easyvibegate 0.4.4 → 0.6.2

package/dist/engine/checkers/live/idor.js

@@ -1,37 +1,44 @@
 import { concretePath } from '../../endpoints.js';
-import { isErr, request, sleep, unreliable } from '../../net/http.js';
+import { classifyBody, isErr, request, sleep, unreliable } from '../../net/http.js';
 function bearer(token) {
     return { Authorization: `Bearer ${token}`, accept: 'application/json' };
 }
-/** Real, non-empty JSON payload — an empty collection or an error envelope is not data. */
-function hasData(body) {
-    const t = body.trim();
-    if (t.length < 2 || !(t.startsWith('{') || t.startsWith('[')))
-        return false;
-    try {
-        const v = JSON.parse(t);
-        if (Array.isArray(v))
-            return v.length > 0;
-        if (v && typeof v === 'object') {
-            const o = v;
-            if ('error' in o || 'errors' in o)
-                return false;
-            return Object.keys(o).length > 0;
-        }
-        return false;
-    }
-    catch {
-        return false;
+/**
+ * What one (A, B) pair proves. Only a pair where at least one side gave a
+ * definite answer AND the other side did not leak is "protected"; anything
+ * where the guessed id did not exist, a token was rejected, or a body could
+ * not be read proves nothing.
+ */
+function classifyPair(a, b, aStatus, bStatus) {
+    if (a.kind === 'data' && b.kind === 'data')
+        return { kind: 'cross-user', reason: 'both accounts read data' };
+    if (a.kind === 'unknown' || b.kind === 'unknown')
+        return { kind: 'unknown', reason: a.kind === 'unknown' ? `A: ${a.reason}` : `B: ${b.reason}` };
+    if (a.kind === 'absent' || b.kind === 'absent')
+        return { kind: 'unknown', reason: `guessed id not found (HTTP ${a.kind === 'absent' ? aStatus : bStatus})` };
+    // A 401 means that token itself was rejected, so that account's access was never tested.
+    if (aStatus === 401 || bStatus === 401)
+        return { kind: 'unknown', reason: `token ${aStatus === 401 ? 'A' : 'B'} rejected (HTTP 401)` };
+    // Neither side got data and neither answer was an error/404: no object behind
+    // the guessed id (or both denied) — nothing leaked, but ownership was not exercised.
+    if (a.kind !== 'data' && b.kind !== 'data') {
+        if (a.kind === 'denied' && b.kind === 'denied')
+            return { kind: 'protected', reason: 'both accounts denied' };
+        return { kind: 'unknown', reason: 'no data for the guessed id from either account' };
     }
+    // Exactly one side read data, the other was denied or got nothing: scoped correctly.
+    return { kind: 'protected', reason: 'only one account read data' };
 }
 /**
  * Differential IDOR/BOLA probe. For each object-scoped endpoint, requests the
  * same resource as two different users and classifies the PAIR:
  *   - either side unreliable (timeout/5xx/429) → inconclusive, not a verdict
- *   - both 200 with data                       → candidate cross-user access
- *   - otherwise                                → a definitive (non-leaking) answer
- * Harvesting real object IDs and judging ambiguous cases is left to the
- * operator or the AI-driven skill; the run status says how much was proven.
+ *   - both 2xx with data                       → candidate cross-user access
+ *   - one side data, other denied/empty        → protected (a verified pair)
+ *   - 404 / rejected tokens / unreadable body  → unknown (not verified)
+ * Any pair that could not be verified makes the run `partial`, so one good
+ * pair never hides the others. Harvesting real object IDs and judging
+ * ambiguous cases is left to the operator or the AI-driven skill.
