dsh-code-security 0.2.2 → 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 stardustlc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.en.md

@@ -18,10 +18,13 @@ A DeepSeek Harness plugin for AI code security review: deterministic rule engine
 | `secure_policy_show` | Show .code-security.json | no |
 | `secure_policy_set` | Replace policy JSON | approval |
 
-40+ deterministic rules: injection, deserialization, weak crypto, secrets, dangerous config, sensitive logging, path traversal, SSRF.
+40+ deterministic rules: injection, deserialization, weak crypto (including shell TLS bypass flags), secrets, dangerous config, sensitive logging, path traversal, SSRF.
 
 ```bash
 dsh plugin --profile web add dsh-code-security
 ```
 
 MIT
+## License
+
+MIT (see [LICENSE](LICENSE))

package/README.md

@@ -22,19 +22,32 @@ DeepSeek Harness AI 代码安全审查插件：确定性规则引擎 + git diff
 
 - 注入：eval / exec / shell=True / SQL 拼接 / innerHTML
 - 反序列化：pickle / yaml.load / ObjectInputStream / Marshal / unserialize
-- 加密：弱哈希、ECB、硬编码 IV/密钥、JWT none、TLS 校验关闭
+- 加密：弱哈希、ECB、硬编码 IV/密钥、JWT none、TLS 校验关闭、Shell TLS 绕过（curl -k / wget --no-check-certificate / git sslVerify=false）
 - 凭据：硬编码密码、令牌、私钥、高熵密钥
 - 配置：chmod 777、Docker privileged / latest、npm audit=false、CORS *
 - 泄露：敏感日志、错误堆栈外发、路径穿越、SSRF
 
 发现只包含客观证据与 CWE 编号，不附修复建议——修复方案由 agent 基于证据生成。
 
+## 兼容性
+
+在 `@deepseek-ai/dsh@0.1.1-rc.2` 上验证（2026-08-26）。遵循 cordis 组合包补丁模型（`cordis.patch.yml` + `dsh.bundle.patch`），运行时不 import 任何 `@deepseek-ai/*` 内部模块。
+
 ## 安装
 
 ```bash
 dsh plugin --profile web add dsh-code-security
 ```
 
+## 卸载
+
+```bash
+dsh plugin --profile web remove dsh-code-security
+```
+
+卸载后重启 Web 服务。如需彻底清理，可再手动删除自己 profile `cordis.patch.yml` 中覆盖的插件行。
+
+
 ## 使用
 
 ```text
@@ -59,7 +72,10 @@ secure_deps { target: . }
 ## 工程
 
