codegate-ai 0.8.0 → 0.9.0

package/dist/layer2-static/detectors/workflow-insecure-commands.js

@@ -0,0 +1,72 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const INSECURE_COMMAND_PATTERNS = [
+    {
+        pattern: /\b(?:curl|wget)\b[\s\S]*?\|\s*(?:sh|bash)\b/iu,
+        description: "remote download piped directly into a shell",
+    },
+    {
+        pattern: /\bbash\s*<\s*\(\s*curl\b/iu,
+        description: "process substitution executes downloaded shell content",
+    },
+    {
+        pattern: /\bsh\s*<\s*\(\s*curl\b/iu,
+        description: "process substitution executes downloaded shell content",
+    },
+];
+function findInsecureCommand(run) {
+    if (typeof run !== "string") {
+        return null;
+    }
+    for (const entry of INSECURE_COMMAND_PATTERNS) {
+        if (entry.pattern.test(run)) {
+            return { match: run, description: entry.description };
+        }
+    }
+    return null;
+}
+export function detectWorkflowInsecureCommands(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            const insecure = findInsecureCommand(step.run);
+            if (!insecure) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [insecure.match],
+                fallbackValue: insecure.match,
+            });
+            findings.push({
+                rule_id: "workflow-insecure-commands",
+                finding_id: `WORKFLOW_INSECURE_COMMANDS-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "COMMAND_EXEC",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                description: `Workflow uses ${insecure.description}`,
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-78",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Download artifacts separately, verify integrity, and run them only after review",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-known-vuln-action.d.ts

@@ -0,0 +1,8 @@
+import type { RuntimeMode } from "../../config.js";
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowKnownVulnActionInput {
+    filePath: string;
+    parsed: unknown;
+    runtimeMode?: RuntimeMode;
+}
+export declare function detectWorkflowKnownVulnAction(input: WorkflowKnownVulnActionInput): Finding[];

package/dist/layer2-static/detectors/workflow-known-vuln-action.js

@@ -0,0 +1,70 @@
+import { loadKnownVulnerableActions } from "../advisories/gha-advisory-client.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function parseRepositoryUses(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("./") || trimmed.startsWith("docker://")) {
+        return null;
+    }
+    const atIndex = trimmed.lastIndexOf("@");
+    if (atIndex < 0) {
+        return null;
+    }
+    const slug = trimmed.slice(0, atIndex).toLowerCase();
+    const ref = trimmed.slice(atIndex + 1).toLowerCase();
+    if (!slug.includes("/") || ref.length === 0) {
+        return null;
+    }
+    return { slug, ref };
+}
+export function detectWorkflowKnownVulnAction(input) {
+    if (input.runtimeMode !== "online") {
+        return [];
+    }
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const advisories = loadKnownVulnerableActions({ runtimeMode: input.runtimeMode }).advisories;
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            const uses = step.uses;
+            if (!uses) {
+                return;
+            }
+            const parsedUses = parseRepositoryUses(uses);
+            if (!parsedUses) {
+                return;
+            }
+            const vulnerableVersions = advisories[parsedUses.slug];
+            if (!vulnerableVersions || !vulnerableVersions.includes(parsedUses.ref)) {
+                return;
+            }
+            findings.push({
+                rule_id: "workflow-known-vuln-action",
+                finding_id: `WORKFLOW_KNOWN_VULN_ACTION-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_VULNERABLE_ACTION",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].uses` },
+                description: `Action ${parsedUses.slug}@${parsedUses.ref} is listed in known vulnerable references`,
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-937",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Upgrade to a non-vulnerable action release and pin to a reviewed commit SHA",
+                ],
+                evidence: uses,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-misfeature.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowMisfeatureInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowMisfeature(input: WorkflowMisfeatureInput): Finding[];