  */
 export async function idorDifferential(appUrl, endpoints, tokenA, tokenB, rateLimitMs = 120) {
     const base = appUrl.replace(/\/$/, '');
@@ -50,9 +57,14 @@ export async function idorDifferential(appUrl, endpoints, tokenA, tokenB, rateLi
     }
     let inconclusive = 0; // a side timed out / 5xx / 429 — we learned nothing
     let evaluated = 0; // both sides answered reliably
-    let dataSeen = 0; // at least one side returned actual data (the guessed id exists)
+    let verifiedPairs = 0; // protected or cross-user: a real verdict
+    const unknown = []; // "GET /path (reason)"
     for (const e of idEndpoints) {
         const path = concretePath(e.path).replace(/^\/?/, '/');
+        if (e.unresolved) {
+            unknown.push(`GET ${path} (${e.note ?? 'unresolved route prefix'})`);
+            continue;
+        }
         await sleep(rateLimitMs);
         const a = await request(base + path, { headers: bearer(tokenA) });
         await sleep(rateLimitMs);
@@ -62,40 +74,44 @@ export async function idorDifferential(appUrl, endpoints, tokenA, tokenB, rateLi
             continue;
         }
         evaluated++;
-        const aOk = a.status === 200 && hasData(a.body);
-        const bOk = b.status === 200 && hasData(b.body);
-        if (aOk || bOk)
-            dataSeen++;
-        if (aOk && bOk) {
-            const identical = a.body === b.body;
-            findings.push({
-                id: 'idor_cross_user',
-                severity: 'warning',
-                title: `Two accounts both read ${path}`,
-                detail: identical
-                    ? `Both accounts received the identical object at ${path}. If this resource is meant to be private/per-user, that is an IDOR; if it is public/shared, it is fine — confirm which.`
-                    : `Both accounts got a 200 with data at ${path}. Verify each only ever sees their own record.`,
-                fix: 'Enforce ownership server-side: check the authenticated user owns the requested id before returning it (or apply RLS). To confirm exploitability, request an id you know belongs to account A while authenticated as account B.',
-                checker: 'idor',
-                level: 2,
-                endpoint: `GET ${path}`,
-            });
+        const pair = classifyPair(classifyBody(a, 'json'), classifyBody(b, 'json'), a.status, b.status);
+        if (pair.kind === 'unknown') {
+            unknown.push(`GET ${path} (${pair.reason})`);
+            continue;
         }
+        verifiedPairs++;
+        if (pair.kind !== 'cross-user')
+            continue;
+        const identical = a.body === b.body;
+        findings.push({
+            id: 'idor_cross_user',
+            severity: 'warning',
+            title: `Two accounts both read ${path}`,
+            detail: identical
+                ? `Both accounts received the identical object at ${path}. If this resource is meant to be private/per-user, that is an IDOR; if it is public/shared, it is fine — confirm which.`
+                : `Both accounts got a 200 with data at ${path}. Verify each only ever sees their own record.`,
+            fix: 'Enforce ownership server-side: check the authenticated user owns the requested id before returning it (or apply RLS). To confirm exploitability, request an id you know belongs to account A while authenticated as account B.',
+            checker: 'idor',
+            level: 2,
+            endpoint: `GET ${path}`,
+        });
     }
     const total = idEndpoints.length;
-    if (evaluated === 0) {
+    if (evaluated === 0 && unknown.length === 0) {
         return { findings, run: { id: 'idor', level: 2, status: 'failed', note: `all ${total} pair(s) were inconclusive (timeout/5xx/429)` } };
     }
-    if (inconclusive > 0 || droppedPairs > 0) {
+    if (inconclusive > 0 || droppedPairs > 0 || unknown.length > 0) {
         const n = [];
         if (inconclusive > 0)
             n.push(`${inconclusive}/${total} pair(s) inconclusive (timeout/5xx/429)`);
+        if (unknown.length > 0) {
+            n.push(`${unknown.length}/${total} pair(s) not verified: ${unknown.slice(0, 5).join(', ')}${unknown.length > 5 ? ', …' : ''}` +
+                ' — provide real object ids to confirm ownership');
+        }
         if (droppedPairs > 0)
             n.push(`only ${MAX}/${idCandidates.length} object endpoints probed (cap)`);
         return { findings, run: { id: 'idor', level: 2, status: 'partial', note: n.join('; ') } };
     }
-    if (dataSeen === 0) {
-        return { findings, run: { id: 'idor', level: 2, status: 'partial', note: 'no endpoint returned data for the guessed id — provide real object ids to confirm ownership' } };
-    }
-    return { findings, run: { id: 'idor', level: 2, status: 'completed' } };
+    // Reaching here means every pair got a real verdict (protected or cross-user).
