fullshield 0.1.1 → 0.2.6

package/rules/README.md

@@ -16,8 +16,10 @@ negative counterpart in `test/fixtures/clean-app`.
 | [SECRET-PRIVKEY-001](SECRET-PRIVKEY-001.md) | PEM private key |
 | [SECRET-DBURL-001](SECRET-DBURL-001.md) | DB URL with inline password |
 | [SECRET-JWT-001](SECRET-JWT-001.md) | Hardcoded JWT secret |
+| [SECRET-SESSION-001](SECRET-SESSION-001.md) | Hardcoded express-session secret |
 | [SECRET-ENTROPY-001](SECRET-ENTROPY-001.md) | High-entropy assignment (low confidence) |
 | [SECRET-ENVFILE-001](SECRET-ENVFILE-001.md) | Committed `.env` file |
+| [SECRET-BUNDLE-001](SECRET-BUNDLE-001.md) | Secret-shaped `NEXT_PUBLIC_`/`VITE_` value in a client bundle (experimental) |
 
 ## Dependencies
 
@@ -27,13 +29,15 @@ negative counterpart in `test/fixtures/clean-app`.
 | [DEPS-TYPOSQUAT-001](DEPS-TYPOSQUAT-001.md) | Direct dep 1 edit from a popular name |
 | [DEPS-DEPRECATED-001](DEPS-DEPRECATED-001.md) | Lockfile `deprecated` field |
 | [DEPS-NOLOCK-001](DEPS-NOLOCK-001.md) | package.json without a lockfile |
+| [SUPPLY-WORM-001](SUPPLY-WORM-001.md) | Experimental: token read + publish/registry/GitHub/workflow write |
+| [SUPPLY-WORKFLOW-001](SUPPLY-WORKFLOW-001.md) | Experimental: dep writes `.github/` / git hooks / CI config |
 
 ## SAST
 
 | ID | What |
 |---|---|
 | [SAST-SQLI-001](SAST-SQLI-001.md) | Tainted SQL concatenation |
-| [SAST-NOSQLI-001](SAST-NOSQLI-001.md) | Raw `req.body`/`query` as Mongo filter |
+| [SAST-NOSQLI-001](SAST-NOSQLI-001.md) | Raw `req.body`/`query` as Mongo filter, or a request field as a filter value |
 | [SAST-CMDI-001](SAST-CMDI-001.md) | Tainted shell `exec` |
 | [SAST-PATH-001](SAST-PATH-001.md) | Tainted path without resolve+prefix |
 | [SAST-EVAL-001](SAST-EVAL-001.md) | `eval` / `new Function` / `vm` / `*.eval` |
@@ -44,6 +48,16 @@ negative counterpart in `test/fixtures/clean-app`.
 | [SAST-PROTO-001](SAST-PROTO-001.md) | Unguarded recursive merge |
 | [SAST-XSS-001](SAST-XSS-001.md) | HTML `res.send` or `<%-` / `{{{` |
 | [SAST-AUTH-001](SAST-AUTH-001.md) | Data route with no auth middleware |
+| [SAST-REDOS-001](SAST-REDOS-001.md) | Nested/overlapping regex quantifiers on tainted input (experimental) |
+| [SAST-DESER-001](SAST-DESER-001.md) | Unsafe deserialize (`node-serialize`, js-yaml, funcster, serialize-javascript) (experimental) |
+| [SAST-XXE-001](SAST-XXE-001.md) | XML external entities on tainted input (experimental) |
+| [SAST-UPLOAD-001](SAST-UPLOAD-001.md) | multer/busboy/formidable without size/type, or `originalname` path (experimental) |
+| [SAST-COOKIE-001](SAST-COOKIE-001.md) | Cookies missing httpOnly/secure/sameSite; hardcoded session secret (experimental) |
+| [SAST-CSRF-001](SAST-CSRF-001.md) | Cookie-auth state-changing route without CSRF and sameSite (experimental) |
+| [SAST-MASSASSIGN-001](SAST-MASSASSIGN-001.md) | `Model.create/update(req.body)` / `Object.assign(user, req.body)` (experimental) |
+| [SAST-TIMING-001](SAST-TIMING-001.md) | Secret/token/HMAC compared with `===` not `timingSafeEqual` (experimental) |
+| [SAST-HASH-001](SAST-HASH-001.md) | bcrypt/argon2/pbkdf2 below OWASP minimums (experimental) |
+| [SAST-GQL-001](SAST-GQL-001.md) | GraphQL introspection in production, no depth limit, tainted resolver args (experimental) |
 