package/dist/layer2-static/detectors/workflow-misfeature.js

@@ -0,0 +1,101 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const SECURITY_TOKENS = [
+    "codeql",
+    "security",
+    "sast",
+    "secret",
+    "dependency review",
+    "npm audit",
+    "trivy",
+];
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function isContinueOnErrorEnabled(value) {
+    if (value === true) {
+        return true;
+    }
+    return typeof value === "string" && value.trim().toLowerCase() === "true";
+}
+function isSecurityStep(candidate) {
+    const combined = [candidate.name, candidate.run, candidate.uses]
+        .filter((value) => typeof value === "string")
+        .join(" ")
+        .toLowerCase();
+    return SECURITY_TOKENS.some((token) => combined.includes(token));
+}
+function gatherCandidates(parsed) {
+    const root = asRecord(parsed);
+    const jobs = asRecord(root?.jobs);
+    if (!jobs) {
+        return [];
+    }
+    const candidates = [];
+    for (const [jobId, jobValue] of Object.entries(jobs)) {
+        const job = asRecord(jobValue);
+        const steps = Array.isArray(job?.steps) ? job.steps : [];
+        steps.forEach((stepValue, stepIndex) => {
+            const step = asRecord(stepValue);
+            if (!step) {
+                return;
+            }
+            candidates.push({
+                jobId,
+                stepIndex,
+                name: typeof step.name === "string" ? step.name : undefined,
+                run: typeof step.run === "string" ? step.run : undefined,
+                uses: typeof step.uses === "string" ? step.uses : undefined,
+                continueOnError: isContinueOnErrorEnabled(step["continue-on-error"]),
+            });
+        });
+    }
+    return candidates;
+}
+export function detectWorkflowMisfeature(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    for (const candidate of gatherCandidates(input.parsed)) {
+        if (!candidate.continueOnError || !isSecurityStep(candidate)) {
+            continue;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: ["continue-on-error: true", candidate.run ?? "", candidate.name ?? ""],
+            fallbackValue: "security step continues on error",
+        });
+        findings.push({
+            rule_id: "workflow-misfeature",
+            finding_id: `WORKFLOW_MISFEATURE-${input.filePath}-${candidate.jobId}-${candidate.stepIndex}`,
+            severity: "MEDIUM",
+            category: "CI_TRIGGER",
+            layer: "L2",
+            file_path: input.filePath,
+            location: {
+                field: `jobs.${candidate.jobId}.steps[${candidate.stepIndex}].continue-on-error`,
+            },
+            description: "Security-relevant step is configured with continue-on-error, which can hide failed checks",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-703",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Remove continue-on-error from security-critical steps or split non-blocking diagnostics into separate jobs",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-obfuscation.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowObfuscationInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowObfuscation(input: WorkflowObfuscationInput): Finding[];

package/dist/layer2-static/detectors/workflow-obfuscation.js

@@ -0,0 +1,79 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const OBFUSCATION_PATTERNS = [
+    {
+        pattern: /\bbase64\s+-d\b/iu,
+        description: "runtime decoding of base64-encoded payload data",
+    },
+    {
+        pattern: /\bbase64\s+-d\b[\s\S]*\|\s*(?:bash|sh)\b/iu,
+        description: "base64-decoded payload piped into a shell",
+    },
+    {
+        pattern: /\beval\b[\s\S]*\$\([^)]+base64[^)]*\)/iu,
+        description: "eval executes command substitution that decodes base64 content",
+    },
+    {
+        pattern: /\bprintf\b[\s\S]*\\x[0-9a-f]{2}/iu,
+        description: "hex-encoded shell payload reconstruction",
+    },
+];
+function detectObfuscation(run) {
+    if (!run) {
+        return null;
+    }
+    for (const entry of OBFUSCATION_PATTERNS) {
+        if (entry.pattern.test(run)) {
+            return {
+                run,
+                description: entry.description,
+            };
+        }
+    }
+    return null;
+}
+export function detectWorkflowObfuscation(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            const match = detectObfuscation(step.run);
+            if (!match) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [match.run, "base64", "eval"],
+                fallbackValue: match.run,
+            });
+            findings.push({
+                rule_id: "workflow-obfuscation",
+                finding_id: `WORKFLOW_OBFUSCATION-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "COMMAND_EXEC",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                description: `Workflow run step uses obfuscated command execution (${match.description})`,
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-506",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Replace obfuscated command pipelines with explicit, reviewable commands and integrity checks",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-overprovisioned-secrets.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowOverprovisionedSecretsInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowOverprovisionedSecrets(input: WorkflowOverprovisionedSecretsInput): Finding[];