 ```bash
-pnpm test       # 构建 + 23 个测试
+pnpm test       # 构建 + 24 个测试
 ```
 
 MIT
+## License
+
+MIT（见 [LICENSE](LICENSE)）

package/lib/index.d.ts

@@ -10,6 +10,7 @@
 import { type SecureConfig } from './config.js';
 import { type SubprocessSpawnLike } from './runner.js';
 import { type SecureToolDefinition } from './tools.js';
+export declare const name = "code-security";
 export declare const inject: string[];
 export interface SecurePluginContext {
     subprocess: {

package/lib/index.js

@@ -10,6 +10,7 @@
 import { resolveConfig } from './config.js';
 import { createSubprocessRunner } from './runner.js';
 import { buildSecureTools } from './tools.js';
+export const name = 'code-security';
 export const inject = ['tools', 'subprocess'];
 export function apply(ctx, config) {
     let cfg;

package/lib/rules.js

@@ -28,10 +28,11 @@ export const RULES = Object.freeze([
     { id: 'SEC-105', title: 'PHP 反序列化', cwe: 'CWE-502', severity: 'high', confidence: 'medium', languages: ['php'], patterns: [/\bunserialize\s*\(/], message: 'unserialize 处理不可信输入。' },
     { id: 'SEC-201', title: '弱哈希用于安全场景', cwe: 'CWE-328', severity: 'high', confidence: 'medium', languages: ALL, patterns: [/\bcreateHash\s*\(\s*['"]?(?:md5|sha1)['"]?/i, /\bhashlib\.(?:md5|sha1)\s*\(/i, /\b(?:md5|sha1)(?:sum)?\s+/i], message: '使用 MD5 / SHA1 弱哈希。' },
     { id: 'SEC-202', title: 'ECB 分组加密模式', cwe: 'CWE-327', severity: 'high', confidence: 'medium', languages: ALL, patterns: [/aes[-_/]?\d*[-_/]?ecb/i, /['"]AES\/ECB/i], message: '使用 ECB 加密模式。' },
-    { id: 'SEC-203', title: '硬编码 IV / 密钥', cwe: 'CWE-321', severity: 'high', confidence: 'medium', languages: ALL, patterns: [/\.createCipheriv?\s*\([^)]*['"][A-Za-z0-9+/=]{12,}['"]/, /\b(?:iv|key|secret)\s*[:=]\s*['"][A-Za-z0-9+/=]{16,}['"]/i], message: '加密密钥或 IV 以字面量硬编码。' },
+    { id: 'SEC-203', title: '硬编码 IV / 密钥', cwe: 'CWE-321', severity: 'high', confidence: 'medium', languages: ALL, patterns: [/\.createCipher(?:iv)?\s*\([^)]*['"][A-Za-z0-9+/=]{12,}['"]/, /\b(?:iv|key|secret)\s*[:=]\s*['"][A-Za-z0-9+/=]{16,}['"]/i], message: '加密密钥或 IV 以字面量硬编码。' },
     { id: 'SEC-204', title: 'JWT alg none / 不校验签名', cwe: 'CWE-347', severity: 'critical', confidence: 'high', languages: JS, patterns: [/['"]?alg['"]?\s*[:=]\s*['"]?none['"]?/i, /\bjwt\.verify\s*\([^)]*\{\s*algorithms\s*:\s*\[\s*['"]none/i], message: 'JWT 允许 none 算法或未校验签名。' },
     { id: 'SEC-205', title: 'TLS 校验被禁用', cwe: 'CWE-295', severity: 'high', confidence: 'high', languages: ALL, patterns: [/rejectUnauthorized\s*:\s*false/, /\bverify\s*=\s*False/, /InsecureSkipVerify\s*:\s*true/], message: 'TLS 证书校验被显式关闭。' },
     { id: 'SEC-206', title: 'Math.random 用于安全敏感逻辑', cwe: 'CWE-330', severity: 'low', confidence: 'low', languages: JS, patterns: [/\bMath\.random\s*\(/], message: '使用非密码学安全的 Math.random。' },
+    { id: 'SEC-207', title: 'Shell 关闭 TLS 证书校验', cwe: 'CWE-295', severity: 'high', confidence: 'high', languages: SHELL, patterns: [/\bcurl\b[^\n]*(?:-k\b|--insecure\b)/, /\bwget\b[^\n]*--no-check-certificate\b/, /\bgit\b[^\n]*-c\s+http\.sslVerify\s*=\s*false\b/i, /\bnpm\b[^\n]*--strict-ssl\s*=\s*false\b/i], message: '命令行下载/访问工具关闭了 TLS 证书校验。' },
     { id: 'SEC-301', title: '硬编码密码', cwe: 'CWE-798', severity: 'critical', confidence: 'high', languages: ALL, patterns: [/(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{4,}['"]/i], message: '密码以明文硬编码在源码中。' },
     { id: 'SEC-302', title: '硬编码令牌 / API 密钥', cwe: 'CWE-798', severity: 'high', confidence: 'medium', languages: ALL, patterns: [/(?:api[_-]?key|secret[_-]?key|access[_-]?key|auth[_-]?token)\s*[:=]\s*['"][A-Za-z0-9_\-]{16,}['"]/i], message: '访问令牌或 API 密钥以字面量硬编码。' },
     { id: 'SEC-303', title: '私钥材料', cwe: 'CWE-798', severity: 'critical', confidence: 'high', languages: ALL, patterns: [/-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/], message: '检测到私钥文件内容。', fileLevel: true },
