codegate-ai 0.7.0 → 0.9.0

package/dist/layer2-static/detectors/workflow-ref-confusion.js

@@ -0,0 +1,69 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const HASH_PINNED_REF_RE = /^[a-f0-9]{40}$/iu;
+function parseRepositoryUses(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("./") || trimmed.startsWith("docker://")) {
+        return null;
+    }
+    const atIndex = trimmed.lastIndexOf("@");
+    if (atIndex < 0) {
+        return null;
+    }
+    const slug = trimmed.slice(0, atIndex).trim().replace(/\/+$/u, "").toLowerCase();
+    const ref = trimmed.slice(atIndex + 1).trim();
+    if (slug.length === 0 || !slug.includes("/") || ref.length === 0) {
+        return null;
+    }
+    return { slug, ref };
+}
+function isHashPinned(ref) {
+    return HASH_PINNED_REF_RE.test(ref.trim());
+}
+export function detectWorkflowRefConfusion(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    for (const [jobIndex, job] of facts.jobs.entries()) {
+        for (const [stepIndex, step] of job.steps.entries()) {
+            const uses = step.uses?.trim();
+            if (!uses) {
+                continue;
+            }
+            const parsedUses = parseRepositoryUses(uses);
+            if (!parsedUses || isHashPinned(parsedUses.ref)) {
+                continue;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [uses],
+                fallbackValue: `uses: ${uses}`,
+            });
+            findings.push({
+                rule_id: "workflow-ref-confusion",
+                finding_id: `WORKFLOW_REF_CONFUSION-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_VULNERABLE_ACTION",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].uses` },
+                description: "Workflow action is pinned to a symbolic ref instead of an immutable commit hash",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-829",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: ["Pin external actions to a full commit SHA"],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        }
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-ref-version-mismatch.d.ts

@@ -0,0 +1,9 @@
+import type { RuntimeMode } from "../../config.js";
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowRefVersionMismatchInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+    runtimeMode?: RuntimeMode;
+}
+export declare function detectWorkflowRefVersionMismatch(input: WorkflowRefVersionMismatchInput): Promise<Finding[]>;

