configsentry 0.0.26 → 0.0.27

package/dist/rules.js

@@ -1,4 +1,43 @@
 const SENSITIVE_PORTS = new Set([5432, 3306, 6379, 27017, 9200]);
+const SECRET_KEY_RE = /(pass(word)?|secret|token|api[_-]?key|private[_-]?key)/i;
+const PLACEHOLDER_VALUE_RE = /^(changeme|change-me|password|secret|token|example|example_password|yourpassword|your_password|replace_me|replace-me|TODO)$/i;
+function extractEnv(svc) {
+    const env = svc?.environment;
+    const res = [];
+    // environment:
+    //   KEY: value
+    // or
+    // environment:
+    //   - KEY=value
+    //   - KEY
+    if (env && typeof env === 'object' && !Array.isArray(env)) {
+        for (const [k, v] of Object.entries(env)) {
+            if (typeof k !== 'string')
+                continue;
+            if (v == null)
+                continue;
+            res.push({ key: k, value: String(v), raw: `${k}=${String(v)}` });
+        }
+        return res;
+    }
+    if (Array.isArray(env)) {
+        for (const item of env) {
+            if (typeof item !== 'string')
+                continue;
+            const idx = item.indexOf('=');
+            if (idx === -1) {
+                // KEY (value from environment at runtime) — not a hardcoded secret
+                continue;
+            }
+            const key = item.slice(0, idx);
+            const value = item.slice(idx + 1);
+            if (!key)
+                continue;
+            res.push({ key, value, raw: item });
+        }
+    }
+    return res;
+}
 function normalizePorts(ports) {
     if (!Array.isArray(ports))
         return [];
@@ -261,6 +300,27 @@ export function runRules(compose, targetPath) {
                 suggestion: 'Set user: "1000:1000" (or a dedicated UID/GID) and ensure the image supports running unprivileged.'
             });
         }
+        // Rule: hardcoded secrets in environment
+        for (const { key, value, raw } of extractEnv(svc)) {
+            if (!SECRET_KEY_RE.test(key))
+                continue;
+            const v = String(value).trim();
+            if (v.length === 0)
+                continue;
+            // ${VAR} / ${VAR:-default} / ${VAR?err}
+            if (v.startsWith('${') && v.endsWith('}'))
+                continue;
+            const placeholder = PLACEHOLDER_VALUE_RE.test(v) || v.toLowerCase().includes('changeme');
+            findings.push({
+                id: 'compose.hardcoded-secret',
+                title: 'Possible hardcoded secret in compose environment',
+                severity: placeholder ? 'medium' : 'high',
+                message: `Service '${serviceName}' sets '${key}' to a literal value in environment ('${raw}').`,
+                service: serviceName,
+                path: `${targetPath}#services.${serviceName}.environment`,
+                suggestion: 'Avoid committing secrets in docker-compose.yml. Prefer ${VAR} with a .env file (gitignored) or Docker secrets where supported.'
+            });
+        }
         // Rule: filesystem not read-only (hardening)
         // Low severity because many images expect write access unless explicitly designed for read-only.
         if (svc?.read_only !== true) {
@@ -274,6 +334,41 @@ export function runRules(compose, targetPath) {
                 suggestion: 'Consider setting read_only: true + add explicit writable mounts (e.g. tmpfs:/tmp or a data volume) if the app supports it.'
             });
         }
+        // Rule: floating / unpinned image tags
+        const image = svc?.image;
+        if (typeof image === 'string' && image.trim() !== '') {
+            // If pinned by digest, it's reproducible.
+            if (!image.includes('@')) {
+                const lastSlash = image.lastIndexOf('/');
+                const lastColon = image.lastIndexOf(':');
+                const hasTag = lastColon > lastSlash;
+                if (!hasTag) {
+                    findings.push({
+                        id: 'compose.image-floating-tag',
+                        title: 'Image tag not pinned',
+                        severity: 'medium',
+                        message: `Service '${serviceName}' uses an image without an explicit tag ('${image}').`,
+                        service: serviceName,
+                        path: `${targetPath}#services.${serviceName}.image`,
+                        suggestion: "Pin the image to a version tag (e.g. 'nginx:1.27') or a digest (e.g. 'nginx@sha256:...') for reproducible deployments."
+                    });
+                }
+                else {
+                    const tag = image.slice(lastColon + 1).trim();
+                    if (tag.toLowerCase() === 'latest') {
+                        findings.push({
+                            id: 'compose.image-floating-tag',
+                            title: 'Image tag not pinned',
+                            severity: 'medium',
+                            message: `Service '${serviceName}' uses a floating image tag ('${image}').`,
+                            service: serviceName,
+                            path: `${targetPath}#services.${serviceName}.image`,
+                            suggestion: "Pin the image to a version tag (e.g. 'nginx:1.27') or a digest (e.g. 'nginx@sha256:...') for reproducible deployments."
+                        });
+                    }
+                }
+            }
+        }
         // Rule: exposed sensitive ports
         const ports = normalizePorts(svc?.ports);
         for (const p of ports) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "configsentry",
-  "version": "0.0.26",
+  "version": "0.0.27",
   "description": "Developer-first guardrails for docker-compose.yml (security + ops footguns).",
   "type": "module",
   "license": "MIT",