+    return { findings, run: { id: 'idor', level: 2, status: verifiedPairs === total ? 'completed' : 'partial' } };
 }

package/dist/engine/checkers/static/client-exposure.js

@@ -1,20 +1,75 @@
 import { lineAt, looksLikePlaceholder, redact } from '../../util/text.js';
+import { classifyKey } from '../backend/supabase.js';
 // Public env prefixes are inlined into the browser bundle by the bundler.
 const PUBLIC_PREFIX = '(?:NEXT_PUBLIC_|VITE_|REACT_APP_|EXPO_PUBLIC_|GATSBY_|PUBLIC_)';
+// Every public-prefixed assignment; what it carries is decided by the VALUE
+// first and the NAME second (below).
+const PUBLIC_ASSIGN = new RegExp(`\\b(${PUBLIC_PREFIX}[A-Z0-9_]*)\\s*[:=]\\s*["']?([^"'\\s]{6,})`, 'gi');
 // A public var whose NAME implies a real secret (not an anon/publishable key).
-const PUBLIC_SECRET = new RegExp(`\\b${PUBLIC_PREFIX}[A-Z0-9_]*(SERVICE_ROLE|SECRET|PRIVATE|PASSWORD|PASSWD|TOKEN|CREDENTIAL|API_KEY|ACCESS_KEY)[A-Z0-9_]*\\s*[:=]\\s*["']?([^"'\\s]{6,})`, 'gi');
+const SECRET_NAME = /(SERVICE_ROLE|SECRET|PRIVATE|PASSWORD|PASSWD|TOKEN|CREDENTIAL|API_KEY|ACCESS_KEY)/i;
+// Value shapes that are server secrets no matter what the variable is called.
+const SERVER_SECRET_VALUE = /^(?:sk_live_|rk_live_|sk-ant-|sk-(?:proj-)?[A-Za-z0-9_-]{20,}$)/;
+const FIREBASE_WEB_KEY = /^AIza[0-9A-Za-z_-]{35}$/;
+/**
+ * A key is public or secret by what it IS, not by what the variable is named.
+ * A Supabase publishable key or a Firebase Web API key stored under a public
+ * *_API_KEY name was reported as a leaked server secret with "rotate it"
+ * advice, although both are designed to ship to the browser. Conversely a
+ * service_role JWT behind a public *_KEY name (no secret word) went unreported.
+ */
+function classifyValue(value) {
+    const sb = classifyKey(value);
+    if (sb === 'publishable' || sb === 'jwt-anon')
+        return 'client-key';
+    if (sb === 'secret' || sb === 'jwt-service' || sb === 'jwt-authenticated')
+        return 'server-secret';
+    if (FIREBASE_WEB_KEY.test(value))
+        return 'client-key';
+    if (SERVER_SECRET_VALUE.test(value))
+        return 'server-secret';
+    return 'unknown';
+}
 export const clientExposureChecker = {
     id: 'client-exposure',
     title: 'Secrets exposed to the browser',
     level: 0,
     run(ctx) {
         const findings = [];
+        // The same public key is typically repeated across .env, .env.local and
+        // config; one advisory per file+value is enough.
