codegate-ai 0.9.1 → 0.10.0

package/dist/layer2-static/detectors/workflow-oidc-untrusted-context.js

@@ -0,0 +1,166 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { collectUntrustedReachableJobIds } from "../workflow/analysis.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const CLOUD_AUTH_ACTIONS = new Set([
+    "aws-actions/configure-aws-credentials",
+    "azure/login",
+    "google-github-actions/auth",
+]);
+const AUDIENCE_KEYS = new Set(["audience", "token_audience", "id_token_audience"]);
+function hasWritePermission(value) {
+    if (typeof value === "string") {
+        return value.trim().toLowerCase() === "write-all";
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    return Object.entries(value).some(([key, permission]) => {
+        if (key.trim().toLowerCase() === "id-token") {
+            return false;
+        }
+        if (typeof permission !== "string") {
+            return false;
+        }
+        return permission.trim().toLowerCase() === "write";
+    });
+}
+function hasIdTokenWrite(value) {
+    if (typeof value === "string") {
+        return value.trim().toLowerCase() === "write-all";
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    const record = value;
+    const idTokenPermission = record["id-token"];
+    return (typeof idTokenPermission === "string" && idTokenPermission.trim().toLowerCase() === "write");
+}
+function normalizeUses(value) {
+    if (!value) {
+        return null;
+    }
+    const normalized = value.trim().toLowerCase();
+    if (normalized.length === 0) {
+        return null;
+    }
+    const atIndex = normalized.indexOf("@");
+    return atIndex === -1 ? normalized : normalized.slice(0, atIndex);
+}
+function hasCloudOidcAuthStep(jobSteps) {
+    return jobSteps.some((step) => {
+        const normalizedUses = normalizeUses(step.uses);
+        return normalizedUses ? CLOUD_AUTH_ACTIONS.has(normalizedUses) : false;
+    });
+}
+function hasAudienceConstraint(jobSteps) {
+    return jobSteps.some((step) => {
+        const withRecord = step.with;
+        if (!withRecord) {
+            return false;
+        }
+        return Object.entries(withRecord).some(([key, value]) => {
+            if (!AUDIENCE_KEYS.has(key.trim().toLowerCase())) {
+                return false;
+            }
+            return value.trim().length > 0;
+        });
+    });
+}
+function hasActorConstraint(condition) {
+    const normalized = condition.toLowerCase();
+    return (normalized.includes("github.actor") ||
+        normalized.includes("github.triggering_actor") ||
+        normalized.includes("github.event.pull_request.user.login"));
+}
+function hasRepositoryOrRefConstraint(condition) {
+    const normalized = condition.toLowerCase();
+    return (normalized.includes("github.repository") ||
+        normalized.includes("github.event.pull_request.head.repo.full_name") ||
+        normalized.includes("github.event.pull_request.head.repo.fork") ||
+        normalized.includes("github.ref") ||
+        normalized.includes("github.base_ref") ||
+        normalized.includes("github.event.pull_request.base.ref"));
+}
+function hasStrictTrustChecks(condition) {
+    if (!condition) {
+        return false;
+    }
+    return hasActorConstraint(condition) && hasRepositoryOrRefConstraint(condition);
+}
+export function detectWorkflowOidcUntrustedContext(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const reachableJobIds = collectUntrustedReachableJobIds(facts);
+    if (reachableJobIds.size === 0) {
+        return [];
+    }
+    const findings = [];
+    const workflowHasIdTokenWrite = hasIdTokenWrite(facts.workflowPermissions);
+    facts.jobs.forEach((job, jobIndex) => {
+        if (!reachableJobIds.has(job.id)) {
+            return;
+        }
+        const jobHasIdTokenWrite = workflowHasIdTokenWrite || hasIdTokenWrite(job.permissions);
+        if (!jobHasIdTokenWrite) {
+            return;
+        }
+        const strictTrustChecks = hasStrictTrustChecks(job.if);
+        const cloudAuthDetected = hasCloudOidcAuthStep(job.steps);
+        const hasAudience = hasAudienceConstraint(job.steps);
+        if (strictTrustChecks && hasAudience) {
+            return;
+        }
+        const evidence = buildFindingEvidence({
+            textContent: input.textContent,
+            searchTerms: [
+                "id-token: write",
+                "permissions",
+                "audience",
+                "github.actor",
+                "github.repository",
+            ],
+            fallbackValue: `${job.id} enables id-token write in untrusted trigger context`,
+        });
+        findings.push({
+            rule_id: "workflow-oidc-untrusted-context",
+            finding_id: `WORKFLOW_OIDC_UNTRUSTED_CONTEXT-${input.filePath}-${jobIndex}`,
+            severity: hasWritePermission(job.permissions) || hasWritePermission(facts.workflowPermissions)
+                ? "CRITICAL"
+                : "HIGH",
+            category: "CI_PERMISSIONS",
+            layer: "L2",
+            file_path: input.filePath,
+            location: { field: `jobs.${job.id}.permissions.id-token` },
+            description: "Workflow enables OIDC token minting in an untrusted trigger context without strict trust boundaries",
+            affected_tools: ["github-actions"],
+            cve: null,
+            owasp: ["ASI02"],
+            cwe: "CWE-284",
+            confidence: "HIGH",
+            fixable: false,
+            remediation_actions: [
+                "Restrict id-token: write to trusted branches or trusted workflow_call boundaries",
+                "Require explicit actor and repository/ref checks on untrusted triggers",
+                cloudAuthDetected
+                    ? "Configure explicit audience constraints for cloud authentication actions"
+                    : "Add audience constraints and scoped trust conditions before minting OIDC tokens",
+            ],
+            metadata: {
+                risk_tags: [
+                    strictTrustChecks ? "strict-trust-checks" : "missing-strict-trust-checks",
+                    hasAudience ? "audience-constrained" : "missing-audience-constraint",
+                    cloudAuthDetected ? "cloud-auth-step" : "generic-oidc",
+                ],
+                origin: "workflow-audit",
+            },
+            evidence: evidence?.evidence ?? null,
+            suppressed: false,
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-pr-target-checkout-head.d.ts