 ## Config
 
@@ -54,7 +68,39 @@ negative counterpart in `test/fixtures/clean-app`.
 | [CONFIG-CORS-001](CONFIG-CORS-001.md) | `origin:'*'` + `credentials:true` |
 | [CONFIG-RATELIMIT-001](CONFIG-RATELIMIT-001.md) | Auth route without a limiter |
 | [CONFIG-ERRSTACK-001](CONFIG-ERRSTACK-001.md) | `err.stack` sent to the client |
+| [CONFIG-DIRLIST-001](CONFIG-DIRLIST-001.md) | `serveIndex()` directory listing |
 | [CONFIG-DOCKER-LATEST-001](CONFIG-DOCKER-LATEST-001.md) | `FROM *:latest` |
 | [CONFIG-DOCKER-ROOT-001](CONFIG-DOCKER-ROOT-001.md) | Dockerfile with no `USER` |
 | [CONFIG-DOCKER-ENV-001](CONFIG-DOCKER-ENV-001.md) | `ENV *_SECRET=` / `*_KEY=` |
 | [CONFIG-INSTALLSCRIPT-001](CONFIG-INSTALLSCRIPT-001.md) | Lockfile `hasInstallScript` |
+| [CONFIG-TRUSTPROXY-001](CONFIG-TRUSTPROXY-001.md) | `trust proxy: true` with IP rate limiting (experimental) |
+
+## Runtime DLP (experimental)
+
+Requires `FULLSHIELD_EXPERIMENTAL_DLP=1` and `shieldGuard({ dlp: { mode } })`. Not a scan module.
+
+| ID | What |
+|---|---|
+| [DLP-SECRET-001](DLP-SECRET-001.md) | Secret pattern in a JSON/text response |
+| [DLP-STACK-001](DLP-STACK-001.md) | Stack trace in a response |
+| [DLP-INTERNAL-001](DLP-INTERNAL-001.md) | Internal IP or hostname in a response |
+| [DLP-CARD-001](DLP-CARD-001.md) | Luhn-valid card number in a response |
+| [DLP-PII-001](DLP-PII-001.md) | Many emails on a one-email route |
+
+## MCP config (experimental, `FULLSHIELD_EXPERIMENTAL_MCPCFG=1`)
+
+| ID | What |
+|---|---|
+| [MCP-001](MCP-001.md) | Inline secret in MCP client config |
+| [MCP-002](MCP-002.md) | Unpinned `npx` / `@latest` MCP server |
+| [MCP-003](MCP-003.md) | Shell/exec or unrestricted fs-write tool, no allowlist |
+| [MCP-004](MCP-004.md) | Tool-description instruction injection / hidden / ZWC |
+| [MCP-005](MCP-005.md) | Remote MCP over plaintext `http://` |
+
+## Host (experimental, `fullshield host --experimental-host`)
+
+| ID | What |
+|---|---|
+| [HOST-SSH-001](HOST-SSH-001.md) | OpenSSH version in the CVE-2024-6387 range |
+| [HOST-SSH-002](HOST-SSH-002.md) | Vulnerable OpenSSH without `LoginGraceTime 0` |
+| [HOST-SSH-003](HOST-SSH-003.md) | Possible SSH authentication-timeout attempts |

package/rules/SAST-COOKIE-001.md

@@ -0,0 +1,11 @@
+# SAST-COOKIE-001
+
+**Session/auth cookies without `httpOnly`, `secure`, or `sameSite`.** A hardcoded `express-session` secret is `SECRET-SESSION-001` only, so this rule does not add a second finding. CWE-614 / CWE-1004.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_CLASSES=1`).
+
+## Remediation
+
+Set `httpOnly: true`, `secure: true`, and `sameSite: 'lax'` or `'strict'`. Load the session secret from the environment and rotate it.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 29.