+        const advised = new Set();
         for (const file of ctx.files) {
             const { content, rel } = file;
-            for (const m of content.matchAll(PUBLIC_SECRET)) {
+            for (const m of content.matchAll(PUBLIC_ASSIGN)) {
+                const name = m[1] ?? '';
                 const value = m[2] ?? '';
                 if (looksLikePlaceholder(value))
                     continue;
+                const kind = classifyValue(value);
+                const line = lineAt(content, m.index ?? 0);
+                if (kind === 'client-key') {
+                    const key = `${rel}:${value}`;
+                    if (advised.has(key))
+                        continue;
+                    advised.add(key);
+                    findings.push({
+                        id: 'public_key_client',
+                        severity: 'advisory',
+                        title: 'Public client key behind a public env var',
+                        detail: `${name} carries a key designed for the browser (${redact(value)}) — an anon/publishable Supabase key or a Firebase Web API key. It is not a leak by itself: its safety depends entirely on Row Level Security / Firebase security rules / API key restrictions.`,
+                        fix: 'Keep it public, and make the server side enforce access: enable RLS with policies on every table (Supabase), lock down security rules (Firebase), and restrict the key by API and HTTP referrer (Google Cloud console).',
+                        checker: 'client-exposure',
+                        level: 0,
+                        file: rel,
+                        line,
+                        evidence: redact(value),
+                    });
+                    continue;
+                }
+                // A proven server secret is critical regardless of the name; an
+                // unknown value is critical only when the NAME says it is a secret.
+                if (kind !== 'server-secret' && !SECRET_NAME.test(name))
+                    continue;
                 findings.push({
                     id: 'public_env_secret',
                     severity: 'critical',
@@ -24,7 +79,7 @@ export const clientExposureChecker = {
                     checker: 'client-exposure',
                     level: 0,
                     file: rel,
-                    line: lineAt(content, m.index ?? 0),
+                    line,
                     evidence: redact(value),
                 });
             }

package/dist/engine/checkers/static/config-risks.js

@@ -1,5 +1,6 @@
 import { lineAt } from '../../util/text.js';
-import { looksMinified, maskCode } from '../../util/mask.js';
+import { looksBundledPath, maskTokens } from '../../util/mask.js';
+import { langForFile, lexCode } from '../../util/code-lex.js';
 const RULES = [
     {
         id: 'cors_star',
@@ -22,7 +23,8 @@ const RULES = [
     {
         id: 'eval_use',
         title: 'Use of eval / new Function',
-        re: /\beval\s*\(|\bnew\s+Function\s*\(/g,
+        // `(?<![\w.])` — `model.eval()` (PyTorch) and `obj.eval(` are methods, not the global.
+        re: /(?<![\w.])eval\s*\(|\bnew\s+Function\s*\(/g,
         severity: 'warning',
         detail: 'eval on any untrusted input is a code-execution risk.',
         fix: 'Replace eval with explicit parsing/logic; never eval user-supplied data.',
@@ -51,30 +53,84 @@ const RULES = [
         maskStrings: false,
     },
 ];
+/**
+ * Template tags that parameterize `${…}` instead of splicing it into the query
+ * text (Postgres.js / slonik / drizzle `sql`, Prisma `$queryRaw` / `Prisma.sql`).
+ * Matched against the code just before the backtick. `sql.unsafe` and
+ * `$queryRawUnsafe` end differently and so stay reported, as do `.query(`…`)`
+ * and untagged templates.
+ */
+const SAFE_SQL_TAG = /(?:^|[^\w$.])(?:sql|SQL|[\w$]+\.sql|(?:[\w$]+\.)?\$(?:queryRaw|executeRaw))\s*$/;
+function isParameterizedTemplate(scan, backtickAt) {
+    if (scan[backtickAt] !== '`')
+        return false;
+    return SAFE_SQL_TAG.test(scan.slice(Math.max(0, backtickAt - 64), backtickAt));
+}
+/**
+ * Where an interpolation sits decides what it can do. `WHERE id = ${id}` splices
+ * a VALUE — injection. `FROM ${table}`, `SET ${col} = ?`, `ORDER BY ${dir}` splice
+ * STRUCTURE with the values still parameterized — risky only if the names come
+ * from request data, so it is reported as info, not as an injection. About half
+ * of the real-world hits were structural.