@@ -61,15 +62,15 @@ export const RULES = Object.freeze([
 ]);
 /** 规则类别：供报告聚合与排序使用。 */
 export function ruleCategory(ruleId) {
-    const group = ruleId.slice(4, 6);
+    const group = ruleId.slice(4, 5);
     const map = {
-        '00': '注入',
-        '01': '反序列化',
-        '02': '加密与密钥',
-        '03': '凭据泄露',
-        '04': '配置与权限',
-        '05': '日志与信息泄露',
-        '06': '路径与网络',
+        '0': '注入',
+        '1': '反序列化',
+        '2': '加密与密钥',
+        '3': '凭据泄露',
+        '4': '配置与权限',
+        '5': '日志与信息泄露',
+        '6': '路径与网络',
     };
     return map[group] ?? '其他';
 }

package/lib/scanner.js

@@ -37,7 +37,7 @@ function fileHasBinary(buffer) {
             return true;
     return false;
 }
-const TEXT_EXTENSIONS = /\.(?:js|mjs|cjs|jsx|ts|tsx|py|go|java|rb|php|sh|bash|zsh|ya?ml|json|env|dockerfile|txt|md|html|css|vue|svelte)$/i;
+const TEXT_EXTENSIONS = /\.(?:js|mjs|cjs|jsx|ts|tsx|py|go|java|rb|php|sh|bash|zsh|ya?ml|json|env|dockerfile|txt|md|html|css|vue|svelte|pem|key|crt|cer|p12|der|p8)$/i;
 function shouldScanFile(file) {
     const base = path.basename(file).toLowerCase();
     if (base === 'dockerfile')
@@ -105,7 +105,8 @@ export function scanLineSet(entries, rel, policy) {
             prevDisable.set(entry.line + 1, disabledRules(entry.text, DISABLE_NEXT));
     }
     for (const entry of entries) {
-        const currentDisable = isComment(entry.text) ? disabledRules(entry.text, DISABLE_LINE) : null;
+        const isCommentLine = isComment(entry.text);
+        const currentDisable = isCommentLine ? disabledRules(entry.text, DISABLE_LINE) : null;
         for (const rule of applied) {
             if (rule.id === 'SEC-304')
                 continue;
@@ -115,6 +116,8 @@ export function scanLineSet(entries, rel, policy) {
                 continue;
             if (rule.fileLevel === true)
                 continue;
+            if (isCommentLine)
+                continue;
             if (!rule.patterns.some((pattern) => pattern.test(entry.text)))
                 continue;
             findings.push({
@@ -131,7 +134,7 @@ export function scanLineSet(entries, rel, policy) {
             });
         }
         const entropyRule = RULES.find((rule) => rule.id === 'SEC-304');
-        if (entropyRule !== undefined && !policyIgnores(policy, entropyRule.id, rel)) {
+        if (entropyRule !== undefined && !policyIgnores(policy, entropyRule.id, rel) && !isCommentLine && !shouldSkipLine(entropyRule, currentDisable) && !shouldSkipLine(entropyRule, prevDisable.get(entry.line))) {
             findings.push(...detectHighEntropy(entry.text, entry.line, rel, rel, entropyRule));
         }
     }

package/lib/tools.js

@@ -355,7 +355,33 @@ export function buildSecureTools(cfg, cwd, runner) {
             return { kind: 'deny', reason: '导出被取消，未执行。' };
         return { kind: 'deny', reason: '导出未获批准。' };
     };
-    return [secureScan, secureDiff, secureFixVerify, secureReport, secureExport, ...buildExtraTools(cfg, cwd), policyShow, policySet];
+    const secureHealth = {
+        name: 'secure_health',
+        description: 'dsh-code-security 自检：汇总扫描配置（文件数/体积上限、严重度门禁、状态目录）并确认工作目录可用。遇到问题时先运行本工具定位。',
+        parameters: compileParameters({}),
+        output: {
+            schema: { type: 'object', additionalProperties: true },
+            render: (_args, value) => {
+                const rec = (value ?? {});
+                const rawChecks = Array.isArray(rec.checks) ? rec.checks : [];
+                const lines = ['dsh-code-security 自检' + (rec.ok === true ? '：正常。' : '：发现问题。')];
+                for (const item of rawChecks) {
+                    const c = (item ?? {});
