dsh-code-security 0.2.2 → 0.2.3

package/README.en.md

@@ -18,7 +18,7 @@ A DeepSeek Harness plugin for AI code security review: deterministic rule engine
 | `secure_policy_show` | Show .code-security.json | no |
 | `secure_policy_set` | Replace policy JSON | approval |
 
-40+ deterministic rules: injection, deserialization, weak crypto, secrets, dangerous config, sensitive logging, path traversal, SSRF.
+40+ deterministic rules: injection, deserialization, weak crypto (including shell TLS bypass flags), secrets, dangerous config, sensitive logging, path traversal, SSRF.
 
 ```bash
 dsh plugin --profile web add dsh-code-security

package/README.md

@@ -22,7 +22,7 @@ DeepSeek Harness AI 代码安全审查插件：确定性规则引擎 + git diff
 
 - 注入：eval / exec / shell=True / SQL 拼接 / innerHTML
 - 反序列化：pickle / yaml.load / ObjectInputStream / Marshal / unserialize
-- 加密：弱哈希、ECB、硬编码 IV/密钥、JWT none、TLS 校验关闭
+- 加密：弱哈希、ECB、硬编码 IV/密钥、JWT none、TLS 校验关闭、Shell TLS 绕过（curl -k / wget --no-check-certificate / git sslVerify=false）
 - 凭据：硬编码密码、令牌、私钥、高熵密钥
 - 配置：chmod 777、Docker privileged / latest、npm audit=false、CORS *
 - 泄露：敏感日志、错误堆栈外发、路径穿越、SSRF
@@ -59,7 +59,7 @@ secure_deps { target: . }
 ## 工程
 
 ```bash
-pnpm test       # 构建 + 23 个测试
+pnpm test       # 构建 + 24 个测试
 ```
 
 MIT

package/lib/rules.js

@@ -32,6 +32,7 @@ export const RULES = Object.freeze([
     { id: 'SEC-204', title: 'JWT alg none / 不校验签名', cwe: 'CWE-347', severity: 'critical', confidence: 'high', languages: JS, patterns: [/['"]?alg['"]?\s*[:=]\s*['"]?none['"]?/i, /\bjwt\.verify\s*\([^)]*\{\s*algorithms\s*:\s*\[\s*['"]none/i], message: 'JWT 允许 none 算法或未校验签名。' },
     { id: 'SEC-205', title: 'TLS 校验被禁用', cwe: 'CWE-295', severity: 'high', confidence: 'high', languages: ALL, patterns: [/rejectUnauthorized\s*:\s*false/, /\bverify\s*=\s*False/, /InsecureSkipVerify\s*:\s*true/], message: 'TLS 证书校验被显式关闭。' },
     { id: 'SEC-206', title: 'Math.random 用于安全敏感逻辑', cwe: 'CWE-330', severity: 'low', confidence: 'low', languages: JS, patterns: [/\bMath\.random\s*\(/], message: '使用非密码学安全的 Math.random。' },
+    { id: 'SEC-207', title: 'Shell 关闭 TLS 证书校验', cwe: 'CWE-295', severity: 'high', confidence: 'high', languages: SHELL, patterns: [/\bcurl\b[^\n]*(?:-k\b|--insecure\b)/, /\bwget\b[^\n]*--no-check-certificate\b/, /\bgit\b[^\n]*-c\s+http\.sslVerify\s*=\s*false\b/i, /\bnpm\b[^\n]*--strict-ssl\s*=\s*false\b/i], message: '命令行下载/访问工具关闭了 TLS 证书校验。' },
     { id: 'SEC-301', title: '硬编码密码', cwe: 'CWE-798', severity: 'critical', confidence: 'high', languages: ALL, patterns: [/(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{4,}['"]/i], message: '密码以明文硬编码在源码中。' },
     { id: 'SEC-302', title: '硬编码令牌 / API 密钥', cwe: 'CWE-798', severity: 'high', confidence: 'medium', languages: ALL, patterns: [/(?:api[_-]?key|secret[_-]?key|access[_-]?key|auth[_-]?token)\s*[:=]\s*['"][A-Za-z0-9_\-]{16,}['"]/i], message: '访问令牌或 API 密钥以字面量硬编码。' },
     { id: 'SEC-303', title: '私钥材料', cwe: 'CWE-798', severity: 'critical', confidence: 'high', languages: ALL, patterns: [/-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/], message: '检测到私钥文件内容。', fileLevel: true },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-security",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "DSH AI 代码安全审查插件：secure_scan/secure_diff/secure_fix_verify/secure_report/secure_export/secure_baseline/secure_deps/secure_policy_show/secure_policy_set 九工具，40+ 确定性规则、密钥熵检测、git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite，零运行时依赖。",
   "type": "module",
   "main": "lib/index.js",