package/dist/layer2-static/detectors/workflow-ref-version-mismatch.js

@@ -0,0 +1,179 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const VERSION_COMMENT_PATTERNS = [
+    /#\s*tag\s*=\s*(v\d+(?:\.\d+)*(?:\.\d+)?)/iu,
+    /#\s*(v\d+(?:\.\d+)*(?:\.\d+)?)/iu,
+    /#\s*tag\s*=\s*(\d+(?:\.\d+)*(?:\.\d+)?)/iu,
+    /#\s*(?:version|ver)\s*[:=]\s*(v?\d+(?:\.\d+)*(?:\.\d+)?)/iu,
+];
+const GITHUB_API_HEADERS = {
+    Accept: "application/vnd.github+json",
+};
+const MAX_TAG_DEPTH = 8;
+function splitOwnerRepo(slug) {
+    const firstSlash = slug.indexOf("/");
+    if (firstSlash < 0) {
+        return null;
+    }
+    const owner = slug.slice(0, firstSlash);
+    const repo = slug.slice(firstSlash + 1).split("/")[0];
+    if (!owner || !repo) {
+        return null;
+    }
+    return { owner, repo };
+}
+function isPinnedToCommit(ref) {
+    return /^[a-f0-9]{40}$/iu.test(ref.trim());
+}
+function parseRepositoryUses(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("./") || trimmed.startsWith("docker://")) {
+        return null;
+    }
+    const atIndex = trimmed.lastIndexOf("@");
+    if (atIndex < 0) {
+        return null;
+    }
+    const slug = trimmed.slice(0, atIndex).trim().replace(/\/+$/u, "").toLowerCase();
+    const ref = trimmed.slice(atIndex + 1).trim();
+    if (!slug.includes("/") || ref.length === 0) {
+        return null;
+    }
+    return { slug, ref };
+}
+function extractVersionComment(line) {
+    for (const pattern of VERSION_COMMENT_PATTERNS) {
+        const match = line.match(pattern);
+        if (match?.[1]) {
+            return match[1];
+        }
+    }
+    return null;
+}
+function parseUsesLine(line, lineNumber) {
+    const match = line.match(/^\s*(?:-\s*)?uses:\s*([^#]+?)(?:\s*#\s*(.+))?\s*$/iu);
+    if (!match?.[1]) {
+        return null;
+    }
+    const uses = match[1].trim();
+    const versionComment = extractVersionComment(line);
+    if (!versionComment) {
+        return null;
+    }
+    const usesColumn = line.indexOf("uses:");
+    return {
+        lineNumber,
+        column: usesColumn >= 0 ? usesColumn + 1 : 1,
+        rawLine: line,
+        uses,
+        versionComment,
+    };
+}
+async function fetchGitHubJson(url) {
+    try {
+        const response = await fetch(url, {
+            headers: GITHUB_API_HEADERS,
+        });
+        if (!response.ok) {
+            return null;
+        }
+        return (await response.json());
+    }
+    catch {
+        return null;
+    }
+}
+async function resolveTagCommitSha(owner, repo, tag) {
+    const normalizedTag = tag.trim();
+    if (normalizedTag.length === 0) {
+        return null;
+    }
+    const refUrl = `https://api.github.com/repos/${owner}/${repo}/git/ref/tags/${encodeURIComponent(normalizedTag)}`;
+    const ref = (await fetchGitHubJson(refUrl));
+    if (!ref?.object?.sha || !ref.object.type) {
+        return null;
+    }
+    if (ref.object.type === "commit") {
+        return ref.object.sha;
+    }
+    if (ref.object.type !== "tag") {
+        return null;
+    }
+    const seenObjects = new Set([ref.object.sha]);
+    let tagObjectSha = ref.object.sha;
+    for (let depth = 0; depth < MAX_TAG_DEPTH; depth += 1) {
+        const tagUrl = `https://api.github.com/repos/${owner}/${repo}/git/tags/${tagObjectSha}`;
+        const tagObject = (await fetchGitHubJson(tagUrl));
+        if (!tagObject?.object?.sha || !tagObject.object.type) {
+            return null;
+        }
+        if (tagObject.object.type === "commit") {
+            return tagObject.object.sha;
+        }
+        if (tagObject.object.type !== "tag" || seenObjects.has(tagObject.object.sha)) {
+            return null;
+        }
+        seenObjects.add(tagObject.object.sha);
+        tagObjectSha = tagObject.object.sha;
+    }
+    return null;
+}
+export async function detectWorkflowRefVersionMismatch(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    if (!extractWorkflowFacts(input.parsed)) {
+        return [];
+    }
+    const mode = input.runtimeMode ?? "offline";
+    if (mode !== "online") {
+        return [];
+    }
+    const findings = [];
+    const lines = input.textContent.split(/\r?\n/u);
+    for (const [index, line] of lines.entries()) {
+        const parsedLine = parseUsesLine(line, index + 1);
+        if (!parsedLine) {
+            continue;
+        }
+        const parsedUses = parseRepositoryUses(parsedLine.uses);
+        if (!parsedUses || !isPinnedToCommit(parsedUses.ref)) {
+            continue;
+        }
+        const ownerRepo = splitOwnerRepo(parsedUses.slug);
+        if (!ownerRepo) {
+            continue;
+        }
+        const matchedCommit = await resolveTagCommitSha(ownerRepo.owner, ownerRepo.repo, parsedLine.versionComment);
+        if (!matchedCommit || matchedCommit === parsedUses.ref) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [parsedLine.rawLine, parsedLine.versionComment, parsedUses.ref],
+            fallbackValue: parsedLine.rawLine.trim(),
+        });
+        findings.push({
+            rule_id: "workflow-ref-version-mismatch",
+            finding_id: `WORKFLOW_REF_VERSION_MISMATCH-${input.filePath}-${index + 1}`,
+            severity: "MEDIUM",
+            category: "CI_SUPPLY_CHAIN",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { line: parsedLine.lineNumber, column: parsedLine.column },
+            description: "Hash-pinned action commit does not match its version comment tag",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-829",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Update the version comment to match the pinned commit or repin the action to the intended release tag",
+            ],
+            evidence: evidence?.evidence ?? parsedLine.rawLine.trim(),
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-secrets-inherit.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowSecretsInheritInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowSecretsInherit(input: WorkflowSecretsInheritInput): Finding[];

package/dist/layer2-static/detectors/workflow-secrets-inherit.js

@@ -0,0 +1,59 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function isReusableWorkflowCall(uses) {
+    return typeof uses === "string" && uses.includes("/.github/workflows/");
+}
+function isInheritSecrets(value) {
+    return typeof value === "string" && value.trim().toLowerCase() === "inherit";
+}
+export function detectWorkflowSecretsInherit(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    const root = asRecord(input.parsed);
+    const jobsRecord = asRecord(root?.jobs);
+    if (!facts || !jobsRecord) {
+        return [];
+    }
+    const findings = [];
+    for (const job of facts.jobs) {
+        const jobRecord = asRecord(jobsRecord[job.id]);
+        if (!jobRecord ||
+            !isReusableWorkflowCall(jobRecord.uses) ||
+            !isInheritSecrets(jobRecord.secrets)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: ["secrets: inherit", "inherit"],
+            fallbackValue: "secrets: inherit",
+        });
+        findings.push({
+            rule_id: "workflow-secrets-inherit",
+            finding_id: `WORKFLOW_SECRETS_INHERIT-${input.filePath}-${job.id}`,
+            severity: "HIGH",
+            category: "CI_PERMISSIONS",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `jobs.${job.id}.secrets` },
+            description: "Reusable workflow call inherits all repository secrets",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-200",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: ["Pass only the specific secrets required by the reusable workflow"],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-secrets-outside-env.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowSecretsOutsideEnvInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowSecretsOutsideEnv(input: WorkflowSecretsOutsideEnvInput): Finding[];

