correctover-scan 3.2.0 → 3.2.2

package/core/bundle-scanner.js

@@ -195,7 +195,11 @@ const METADATA_HOSTS = /metadata\.google(?:\.internal)?|169\.254\.|fd00:ec2/i;
 
 // Context that proves a 169.254/private address is a cloud SDK credential
 // provider (normal) rather than business-code SSRF (finding).
-const SDK_CTX = /(aws|amazon|ec2|ecs|eks|imds|metadata\s*(service|endpoint|host)|credentialprovider|container\s*credentials|ecr|sts\.)/i;
+// Strong signals only: the metadata address must actually sit inside a cloud
+// SDK credential-provider call. A bare AWS_/GCP env-var name nearby is NOT
+// proof of SDK usage — it often co-occurs with a hand-rolled SSRF and used to
+// wrongly suppress it. Keep this narrow to avoid false negatives.
+const SDK_CTX = /(aws-sdk|@aws-sdk|amazon-cognito|aws4fetch|fromNodeProviderChain|fromIni|ECSCredentials|EC2MetadataClient|instanceMetadataService|metadataService\b|[A-Za-z_$][\w$]*[Mm]etadata\s*[=(]|metadata\s*(?:service|endpoint)\s*[:=]|credentialprovider|credential[ _-]?provider|credentials?\s*(?:chain|from)|container\s*credentials|sts\.|gcp-metadata|google-auth-library)/i;
 // Context that proves the address sits inside an SSRF guard / blocklist.
 // Actual guard constructs (a bare "ssrf" word in a comment is not a guard).
 const GUARD_CTX = /(no_?proxy|blocklist|block_list|denylist|deny_list|allowlist|preflight|isPrivate|private[_-]?ip|loopback|metadata.{0,30}(block|deny|filter|redirect))/i;
@@ -391,7 +395,9 @@ function checkMetadataIntranet(file) {
       seen.add(target + ':' + i);
       const ctx = lineWindow(file.lines, i);
       const isMetadata = /^169\.254\./.test(target) || /metadata\.google/i.test(target) || /fd00:ec2/i.test(target);
-      const inSdk = SDK_CTX.test(ctx) || /SECONDARY_HOST_ADDRESS|gcp|google/i.test(ctx);
+      // Bare "gcp"/"google" words are too weak and suppress real SSRFs; require
+      // concrete SDK/host markers instead (SDK_CTX already covers the strong ones).
+      const inSdk = SDK_CTX.test(ctx) || /SECONDARY_HOST_ADDRESS|gcp-metadata|metadata\.google(?:\.internal)?/.test(ctx);
       const inGuard = GUARD_CTX.test(ctx);
       let sev, msg, suppressed = false;
       if (inSdk) {
@@ -417,7 +423,7 @@ function checkMetadataIntranet(file) {
 function checkCommandExec(file) {
   const findings = [];
   const shellTrue = /shell\s*:\s*(?:!0|true)/;
-  const execCall = /(^|[^.\w$])(?:exec|execSync)\s*\(/;
+  const execCall = /(?<![\w$])(?:exec|execSync)\s*\(/;
   const gatedRe = /(permission[A-Z]|permission[ _-]?(?:check|mode|behavior|behaviour|prompt|decision|system|gate)|allowedTools|disallowedTools|shell-quote|shellQuote|\.quote\(|PreToolUse|PostToolUse|hookEventName|"Bash"|Bash tool|isCommandAllowed|canUseBash|checkPermissions|permissionRule|toolPermission)/i;
   const buildRe = /(node-gyp|npm install|install script|spawnSync\(\s*["'`])(?:[a-z\-]+ )?[a-z\-]+(?:\s|["'`])/i;
   // call site where the command arg is a fixed literal ("cmd ...")
@@ -456,9 +462,14 @@ function checkCommandExec(file) {
       if (seen.has('exec:' + i)) return;
       seen.add('exec:' + i);
       const ctx = lineWindow(file.lines, i);
-      const looksDynamic = dynamicCmd.test(line) || /\$\{/.test(ctx);
+      // Variable passed straight through as the command arg, e.g. exec(userInput)
+      // or execSync(cmd, opts) — no template/concat syntax but still fully
+      // attacker-controllable. String literals are excluded by the identifier
+      // pattern; method chains like obj.execute(x) are not matched (execCall).
+      const varArg = /(?:exec|execSync)\s*\(\s*[A-Za-z_$][\w$]*\s*[,\)]/.test(line);
+      const looksDynamic = dynamicCmd.test(line) || /\$\{/.test(ctx) || varArg;
       findings.push(mkFinding(file, i + 1, looksDynamic ? 'warn' : 'info',
-        `child_process exec/execSync 调用（始终经 shell）${looksDynamic ? '，参数疑似动态拼接 — 检查注入面' : '，参数为静态/库内字符串'}`,
+        `child_process exec/execSync 调用（始终经 shell）${looksDynamic ? '，命令参数疑似动态/外部输入 — 检查命令注入面' : '，参数为静态/库内字符串'}`,
         { suppressed: !looksDynamic, snippet: snippet(line), checkId: 'command-exec' }));
     }
   });

package/index.js

@@ -15,7 +15,7 @@ const { recordCall, getUpgradeMessage } = require('./core/license');
 const skillpay = require('./core/skillpay');
 const { formatHTMLReport, normalizeConfigFindings, normalizeBundleFindings, failHint } = require('./core/report');
 
-const VERSION = '3.2.0';
+const VERSION = '3.2.2';
 const PRODUCT = 'correctover-scan';
 const JS_EXT = new Set(['.js', '.mjs', '.cjs', '.ts']);
 
@@ -373,10 +373,13 @@ function runBundleMode(target, format, outFile) {
   }
   if (files.length === 0) {
     diag(`${c.yellow}No JavaScript files (.js/.mjs/.cjs) found under ${target}.${c.reset}`);
-    process.exit(0);
+    diag(`${c.dim}Emitting an empty (zero-result) report${outFile ? ` to ${outFile}` : ''}.${c.reset}\n`);
+  } else {
+    diag(`${c.dim}Bundle mode: ${files.length} JS file(s) under ${target}${c.reset}\n`);
   }
-  diag(`${c.dim}Bundle mode: ${files.length} JS file(s) under ${target}${c.reset}\n`);
 
+  // An empty file list yields a valid zero-finding bundle (score 100) so that
+  // SARIF/JSON consumers downstream never see a missing artifact.
   const bundle = runBundleScan(files, baseDir);
   const label = path.relative(process.cwd(), abs) || abs;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "correctover-scan",
-  "version": "3.2.0",
+  "version": "3.2.2",
   "description": "Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.",
   "main": "index.js",
   "bin": {