fullshield 3.2.1 → 3.3.1

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to FullShield are documented here.
 
+## 3.3.1 — 2026-10-29
+
+### Runtime guard
+
+- Phase 567: `FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD` keeps block mode to SQL and shell. Other sinks stay monitor. A runtime event may include a local `webhookJson` body, at most 5 per 60 seconds, and that body is not posted. No eBPF and no new host.
+
+## 3.2.2 — 2026-10-29
+
+### Stored response
+
+- Phase 566: with `FULLSHIELD_EXPERIMENTAL_SAST_PARITY` already on, a same-file `req.body` binding later passed to `res.send` or `res.end` is a medium, low-confidence finding. Encoded output, Prisma `$queryRaw`, tRPC `input`, Nest `@Body()`, and `req.params.id` are not. No new command or flag.
+
 ## 3.2.1 — 2026-10-29
 
 ### SAST parity

package/README.md

@@ -1,6 +1,6 @@
 # FullShield
 
-**v3.2.1.** One install for Node.js/TypeScript backends: detect → classify → report → notify → fix → gate (CI `--fail-on` + runtime monitor). It does not stop attacks by itself. Scan when you want with `npx fullshield scan`, or install an every-2-hours timer with `npx fullshield schedule install`.
+**v3.3.1.** One install for Node.js/TypeScript backends: detect → classify → report → notify → fix → gate (CI `--fail-on` + runtime monitor). It does not stop attacks by itself. Scan when you want with `npx fullshield scan`, or install an every-2-hours timer with `npx fullshield schedule install`.
 
 **Headline: dependency reachability.** A lockfile CVE is not the same as an unused package. FullShield classifies each OSV hit as `reachable` (imported and called), `imported-not-called` (−1), `reachable-via-dependency` (lockfile path from an imported direct dep — **severity kept**, path shown, e.g. `express > body-parser > qs`), `not-imported` (−2, only when no such path exists), or `reachability-unknown` (severity kept) when the lockfile format has no parsed dependency edges. DevDependency-only vulns are `info` with a `dev-only` note unless production sources import the package. Pair it with `fullshield sbom --format cyclonedx`.
 
@@ -10,16 +10,16 @@ npx fullshield scan --json --fail-on high
 npx fullshield scan --sarif fullshield.sarif
 ```
 
-3.2.1 is the version of this tree. Python and other languages are out of scope. `schedule install` writes `fullShieldReport/fullShieldReport_YYYYMMDD_HHMM.md` every 2 hours and keeps 60 reports. `scan` does not create that folder. The stable contract is [docs/stability.md](docs/stability.md). The 1.0.1 release moved values that only experimental flags produce out of Stable. Experimental flags stay off unless you set them. Do not treat a scan as a penetration test. Reviewed recall for untouched apps is not published. From `bench/perf-v2.json` (`measured: true`, `label: unreviewed`), the stored Next.js cold p50 is 107.95 seconds — still above the 60-second target (target unmet). Default scans share one AST, run modules in parallel, and use lazy taint. Multi-workspace repos scan each workspace lockfile by default; single-package finding keys stay the same as 2.3.0.
+3.3.1 is the version of this tree. Python and other languages are out of scope. `schedule install` writes `fullShieldReport/fullShieldReport_YYYYMMDD_HHMM.md` every 2 hours and keeps 60 reports. `scan` does not create that folder. The stable contract is [docs/stability.md](docs/stability.md). The 1.0.1 release moved values that only experimental flags produce out of Stable. Experimental flags stay off unless you set them. Do not treat a scan as a penetration test. Reviewed recall for untouched apps is not published. From `bench/perf-v2.json` (`measured: true`, `label: unreviewed`), the stored Next.js cold p50 is 107.95 seconds — still above the 60-second target (target unmet). Default scans share one AST, run modules in parallel, and use lazy taint. Multi-workspace repos scan each workspace lockfile by default; single-package finding keys stay the same as 2.3.0.
 
 ## Verify in 60 seconds
 