@@ -0,0 +1,7 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowPrTargetCheckoutHeadInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+}
+export declare function detectWorkflowPrTargetCheckoutHead(input: WorkflowPrTargetCheckoutHeadInput): Finding[];

package/dist/layer2-static/detectors/workflow-pr-target-checkout-head.js

@@ -0,0 +1,99 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { collectUntrustedReachableJobIds } from "../workflow/analysis.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+function hasWritePermission(value) {
+    if (typeof value === "string") {
+        return value.trim().toLowerCase() === "write-all";
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    return Object.values(value).some((permission) => {
+        if (typeof permission !== "string") {
+            return false;
+        }
+        return permission.trim().toLowerCase() === "write";
+    });
+}
+function isCheckoutStep(uses) {
+    if (!uses) {
+        return false;
+    }
+    return /^actions\/checkout(?:@.+)?$/iu.test(uses.trim());
+}
+function isRiskyCheckoutRef(ref) {
+    if (!ref) {
+        return false;
+    }
+    const normalized = ref.toLowerCase();
+    return (normalized.includes("github.event.pull_request.head.") || normalized.includes("github.head_ref"));
+}
+function hasInheritedSecrets(secrets) {
+    return typeof secrets === "string" && secrets.trim().toLowerCase() === "inherit";
+}
+export function detectWorkflowPrTargetCheckoutHead(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const hasPullRequestTarget = facts.triggers.some((trigger) => trigger.trim().toLowerCase() === "pull_request_target");
+    if (!hasPullRequestTarget) {
+        return [];
+    }
+    const reachableJobIds = collectUntrustedReachableJobIds(facts);
+    if (reachableJobIds.size === 0) {
+        return [];
+    }
+    const findings = [];
+    const workflowPrivileged = hasWritePermission(facts.workflowPermissions);
+    facts.jobs.forEach((job, jobIndex) => {
+        if (!reachableJobIds.has(job.id)) {
+            return;
+        }
+        const jobPrivileged = workflowPrivileged || hasWritePermission(job.permissions) || hasInheritedSecrets(job.secrets);
+        job.steps.forEach((step, stepIndex) => {
+            if (!isCheckoutStep(step.uses)) {
+                return;
+            }
+            if (!isRiskyCheckoutRef(step.with?.ref)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: [
+                    "pull_request_target",
+                    "actions/checkout",
+                    step.with?.ref ?? "github.event.pull_request.head",
+                ],
+                fallbackValue: "pull_request_target workflow checks out untrusted PR head ref",
+            });
+            findings.push({
+                rule_id: "workflow-pr-target-checkout-head",
+                finding_id: `WORKFLOW_PR_TARGET_CHECKOUT_HEAD-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: jobPrivileged ? "CRITICAL" : "HIGH",
+                category: "CI_TRIGGER",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].with.ref` },
+                description: "pull_request_target job checks out pull request head ref, enabling untrusted code execution in privileged context",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-284",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Avoid checking out pull request head refs in pull_request_target workflows",
+                    "Use pull_request for untrusted code validation and keep privileged operations isolated",
+                    "Enforce least-privilege token scopes and avoid inherited secrets for untrusted paths",
+                ],
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/detectors/workflow-secret-exfiltration.d.ts