package/rules/SAST-CSRF-001.md

@@ -0,0 +1,11 @@
+# SAST-CSRF-001
+
+**Cookie-authenticated POST/PUT/PATCH/DELETE with no CSRF protection and `sameSite` not `strict`/`lax`.** CWE-352.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_CLASSES=1`).
+
+## Remediation
+
+Use `csurf`, `csrf-csrf`, `csrf-sync`, `lusca`, or `@fastify/csrf-protection`, including `app.use` in `app.js` when routes live in another file. Set cookie `sameSite` to `lax` or `strict`.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 29.

package/rules/SAST-DESER-001.md

@@ -0,0 +1,11 @@
+# SAST-DESER-001
+
+**Tainted input into `node-serialize.unserialize`, unsafe `js-yaml` schemas, `funcster`, or `serialize-javascript` eval paths.** CWE-502.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_CLASSES=1`).
+
+## Remediation
+
+Do not deserialize untrusted data into objects or code. Use JSON with a schema, or `js-yaml` `JSON_SCHEMA` / `safeLoad`. Never `eval` serialized JavaScript.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 29.

package/rules/SAST-GQL-001.md

@@ -0,0 +1,11 @@
+# SAST-GQL-001
+
+**GraphQL introspection enabled in production, no depth/complexity limit, or tainted resolver args reaching sinks.** CWE-770 / CWE-200.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_CLASSES=1`).
+
+## Remediation
+
+Disable introspection in production. Add `graphql-depth-limit` (or query complexity). Validate resolver arguments before they reach SQL/shell/eval.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 29.

package/rules/SAST-HASH-001.md

@@ -0,0 +1,11 @@
+# SAST-HASH-001
+
+**`bcrypt` cost < 10, `argon2` below OWASP memory/time minimums, or `pbkdf2` iterations below OWASP for the digest.** CWE-916.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_CLASSES=1`).
+
+## Remediation
+
+Use bcrypt cost ≥ 10, argon2id at least OWASP `m=19456,t=2` or `m=12288,t=3`, and PBKDF2-HMAC-SHA256 ≥ 600,000 iterations (SHA-512 ≥ 210,000).
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 29.

package/rules/SAST-MASSASSIGN-001.md

@@ -0,0 +1,11 @@
+# SAST-MASSASSIGN-001
+
+**`Model.create(req.body)` / `update(req.body)` / `Object.assign(user, req.body)` without an allowlist or schema.** CWE-915.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_CLASSES=1`).
+
+## Remediation
+
+Pick allowed fields, or parse with zod/joi/yup before create/update. Never pass `req.body` straight into an ORM or `Object.assign`.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 29.

package/rules/SAST-NOSQLI-001.md

@@ -1,9 +1,13 @@
 # SAST-NOSQLI-001
 
-**req.body/req.query passed as a Mongo filter.** CWE-943.
+**req.body/req.query passed as a Mongo filter, a tainted `$where` string, or request input used as a Mongo filter value without coercion, schema validation, or mongo-sanitize.** CWE-943.
+
+Constructed filters such as `{ password: req.body.password }` are medium confidence. They are not flagged when the value is `String()` / `Number()` / `Boolean()`, a zod/joi/yup `.parse`, `mongo-sanitize`, or `express-mongo-sanitize` middleware.
+
+The sink must be MongoDB or mongoose: the file imports `mongodb`/`mongoose`, or the receiver is a known collection (`collection.find`, `*Collection.update`) or a PascalCase mongoose model (`User.find`). Sequelize, Prisma, TypeORM, Knex, Drizzle, and unknown receivers are not flagged.
 
 ## Remediation
 
-Build an allow-listed filter object; never pass the request object through.
+Coerce or schema-validate each filter field; never pass the request object through. Prefer `mongo-sanitize` or an allow-listed filter object.
 