 ```bash
 # fresh temp / empty cache is enough — no install-guard phones home
-npx fullshield@3.2.1 --version
+npx fullshield@3.3.1 --version
 ```
 
-Package page: [npmjs.com/package/fullshield](https://www.npmjs.com/package/fullshield). Release tag: [v3.2.1](https://github.com/kathanp/fullshield/releases/tag/v3.2.1). Publish stages with npm provenance (OIDC). After install, the stranger checks in the build spec (scan / json / sarif / fail-on / fix / init / sbom) are the post-publish gate — no Rekor/sigstore SaaS dependency in the CLI.
+Package page: [npmjs.com/package/fullshield](https://www.npmjs.com/package/fullshield). Release tag: [v3.3.1](https://github.com/kathanp/fullshield/releases/tag/v3.3.1). Publish stages with npm provenance (OIDC). After install, the stranger checks in the build spec (scan / json / sarif / fail-on / fix / init / sbom) are the post-publish gate — no Rekor/sigstore SaaS dependency in the CLI.
 
 ## GitHub Action
 
@@ -28,7 +28,7 @@ Copy `templates/action/` into your repo (or use `kathanp/fullshield-action` once
 ```yaml
 - uses: your-org/your-repo/.github/actions/fullshield@<commit-sha>
   with:
-    version: '3.2.1'
+    version: '3.3.1'
 ```
 
 Or run `npx fullshield init --recommended` to write `profile: "recommended"` and a workflow that calls `./templates/action`. The Action runs `fullshield scan`, uploads SARIF, and may cache the baseline. It does not post a pull-request comment, open issues, or phone home.
@@ -86,7 +86,7 @@ Contributor quality gate: [docs/QUALITY.md](docs/QUALITY.md) (`npm run quality`)
 - Cross-file taint follows `require`/`import` and method calls up to 5 hops and records a `trace` (also SARIF `codeFlows`). Nested closures and some dynamic dispatch are still missed.
 - Runtime v1 is **signature-based** (payload regex + rate limit + body-size guard). It is a **stopgap monitor**, not a WAF. Prefer **`mode: 'monitor'`** in production until you have measured false-positive rate. Sink-hooking RASP is **experimental** (off by default; see below) and does not claim to prevent attacks.
 - Only scan hosts and repos you own or are authorized to test.
-- Does **not** scan container images or OS packages. Pass a Trivy SARIF file you already produced to `fullshield ingest`. FullShield does not pretend to be a container scanner.
+- Does **not** scan container images or OS packages, and does not implement eBPF or network-layer detection. Pass a Trivy SARIF file you already produced to `fullshield ingest`. FullShield does not pretend to be a container scanner.
 - **Experimental features are off by default and are not product claims:**
   - RASP / virtual patches / honeytokens / threat auto-block: fail-open hooks; decoy-route hits are low and never auto-block; auto-block is opt-in (shared-IP / NAT risk).
   - `install` / supply-chain: static heuristics only; never a substitute for `npm audit` policy or a malware sandbox.
@@ -230,7 +230,7 @@ app.use(shieldGuard({ mode: 'monitor', authRoutes: ['/login'] }));
 
 **Experimental ingest (off by default):** `FULLSHIELD_EXPERIMENTAL_INGEST=1` or `fullshield ingest --experimental-ingest <file...>`. Reads local SARIF 2.1.0, OSV-Scanner JSON, `npm audit --json`, and Semgrep JSON. It does not run those tools and does not fetch. Severity stays the tool's severity (`moderate` and Semgrep `WARNING` are stored as medium; the original token is `externalSeverity`). `fullshieldPriority` is not set.
 
-**Experimental RASP** (Frontier, off by default): structure-change sink hooks via `node --import fullshield/runtime/register app.js` or `import 'fullshield/runtime/auto'` as the first import. Enable only with `FULLSHIELD_EXPERIMENTAL_RASP=1`. Default mode is `monitor` (events only). `FULLSHIELD_RASP_MODE=block` throws on structure-changing SQL/shell/path/NoSQL/SSRF/prototype input. Hooks **fail open**: a hook error logs `RASP-FAIL-OPEN-001` and the original call proceeds. Do not use block mode in production until you have measured the benign corpus on your app.
