fullshield 0.0.1 → 0.1.1

package/rules/SAST-NOSQLI-001.md

@@ -0,0 +1,9 @@
+# SAST-NOSQLI-001
+
+**req.body/req.query passed as a Mongo filter.** CWE-943.
+
+## Remediation
+
+Build an allow-listed filter object; never pass the request object through.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SAST-PATH-001.md

@@ -0,0 +1,9 @@
+# SAST-PATH-001
+
+**Tainted path without path.resolve + prefix check.** CWE-22.
+
+## Remediation
+
+Resolve against a fixed base and require startsWith(baseDir).
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SAST-PROTO-001.md

@@ -0,0 +1,9 @@
+# SAST-PROTO-001
+
+**Recursive merge of a tainted object without a __proto__ guard.** CWE-1321.
+
+## Remediation
+
+Skip __proto__, constructor, and prototype keys.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SAST-REDIRECT-001.md

@@ -0,0 +1,9 @@
+# SAST-REDIRECT-001
+
+**Tainted value into res.redirect.** CWE-601.
+
+## Remediation
+
+Allow-list destinations or require a relative path.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SAST-SQLI-001.md

@@ -0,0 +1,9 @@
+# SAST-SQLI-001
+
+**Tainted input concatenated into query/execute.** CWE-89.
+
+## Remediation
+
+Use a parameterized query (query(sql, [params])).
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SAST-SSRF-001.md

@@ -0,0 +1,9 @@
+# SAST-SSRF-001
+
+**Tainted URL into fetch/axios/http/needle/got/request/superagent/undici.** CWE-918.
+
+## Remediation
+
+Allow-list destinations; do not fetch user-supplied URLs.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SAST-XSS-001.md

@@ -0,0 +1,9 @@
+# SAST-XSS-001
+
+**Tainted HTML res.send, or unescaped <%- / {{{ in templates.** CWE-79.
+
+## Remediation
+
+Escape output. Use <%= in EJS and {{ in Handlebars. skip include.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SECRET-AIKEY-001.md

@@ -0,0 +1,9 @@
+# SECRET-AIKEY-001
+
+**OpenAI/Anthropic-style API key.** CWE-798.
+
+## Remediation
+
+Rotate and load from env. Never send scanned code to an AI provider without consent.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SECRET-AWS-001.md

@@ -0,0 +1,9 @@
+# SECRET-AWS-001
+
+**AWS access key.** CWE-798.
+
+## Remediation
+
+Rotate the key. Load it from the environment. Removing it from the file is not enough — it stays in git history.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SECRET-DBURL-001.md

@@ -0,0 +1,9 @@
+# SECRET-DBURL-001
+
+**Database URL with an inline password.** CWE-798.
+
+## Remediation
+
+Angle-bracket placeholders are ignored. Real passwords must be rotated and moved to env.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SECRET-ENTROPY-001.md

@@ -0,0 +1,9 @@
+# SECRET-ENTROPY-001
+
+**High-entropy string assigned to a secret-like name.** CWE-798.
+
+## Remediation
+
+Low confidence. Confirm it is not a live credential.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SECRET-ENVFILE-001.md

@@ -0,0 +1,9 @@
+# SECRET-ENVFILE-001
+
+**Committed .env file.** CWE-260.
+
+## Remediation
+
+Add .env to .gitignore, rotate every value, keep only .env.example.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SECRET-GITHUB-001.md

@@ -0,0 +1,9 @@
+# SECRET-GITHUB-001
+
+**GitHub token.** CWE-798.
+
+## Remediation
+
+Revoke the token and store a new one in env/CI secrets.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SECRET-GOOGLE-001.md

@@ -0,0 +1,9 @@
+# SECRET-GOOGLE-001
+
+**Google API key.** CWE-798.
+
+## Remediation
+
+Restrict and rotate the key; do not commit it.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SECRET-JWT-001.md

@@ -0,0 +1,9 @@
+# SECRET-JWT-001
+
+**Hardcoded JWT signing secret.** CWE-798.
+
+## Remediation
+
+Replace the literal with process.env.JWT_SECRET and rotate.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SECRET-PRIVKEY-001.md

@@ -0,0 +1,9 @@
+# SECRET-PRIVKEY-001
+
+**PEM private key block.** CWE-798.
+
+## Remediation
+
+Treat the key as compromised, rotate, and keep material out of git.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SECRET-SLACK-001.md

@@ -0,0 +1,9 @@
+# SECRET-SLACK-001
+
+**Slack token.** CWE-798.
+
+## Remediation
+
+Revoke the token in Slack and load a replacement from env.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SECRET-STRIPE-001.md

@@ -0,0 +1,9 @@
+# SECRET-STRIPE-001
+
+**Stripe secret key.** CWE-798.
+
+## Remediation
+
+Rotate the key and move it to a secret manager.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/templates/fullshield.config.json

@@ -0,0 +1,7 @@
+{
+  "modules": ["deps", "secrets", "sast", "config"],
+  "failOn": "high",
+  "ignore": ["dist/**", "**/*.test.ts"],
+  "baseline": ".fullshield-baseline.json",
+  "notify": { "slackWebhookEnv": "FULLSHIELD_SLACK_WEBHOOK" }
+}

package/templates/github-watch.yml

@@ -0,0 +1,15 @@
+name: FullShield watch
+on:
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+jobs:
+  watch:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+      - run: npm ci
+      - run: npx fullshield watch --fail-on high

package/templates/github-workflow.yml

@@ -0,0 +1,19 @@
+name: FullShield
+on:
+  pull_request:
+  push:
+    branches: [main]
+jobs:
+  scan:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+      - run: npm ci
+      - run: npx fullshield scan --sarif fullshield.sarif --fail-on high
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: fullshield.sarif

package/templates/gitlab-ci.yml

@@ -0,0 +1,11 @@
+fullshield:
+  image: node:22
+  script:
+    - npm ci
+    - npx fullshield scan --json --fail-on high
+  artifacts:
+    when: always
+    paths:
+      - fullshield-report.json
+    reports:
+      sast: fullshield-report.json

package/templates/pre-commit.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# FullShield pre-commit hook: block staged secrets.
+set -e
+ROOT=$(git rev-parse --show-toplevel)
+cd "$ROOT"
+if command -v npx >/dev/null 2>&1; then
+  npx fullshield scan --modules secrets --staged --fail-on high
+else
+  echo "fullshield pre-commit: npx not found" >&2
+  exit 1
+fi