 See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SAST-REDOS-001.md

@@ -0,0 +1,11 @@
+# SAST-REDOS-001
+
+**Tainted input matched against a regex with nested or overlapping quantifiers.** CWE-1333.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_CLASSES=1`). Detection is static star-height analysis; user regexes are never executed.
+
+## Remediation
+
+Rewrite the pattern so quantified groups do not contain further quantifiers or overlapping alternations. Prefer a parser or an allow-list over a complex regex.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 29.

package/rules/SAST-TIMING-001.md

@@ -0,0 +1,11 @@
+# SAST-TIMING-001
+
+**Secrets, tokens, or HMACs compared with `===` / `==` instead of `crypto.timingSafeEqual`.** CWE-208.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_CLASSES=1`).
+
+## Remediation
+
+Compare MACs and tokens with `crypto.timingSafeEqual` on equal-length Buffers.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 29.

package/rules/SAST-UPLOAD-001.md

@@ -0,0 +1,11 @@
+# SAST-UPLOAD-001
+
+**`multer` / `busboy` / `formidable` without a file size limit or type filter; uploaded `originalname` used in a filesystem path.** CWE-434.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_CLASSES=1`).
+
+## Remediation
+
+Set `limits.fileSize` (or `maxFileSize`) and a MIME/extension allow-list. Store files under a generated name, never `originalname`.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 29.

package/rules/SAST-XXE-001.md

@@ -0,0 +1,11 @@
+# SAST-XXE-001
+
+**XML parsers with external entities enabled (`libxmljs` `noent: true`, `xml2js` custom entities) on tainted input.** CWE-611.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_CLASSES=1`).
+
+## Remediation
+
+Disable external entity expansion (`noent: false`). Do not register custom SAX entities. Prefer a parser that rejects DTDs.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 29.

package/rules/SECRET-BUNDLE-001.md

@@ -0,0 +1,11 @@
+# SECRET-BUNDLE-001
+
+**Secret-shaped value in a client bundle.** CWE-798.
+
+`NEXT_PUBLIC_*` and `VITE_*` values are inlined into the browser. Experimental: `scan --bundle` with `FULLSHIELD_EXPERIMENTAL_SECRETS_ADV=1`.
+
+## Remediation
+
+Do not prefix secrets with `NEXT_PUBLIC_` or `VITE_`. Keep credentials server-side. Rotate any key that was bundled.
+
+See `SECURITY_SCANNER_SPEC.md` §24 Phase 30.

package/rules/SECRET-SESSION-001.md

@@ -0,0 +1,9 @@
+# SECRET-SESSION-001
+
+**Hardcoded `express-session` `secret` string.** CWE-798.
+
+## Remediation
+
+Load the session secret from the environment (for example `process.env.SESSION_SECRET`) and rotate any value that was committed.
+
+See `SECURITY_SCANNER_SPEC.md` §4 and the fixtures under `test/fixtures/`.

package/rules/SUPPLY-WORKFLOW-001.md

@@ -0,0 +1,9 @@
+# SUPPLY-WORKFLOW-001
+
+**Dependency writes GitHub workflows, git hooks, or CI config (static).** CWE-829.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_VEX=1`). Flags install scripts or package code that write `.github/`, `.git/hooks/`, or CI config files. Critical. Never executes packages.
+
+## Remediation
+
+Do not install the package until the write is reviewed. Prefer `--ignore-scripts` and pin CI config so dependencies cannot persist a workflow.

package/rules/SUPPLY-WORM-001.md

@@ -0,0 +1,9 @@
+# SUPPLY-WORM-001
+
+**Self-replicating worm indicators in dependency code (static).** CWE-506.
+
+Experimental (`FULLSHIELD_EXPERIMENTAL_VEX=1`). Flags package sources that read npm/GitHub tokens (`~/.npmrc`, `NPM_TOKEN`, `GITHUB_TOKEN`) **and** `npm publish`, a registry PUT, GitHub API repo/workflow creation, or writing `.github/workflows/*`. Critical. Never executes packages.
+
+## Remediation
+
+Do not install the package. Remove it from the lockfile, delete `node_modules`, reinstall, and rotate npm/GitHub tokens on machines that installed it.