+**Experimental RASP** (Frontier, off by default): structure-change sink hooks via `node --import fullshield/runtime/register app.js` or `import 'fullshield/runtime/auto'` as the first import. Enable only with `FULLSHIELD_EXPERIMENTAL_RASP=1`. Default mode is `monitor` (events only). `FULLSHIELD_RASP_MODE=block` throws on structure-changing SQL/shell/path/NoSQL/SSRF/prototype input. With `FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD=1`, block mode throws only for SQL and shell; path, NoSQL, SSRF, prototype, and SSTI stay monitor. A matching event may include `webhookJson` (`schema`, `kind`, `action`, `ruleId`) at most 5 times per 60 seconds. That JSON is not posted and has no request sample. Hooks **fail open**: a hook error logs `RASP-FAIL-OPEN-001` and the original call proceeds. Do not use block mode in production until you have measured the benign corpus on your app.
 
 `npm run bench` reports `inspect()` p50/p95 (must stay under 1ms) and full Express request overhead p50/p95 with the middleware on the stack.
 
@@ -263,7 +263,7 @@ app.use(shieldGuard({ mode: 'monitor', authRoutes: ['/login'] }));
 | `agent` | **Experimental** remediation agent (`FULLSHIELD_EXPERIMENTAL_AGENT=1`). Mock/localhost GitHub API + local git remote only — never a real network. Never merges, never pushes to `main`/`master`. `--max-prs` (default 3). |
 | `scan --changed` / `--since` | **Experimental** incremental scan (`FULLSHIELD_EXPERIMENTAL_PLATFORM=1`). |
 | `scan --diff` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_DIFFSCAN=1` or `--experimental-diffscan`). Scans git-changed JS/TS files, the files they import by a relative literal, and the files that import them the same way. One hop. A sink in an unchanged importer still reports when the changed file returns the request value. A git failure is `FS-E018` and does not scan the rest of the tree. Off, or `scan` without `--diff`, matches today's scan. `init --recommended` writes `.github/workflows/fullshield-diff.yml`, which sets `FULLSHIELD_EXPERIMENTAL_DIFFSCAN=1` and runs `scan --diff`. |
-| `scan --counts` / `fix --finding` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_SAST_PARITY=1`). `--counts` prints severity × reachability totals and never a letter grade. `fullshield.rules.yml` is a local list of `schema: 1` rules (`pattern`, `message`, `severity`). Patterns are literal substrings and are never downloaded. `fix --finding ruleId:file:line` writes one safe fix and does not run project tests. The HTML report lists a `source` and `sink` only when a taint trace already has both. |
+| `scan --counts` / `fix --finding` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_SAST_PARITY=1`). `--counts` prints severity × reachability totals and never a letter grade. `fullshield.rules.yml` is a local list of `schema: 1` rules (`pattern`, `message`, `severity`). Patterns are literal substrings and are never downloaded. `fix --finding ruleId:file:line` writes one safe fix and does not run project tests. The HTML report lists a `source` and `sink` only when a taint trace already has both. The same flag reports a same-file `req.body` value later passed to `res.send` or `res.end` as medium and low confidence. `encodeURIComponent`, `prisma.$queryRaw`, `publicProcedure.input`, and `@Body()` are not that finding. `req.params.id` is not an IDOR finding and does not fail the default high gate. |
 | `bumps plan` / `bumps open` | **Experimental** (`FULLSHIELD_EXPERIMENTAL_BUMP_PR=1`). Ranks reachable high and critical `DEPS-VULN-001` bumps from a local `scan --json` file (`--from`). One pull request covers one package name and target (`clears` counts the findings). Plan JSON includes `skippedNotImported` and static `installScripts` (never executed). With `FULLSHIELD_EXPERIMENTAL_PROVENANCE=1`, a local cache entry that lacks `dist.attestations` is `provenanceBlocked` and is not opened. `open` runs `gh pr create` and never merges. `templates/fullshield-bumps.yml` is a nightly copy-in workflow. |
 | License policy | **Experimental** (`FULLSHIELD_EXPERIMENTAL_LICENSE_POLICY=1`). `deps.licenseDeny` and `deps.licenseAllow` match the installed direct dependency `license` string. `DEPS-LICENSE-002` is a license policy, not a vulnerability. A missing license stays silent. |
 | Private registry | **Experimental** (`FULLSHIELD_EXPERIMENTAL_PRIVATE_REG=1`). `deps.registry` must be https with no userinfo. The host is not contacted and is not added to the allowlist. Org advisories are read from `<cacheDir>/org-advisories.json` (`DEPS-ORG-ADV-001`), at most 1000000 bytes. |