                             fix: rule.fixCode ? `${rule.fix}\n\n${rule.fixCode}` : rule.fix,
                             file: relPath,
                             line,

package/examples/security.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.10.1
+      - uses: murtazaozdemir/cleartoship@v0.10.2
         with:
           fail-on: critical   # block the PR only on criticals
           comment: true        # post a summary comment on the PR

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cleartoship",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "The 30-second pre-launch security clearance for AI-built & vibe-coded apps. Catches missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys.",
   "keywords": [
     "security",