fullshield 0.2.6 → 0.4.0

package/dist/supply.js

@@ -168,14 +168,24 @@ function checkLockfileIntegrity(lock) {
     if (name === "") continue;
     const resolved = entry.resolved;
     if (!resolved) continue;
+    if (entry.integrity === void 0 || entry.integrity.length === 0) {
+      findings.push(
+        finding(
+          "SUPPLY-LOCKINTEGRITY-001",
+          "Lockfile entry has no integrity hash",
+          `${name} resolved without an integrity hash`,
+          "package-lock.json"
+        )
+      );
+    }
     try {
-      const host = new URL(resolved).hostname;
-      if (host !== REGISTRY_HOST) {
+      const url = new URL(resolved);
+      if (url.protocol !== "https:" || url.hostname !== REGISTRY_HOST) {
         findings.push(
           finding(
             "SUPPLY-LOCKURL-001",
             "Lockfile entry resolves from a non-npm registry host",
-            `${name} resolved host ${host}`,
+            `${name} resolved host ${url.hostname || resolved}`,
             "package-lock.json"
           )
         );

package/dist/vex.js

@@ -49,14 +49,16 @@ function openVexStatement(finding) {
     vulnerability: { name: vulnName(finding) },
     products: [{ "@id": npmPurl(finding.snippet) }]
   };
+  const detail = process.env.FULLSHIELD_EXPERIMENTAL_SBOM_REACH === "1" && finding.reachabilityEvidence?.reason !== void 0 ? { detail: finding.reachabilityEvidence.reason } : {};
   if (notImported(finding)) {
     return {
       ...base,
       status: "not_affected",
-      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION
+      justification: OPENVEX_NOT_AFFECTED_JUSTIFICATION,
+      ...detail
     };
   }
-  return { ...base, status: "under_investigation" };
+  return { ...base, status: "under_investigation", ...detail };
 }
 function buildOpenVex(findings) {
   const statements = depFindings(findings).map(openVexStatement);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "0.2.6",
+  "version": "0.4.0",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",

package/rules/README.md

@@ -1,5 +1,7 @@
 # FullShield rules
 
+New work is `SECURITY_SCANNER_SPEC.md` Section 32. These pages describe rules that already exist. They are not the Phase 46–59 designs.
+
 Each Core rule has a positive fixture in `test/fixtures/vulnerable-app` and a
 negative counterpart in `test/fixtures/clean-app`.
 

package/rules/SAST-SKIP-001.md

@@ -0,0 +1,9 @@
+# SAST-SKIP-001
+
+**A source file was not parsed.** Severity info.
+
+The file is larger than `sast.maxFileBytes` (default 1 MB) or it contains NUL bytes. This is a skip notice, not a vulnerability.
+
+## Remediation
+
+Raise `sast.maxFileBytes` in `fullshield.config.json` when the file should be parsed. Generated and vendored trees are excluded before this check.

package/rules/SUPPLY-CHAINC2-001.md

@@ -0,0 +1,3 @@
+# SUPPLY-CHAINC2-001
+
+A package file names a public blockchain RPC method (`getSignaturesForAddress` or `eth_getLogs`) and also fetches or evaluates a value. Either signal alone is not a finding. Experimental: `FULLSHIELD_EXPERIMENTAL_SUPPLY=1`. Static only. Fixtures use `example.invalid`.

package/rules/SUPPLY-PLATFORMGATE-001.md

@@ -0,0 +1,3 @@
+# SUPPLY-PLATFORMGATE-001
+
+A `process.platform === 'win32'` or `os.platform()` check, a download, and a process spawn or executable write all appear in the same file. One of those signals alone is not a finding. Experimental: `FULLSHIELD_EXPERIMENTAL_SUPPLY=1`. Fixtures use `example.invalid`.

package/rules/SUPPLY-SECHOLDER-001.md

@@ -0,0 +1,3 @@
+# SUPPLY-SECHOLDER-001
+
+The registry `latest` dist-tag for a locked package is npm's removed-for-security placeholder `0.0.1-security`, and the locked version is not that placeholder. Missing registry data produces no finding. `--offline` reads the cache only. Critical. Not downgraded by reachability. Remove the package, delete `node_modules`, reinstall from a clean lockfile, and rotate credentials the machine could read.

package/rules/SUPPLY-STEALER-001.md

@@ -0,0 +1,3 @@
+# SUPPLY-STEALER-001
+
+A package file names a browser, Discord, or wallet store path and also makes a network call. A path alone, or a network call alone, is not a finding. Experimental: `FULLSHIELD_EXPERIMENTAL_SUPPLY=1`. Critical. Not downgraded by reachability.