@@ -0,0 +1,8 @@
+import type { Finding } from "../../types/finding.js";
+export interface WorkflowSecretExfiltrationInput {
+    filePath: string;
+    parsed: unknown;
+    textContent: string;
+    trustedApiDomains: string[];
+}
+export declare function detectWorkflowSecretExfiltration(input: WorkflowSecretExfiltrationInput): Finding[];

package/dist/layer2-static/detectors/workflow-secret-exfiltration.js

@@ -0,0 +1,97 @@
+import { buildFindingEvidence } from "../evidence.js";
+import { extractWorkflowFacts, isGitHubWorkflowPath } from "../workflow/parser.js";
+const OUTBOUND_COMMAND_PATTERN = /\b(curl|wget|invoke-webrequest|httpie)\b/iu;
+const SECRET_REFERENCE_PATTERN = /\$\{\{\s*secrets\.([a-zA-Z0-9_]+)\s*\}\}/giu;
+const URL_PATTERN = /https?:\/\/[^\s"')]+/giu;
+function extractSecretReferences(value) {
+    const references = new Set();
+    for (const match of value.matchAll(SECRET_REFERENCE_PATTERN)) {
+        const key = match[1]?.trim();
+        if (!key) {
+            continue;
+        }
+        references.add(key);
+    }
+    return Array.from(references);
+}
+function extractUrls(value) {
+    return Array.from(value.matchAll(URL_PATTERN), (match) => match[0] ?? "").filter(Boolean);
+}
+function isTrustedHost(hostname, trustedApiDomains) {
+    const normalizedHost = hostname.toLowerCase();
+    return trustedApiDomains.some((domain) => {
+        const normalizedDomain = domain.toLowerCase();
+        return normalizedHost === normalizedDomain || normalizedHost.endsWith(`.${normalizedDomain}`);
+    });
+}
+function hasOnlyTrustedUrls(run, trustedApiDomains) {
+    const urls = extractUrls(run);
+    if (urls.length === 0) {
+        return false;
+    }
+    return urls.every((url) => {
+        try {
+            const parsed = new URL(url);
+            return isTrustedHost(parsed.hostname, trustedApiDomains);
+        }
+        catch {
+            return false;
+        }
+    });
+}
+export function detectWorkflowSecretExfiltration(input) {
+    if (!isGitHubWorkflowPath(input.filePath)) {
+        return [];
+    }
+    const facts = extractWorkflowFacts(input.parsed);
+    if (!facts) {
+        return [];
+    }
+    const findings = [];
+    facts.jobs.forEach((job, jobIndex) => {
+        job.steps.forEach((step, stepIndex) => {
+            if (!step.run || !OUTBOUND_COMMAND_PATTERN.test(step.run)) {
+                return;
+            }
+            const referencedSecrets = extractSecretReferences(step.run);
+            if (referencedSecrets.length === 0) {
+                return;
+            }
+            if (hasOnlyTrustedUrls(step.run, input.trustedApiDomains)) {
+                return;
+            }
+            const evidence = buildFindingEvidence({
+                textContent: input.textContent,
+                searchTerms: ["secrets.", "curl", "wget", "http://", "https://"],
+                fallbackValue: `${job.id} step references secrets in outbound network command`,
+            });
+            findings.push({
+                rule_id: "workflow-secret-exfiltration",
+                finding_id: `WORKFLOW_SECRET_EXFILTRATION-${input.filePath}-${jobIndex}-${stepIndex}`,
+                severity: "CRITICAL",
+                category: "CI_PERMISSIONS",
+                layer: "L2",
+                file_path: input.filePath,
+                location: { field: `jobs.${job.id}.steps[${stepIndex}].run` },
+                description: "Workflow step sends secret context through outbound network command",
+                affected_tools: ["github-actions"],
+                cve: null,
+                owasp: ["ASI02"],
+                cwe: "CWE-200",
+                confidence: "HIGH",
+                fixable: false,
+                remediation_actions: [
+                    "Avoid sending secrets through outbound shell commands",
+                    "Use trusted first-party actions with scoped credentials instead of ad-hoc exfil-prone scripts",
+                    "Restrict outbound domains and sanitize command arguments in privileged workflows",
+                ],
+                metadata: {
+                    referenced_secrets: referencedSecrets,
+                },
+                evidence: evidence?.evidence ?? null,
+                suppressed: false,
+            });
+        });
+    });
+    return findings;
+}