+                    lines.push('- ' + String(c.name) + '：' + (c.ok === true ? '✅ ' + String(c.detail ?? '') : '❌ ' + String(c.detail ?? '')));
+                }
+                return [{ type: 'text', text: lines.join('\n') }];
+            },
+        },
+        async execute(rawArgs) {
+            const checks = [];
+            checks.push({ name: '扫描上限', ok: true, detail: 'maxFiles=' + cfg.maxFiles + '，maxFileBytes=' + cfg.maxFileBytes });
+            checks.push({ name: '严重度门禁', ok: true, detail: 'failOn=' + cfg.failOn });
+            checks.push({ name: '状态目录', ok: true, detail: cfg.stateDir });
+            checks.push({ name: '工作目录', ok: cwd !== '', detail: cwd });
+            return { ok: true, plugin: 'dsh-code-security', checks };
+        },
+    };
+    return [secureScan, secureDiff, secureFixVerify, secureReport, secureExport, ...buildExtraTools(cfg, cwd), policyShow, policySet, secureHealth];
 }
 function buildMarkdown(findings, target) {
     const lines = ['# 安全审查报告', '', '目标：' + target, '', '| 严重度 | 规则 | CWE | 文件:行 | 说明 |', '| :-- | :-- | :-- | :-- | :-- |'];

package/package.json

@@ -1,62 +1,61 @@
-{
-  "name": "dsh-code-security",
-  "version": "0.2.2",
-  "description": "DSH AI 代码安全审查插件：secure_scan/secure_diff/secure_fix_verify/secure_report/secure_export/secure_baseline/secure_deps/secure_policy_show/secure_policy_set 九工具，40+ 确定性规则、密钥熵检测、git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite，零运行时依赖。",
-  "type": "module",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/index.d.ts",
-      "default": "./lib/index.js"
-    },
-    "./cordis.patch.yml": "./cordis.patch.yml",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib",
-    "cordis.patch.yml",
-    "README.md",
-    "README.en.md"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "prepare": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "pnpm run build && node --test \"test/*.test.mjs\"",
-    "prepublishOnly": "pnpm run build"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    }
-  },
-  "keywords": [
-    "dsh",
-    "deepseek-harness",
-    "plugin",
-    "security",
-    "code-review",
-    "sast",
-    "secrets",
-    "owasp"
-  ],
-  "license": "MIT",
-  "engines": {
-    "node": ">=22.13"
-  },
-  "devDependencies": {
-    "@types/node": "^24.0.0",
-    "typescript": "^5.6.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/STARDUSTLC666/dsh-code-security.git"
-  },
-  "bugs": {
-    "url": "https://github.com/STARDUSTLC666/dsh-code-security/issues"
-  },
-  "homepage": "https://github.com/STARDUSTLC666/dsh-code-security#readme",
-  "author": "stardustlc",
-  "packageManager": "pnpm@11.7.0"
-}
+{
+  "name": "dsh-code-security",
+  "version": "0.3.0",
+  "description": "DSH AI 代码安全审查插件：secure_scan/secure_diff/secure_fix_verify/secure_report/secure_export/secure_baseline/secure_deps/secure_policy_show/secure_policy_set 九工具，40+ 确定性规则、密钥熵检测、git diff/staged 审查、SARIF 导出、基线接受与 SBOM-lite，零运行时依赖。",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "README.en.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "pnpm run build && node --test \"test/*.test.mjs\"",
+    "prepublishOnly": "pnpm run build"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "plugin",
+    "security",
+    "code-review",
+    "sast",
+    "secrets",
+    "owasp"
+  ],
+  "license": "MIT",
+  "engines": {
+    "node": ">=22"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.6.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/STARDUSTLC666/dsh-code-security.git"
+  },
+  "bugs": {
+    "url": "https://github.com/STARDUSTLC666/dsh-code-security/issues"
+  },
+  "homepage": "https://github.com/STARDUSTLC666/dsh-code-security#readme",
+  "author": "stardustlc",
+  "packageManager": "pnpm@11.7.0"
+}