+ */
+const VALUE_POSITION = /(=|<>|!=|<=|>=|<|>|\bLIKE|\bILIKE|\bIN\s*\(|\bVALUES\s*\([^)]*|\bBETWEEN|\bAND|\bOR|\bLIMIT|\bOFFSET|\bTHEN|\bELSE)\s*$/i;
+const PLACEHOLDER_EXPR = /^\s*(?:\w+\.)?(placeholders?|params?|marks|questions|qs|values|binds?)\b/i;
+function onlyStructuralInterpolation(scan, at) {
+    // The literal: from the opening delimiter to its close (bounded).
+    const open = scan[at] === '`' ? '`' : scan[at + 1] ?? '"';
+    const start = scan[at] === '`' ? at + 1 : at + 2;
+    const close = scan.indexOf(open, start);
+    const body = scan.slice(start, close === -1 ? Math.min(scan.length, start + 2000) : close);
+    const holes = [...body.matchAll(/\$\{([^}]*)\}|(?<!\$)\{([^}]*)\}/g)];
+    if (holes.length === 0)
+        return false;
+    for (const h of holes) {
+        const expr = h[1] ?? h[2] ?? '';
+        if (PLACEHOLDER_EXPR.test(expr))
+            continue;
+        const before = body.slice(Math.max(0, (h.index ?? 0) - 60), h.index ?? 0);
+        if (VALUE_POSITION.test(before))
+            return false;
+    }
+    return true;
+}
 export const configRisksChecker = {
     id: 'config-risks',
     title: 'Dangerous configuration',
     level: 0,
     run(ctx) {
         const findings = [];
+        const skipped = [];
         for (const file of ctx.files) {
             // Config risks in prose docs are examples, not live config — skip them.
             if (file.rel.endsWith('.md') || file.rel.endsWith('.txt'))
                 continue;
-            if (looksMinified(file.rel, file.content))
-                continue; // generated output, not source
+            // Generated output is skipped by PATH only and reported as missing
+            // coverage below. A "looks minified" content heuristic used to skip a
+            // file silently, so one long data line disabled every rule for it. The
+            // regexes are length-bounded, so long lines are safe to scan instead.
+            if (looksBundledPath(file.rel)) {
+                skipped.push(file.rel);
+                continue;
+            }
             // Comments never trigger a rule. Strings are a per-rule decision: a rule
             // matching a literal value must still see it (see Rule.maskStrings).
-            const noComments = maskCode(file.content);
-            const noStrings = maskCode(file.content, { strings: true });
+            const tokens = lexCode(file.content, langForFile(file.rel));
+            const noComments = maskTokens(file.content, tokens);
+            const noStrings = maskTokens(file.content, tokens, { strings: true });
             for (const rule of RULES) {
                 const scan = rule.maskStrings ? noStrings : noComments;
                 for (const m of scan.matchAll(rule.re)) {
+                    if (rule.id === 'sql_interpolation' && isParameterizedTemplate(scan, m.index ?? 0))
+                        continue;
+                    const structural = rule.id === 'sql_interpolation' && onlyStructuralInterpolation(scan, m.index ?? 0);
                     findings.push({
                         id: rule.id,
-                        severity: rule.severity,
-                        title: rule.title,
-                        detail: rule.detail,
+                        severity: structural ? 'info' : rule.severity,
+                        title: structural ? 'SQL built with interpolated identifiers' : rule.title,
+                        detail: structural
+                            ? 'Table/column names or operators are spliced into the query while the values use placeholders. That is safe only if those names come from a fixed allowlist in code — never from request data (`Object.keys(body)` is the classic hole).'
+                            : rule.detail,
                         fix: rule.fix,
                         checker: 'config-risks',
                         level: 0,
@@ -84,6 +140,10 @@ export const configRisksChecker = {
                 }
             }
         }
-        return findings;
+        // Skipped is not clean: name what was not reviewed so the gate stays incomplete.
+        if (skipped.length === 0)
+            return { findings };
+        const shown = skipped.slice(0, 5).join(', ') + (skipped.length > 5 ? `, … (+${skipped.length - 5})` : '');
+        return { findings, partial: `${skipped.length} generated/minified file(s) not reviewed: ${shown}` };
     },
 };