package/dist/layer2-static/engine.js

@@ -41,6 +41,14 @@ import { detectDependabotExecution } from "./detectors/dependabot-execution.js";
 import { detectWorkflowHardcodedContainerCredentials } from "./detectors/workflow-hardcoded-container-credentials.js";
 import { detectWorkflowUnredactedSecrets } from "./detectors/workflow-unredacted-secrets.js";
 import { detectWorkflowBotConditions } from "./detectors/workflow-bot-conditions.js";
+import { detectWorkflowPrTargetCheckoutHead } from "./detectors/workflow-pr-target-checkout-head.js";
+import { detectWorkflowArtifactTrustChain } from "./detectors/workflow-artifact-trust-chain.js";
+import { detectWorkflowCallBoundary } from "./detectors/workflow-call-boundary.js";
+import { detectWorkflowSecretExfiltration } from "./detectors/workflow-secret-exfiltration.js";
+import { detectWorkflowOidcUntrustedContext } from "./detectors/workflow-oidc-untrusted-context.js";
+import { detectWorkflowDynamicMatrixInjection } from "./detectors/workflow-dynamic-matrix-injection.js";
+import { detectDependabotAutoMerge } from "./detectors/dependabot-auto-merge.js";
+import { detectWorkflowLocalActionMutation } from "./detectors/workflow-local-action-mutation.js";
 import { filterRegisteredAudits } from "./audits/registry.js";
 import { FINDING_CATEGORIES } from "../types/finding.js";
 import { buildFindingEvidence } from "./evidence.js";
@@ -536,6 +544,87 @@ function buildFileAudits() {
                 })
                 : [],
         },
+        {
+            id: "workflow-pr-target-checkout-head",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowPrTargetCheckoutHead({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-artifact-trust-chain",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowArtifactTrustChain({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-call-boundary",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowCallBoundary({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-secret-exfiltration",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowSecretExfiltration({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                    trustedApiDomains: input.config.trustedApiDomains,
+                })
+                : [],
+        },
+        {
+            id: "workflow-oidc-untrusted-context",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowOidcUntrustedContext({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-dynamic-matrix-injection",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowDynamicMatrixInjection({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "dependabot-auto-merge",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectDependabotAutoMerge({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-local-action-mutation",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowLocalActionMutation({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
         {
             id: "hardcoded-container-credentials",
             run: ({ file, input }) => input.config.workflowAuditsEnabled

package/dist/layer2-static/workflow/analysis.d.ts

@@ -0,0 +1,24 @@
+import type { WorkflowFacts } from "./types.js";
+export interface WorkflowArtifactTransferEdge {
+    artifactName: string;
+    producerJobId: string;
+    producerStepIndex: number;
+    consumerJobId: string;
+    consumerStepIndex: number;
+    consumerDownloadsAll: boolean;
+}
+export interface WorkflowCallBoundaryContext {
+    hasWorkflowCall: boolean;
+    declaredInputKeys: string[];
+    requiredInputKeys: string[];
+    declaredSecretKeys: string[];
+    requiredSecretKeys: string[];
+    jobsWithInheritedSecrets: string[];
+    jobsCallingReusableWorkflow: string[];
+}
+export declare function buildWorkflowNeedsGraph(facts: WorkflowFacts): Map<string, string[]>;
+export declare function collectTransitiveDependencies(facts: WorkflowFacts, seedJobIds: Iterable<string>): Set<string>;
+export declare function collectTransitiveDependents(facts: WorkflowFacts, seedJobIds: Iterable<string>): Set<string>;
+export declare function collectArtifactTransferEdges(facts: WorkflowFacts): WorkflowArtifactTransferEdge[];
+export declare function collectUntrustedReachableJobIds(facts: WorkflowFacts): Set<string>;
+export declare function extractWorkflowCallBoundaryContext(parsed: unknown, facts: WorkflowFacts): WorkflowCallBoundaryContext;