package/dist/layer2-static/detectors/workflow-overprovisioned-secrets.js

@@ -0,0 +1,81 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const FULL_SECRETS_SERIALIZATION = /\btojson\s*\(\s*secrets\s*\)/iu;
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function appendPath(base, segment) {
+    if (typeof segment === "number") {
+        return `${base}[${segment}]`;
+    }
+    return base.length > 0 ? `${base}.${segment}` : segment;
+}
+function findSerializedSecrets(value, path) {
+    if (typeof value === "string") {
+        return FULL_SECRETS_SERIALIZATION.test(value) ? { path, value } : null;
+    }
+    if (Array.isArray(value)) {
+        for (let index = 0; index < value.length; index += 1) {
+            const found = findSerializedSecrets(value[index], appendPath(path, index));
+            if (found) {
+                return found;
+            }
+        }
+        return null;
+    }
+    const record = asRecord(value);
+    if (!record) {
+        return null;
+    }
+    for (const [key, child] of Object.entries(record)) {
+        const found = findSerializedSecrets(child, appendPath(path, key));
+        if (found) {
+            return found;
+        }
+    }
+    return null;
+}
+export function detectWorkflowOverprovisionedSecrets(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const found = findSerializedSecrets(input.parsed, "");
+    if (!found) {
+        return [];
+    }
+    const evidence = buildFindingEvidence({
+        textContent: input.textContent,
+        searchTerms: [found.value, "toJSON(secrets)", "toJson(secrets)"],
+        fallbackValue: found.value,
+    });
+    return [
+        {
+            rule_id: "workflow-overprovisioned-secrets",
+            finding_id: `WORKFLOW_OVERPROVISIONED_SECRETS-${input.filePath}`,
+            severity: "HIGH",
+            category: "CI_PERMISSIONS",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: found.path },
+            description: "Workflow serializes the entire secrets context",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-200",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Reference only the specific secrets each step needs instead of serializing the full secrets context",
+            ],
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        },
+    ];
+}

package/dist/layer2-static/detectors/workflow-ref-confusion.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowRefConfusionInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowRefConfusion(input: WorkflowRefConfusionInput): Finding[];

package/dist/layer2-static/detectors/workflow-ref-confusion.js

@@ -0,0 +1,69 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const HASH_PINNED_REF_RE = /^[a-f0-9]{40}$/iu;
+function parseRepositoryUses(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("./") || trimmed.startsWith("docker://")) {
+        return null;
+    }
+    const atIndex = trimmed.lastIndexOf("@");
+    if (atIndex < 0) {
+        return null;
+    }
+    const slug = trimmed.slice(0, atIndex).trim().replace(/\/+$/u, "").toLowerCase();
+    const ref = trimmed.slice(atIndex + 1).trim();
+    if (slug.length === 0 || !slug.includes("/") || ref.length === 0) {
+        return null;
+    }
+    return { slug, ref };
+}
+function isHashPinned(ref) {
+    return HASH_PINNED_REF_RE.test(ref.trim());
+}
+export function detectWorkflowRefConfusion(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    for (const [jobIndex, job] of facts.jobs.entries()) {
+        for (const [stepIndex, step] of job.steps.entries()) {
+            const uses = step.uses?.trim();
+            if (!uses) {
+                continue;
+            }
+            const parsedUses = parseRepositoryUses(uses);
+            if (!parsedUses || isHashPinned(parsedUses.ref)) {
+                continue;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [uses],
+                fallbackValue: `uses: ${uses}`,
+            });
+            findings.push({
+                rule_id: "workflow-ref-confusion",
+                finding_id: `WORKFLOW_REF_CONFUSION-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "HIGH",
+                category: "CI_VULNERABLE_ACTION",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].uses` },
+                description: "Workflow action is pinned to a symbolic ref instead of an immutable commit hash",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-829",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: ["Pin external actions to a full commit SHA"],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        }
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-ref-version-mismatch.d.ts

@@ -0,0 +1,9 @@
+import type { RuntimeMode } from "../../config.js";
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowRefVersionMismatchInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+    runtimeMode?: RuntimeMode;
+}
+export declare function detectWorkflowRefVersionMismatch(input: WorkflowRefVersionMismatchInput): Promise<Finding[]>;