package/dist/layer2-static/detectors/workflow-secrets-outside-env.js

@@ -0,0 +1,99 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const DIRECT_SECRET_REFERENCE = /\bsecrets\.(?!GITHUB_TOKEN\b)[A-Za-z0-9_]+\b/iu;
+const BRACKET_SECRET_REFERENCE = /\bsecrets\s*\[\s*['"][^'"\r\n]+['"]\s*\]/iu;
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function appendPath(base, segment) {
+    if (typeof segment === "number") {
+        return `${base}[${segment}]`;
+    }
+    return base.length > 0 ? `${base}.${segment}` : segment;
+}
+function findSecretReference(value, path) {
+    if (typeof value === "string") {
+        return DIRECT_SECRET_REFERENCE.test(value) || BRACKET_SECRET_REFERENCE.test(value)
+            ? { path, value }
+            : null;
+    }
+    if (Array.isArray(value)) {
+        for (let index = 0; index < value.length; index += 1) {
+            const found = findSecretReference(value[index], appendPath(path, index));
+            if (found) {
+                return found;
+            }
+        }
+        return null;
+    }
+    const record = asRecord(value);
+    if (!record) {
+        return null;
+    }
+    for (const [key, child] of Object.entries(record)) {
+        const found = findSecretReference(child, appendPath(path, key));
+        if (found) {
+            return found;
+        }
+    }
+    return null;
+}
+function hasDedicatedEnvironment(job) {
+    const environment = job.environment;
+    if (typeof environment === "string") {
+        return environment.trim().length > 0;
+    }
+    return environment !== undefined && environment !== null;
+}
+export function detectWorkflowSecretsOutsideEnv(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    const root = asRecord(input.parsed);
+    const jobsRecord = asRecord(root?.jobs);
+    if (!facts || !jobsRecord) {
+        return [];
+    }
+    const findings = [];
+    for (const job of facts.jobs) {
+        const jobRecord = asRecord(jobsRecord[job.id]);
+        if (!jobRecord || hasDedicatedEnvironment(jobRecord)) {
+            continue;
+        }
+        const found = findSecretReference(jobRecord, `jobs.${job.id}`);
+        if (!found) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [found.value, "secrets."],
+            fallbackValue: found.value,
+        });
+        findings.push({
+            rule_id: "workflow-secrets-outside-env",
+            finding_id: `WORKFLOW_SECRETS_OUTSIDE_ENV-${input.filePath}-${job.id}`,
+            severity: "HIGH",
+            category: "CI_PERMISSIONS",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: found.path },
+            description: "Job references workflow secrets without a dedicated environment",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-522",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Use a dedicated environment for secrets-bound jobs or reduce the scope of secret exposure",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-self-hosted-runner.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowSelfHostedRunnerInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowSelfHostedRunner(input: WorkflowSelfHostedRunnerInput): Finding[];

package/dist/layer2-static/detectors/workflow-self-hosted-runner.js

@@ -0,0 +1,67 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function normalizeRunsOn(value) {
+    if (typeof value === "string") {
+        return [value.trim()];
+    }
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value
+        .filter((entry) => typeof entry === "string")
+        .map((entry) => entry.trim());
+}
+function isSelfHostedRunner(value) {
+    return normalizeRunsOn(value).some((entry) => entry.toLowerCase() === "self-hosted");
+}
+export function detectWorkflowSelfHostedRunner(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    const root = asRecord(input.parsed);
+    const jobsRecord = asRecord(root?.jobs);
+    if (!facts || !jobsRecord) {
+        return [];
+    }
+    const findings = [];
+    for (const job of facts.jobs) {
+        const jobRecord = jobsRecord[job.id];
+        if (!isSelfHostedRunner(asRecord(jobRecord)?.["runs-on"])) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: ["self-hosted"],
+            fallbackValue: "runs-on: self-hosted",
+        });
+        findings.push({
+            rule_id: "workflow-self-hosted-runner",
+            finding_id: `WORKFLOW_SELF_HOSTED_RUNNER-${input.filePath}-${job.id}`,
+            severity: "MEDIUM",
+            category: "CI_PERMISSIONS",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `jobs.${job.id}.runs-on` },
+            description: "Job uses a self-hosted runner",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-732",
+            confidence: "MEDIUM",
+            fixable: false,
+            remediation_actions: [
+                "Prefer GitHub-hosted runners unless the workflow requires a hardened self-hosted trust boundary",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-stale-action-refs.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowStaleActionRefsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowStaleActionRefs(input: WorkflowStaleActionRefsInput): Promise<Finding[]>;