progmune-runtime 3.7.27 → 3.7.28

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [3.7.28] — 2026-09-14
+
+### SSRF 检测 TS 化 + Python 形参污点扩展（A3，修复回归 fr-009/010/011 驱动）
+
+- **TS 提取器 SSRF 标记**（`extract-ir.ts`）：URL 形参/request 污点 → HTTP fetch sink（fetch/axios.*/http.request/ky.*/undici.request/nodeFetch/got），函数内无 SSRF 守卫词汇（private-IP/loopback/denylist/hostname 校验）→ `__progmune_ssrf_user_url__`
+- **Python 形参污点扩展**（`extract_ir.py`）：URL 形参（url/target/endpoint/spec_url…）作为污点源（库形态，如 from_url(url)）；守卫抑制词汇（validate_url/safe_http/is_blocked_hostname 等；**不含裸 "ssrf"**——PyGoat 实验模板名 ssrf_lab2.html 会被误抑制）；**is_request_rooted 收紧**：裸名 "request" 仅当它是函数形参才算请求根——此前局部变量命名为 request 会被误判（skyvern _fetch_discovery FP 根因）
+- **引擎 IR 层消费**：SSRF 违规直接报出（同 PATH_TRAVERSAL/AUTHZ_CROSS_USER_WRITE 模式）——Python 侧 SSRF 标记此前在引擎管线中是死的，本版点亮
+- **修复回归战绩 4/11**：fr-011（mcp-from-openapi TS，引擎级：修复前 SSRF ×1 @ fromURL 真值位置/修复后 0）✅、fr-010（unstructured Python，提取器级：修复前 2 标记命中 partition_md/file_and_type_from_url/修复后 0；整仓 tarball 网络截断，mini 语料验证如实记录）✅、PyGoat ssrf_lab2 引擎级 TP 恢复 ✅；fr-009（open-webui DNS 重绑定）为「守卫存在但不足」类，标记模型边界如实不覆盖
+- **skyvern 精化**：_fetch_discovery FP 消除；_download_screenshot 为弱 TP（scheme 校验≠SSRF 防护，如实标注）
+
+### 回归
+
+- TS 795 零漂移（3086 LOST 0/ADDED 0）✓ / Python 盲测 64/64 ✓ / Python 源级金标 SSRF 0 命中 ✓ / open-seo 10 无漂移 ✓ / 引擎测试 73 green ✓ / build ✓ / check 免疫正常 ✓
+
 ## [3.7.27] — 2026-09-13
 
 ### 归属校验 Python 化（A2，修复回归 fr-005 驱动）

package/dist/extract-ir.js

@@ -598,6 +598,96 @@ function augmentPathTraversalMarkers(project, funcs, absRoot) {
         });
     }
 }
+// ═══════════════════════════════════════════════════════════════
+// SSRF marker（2026-09-14，REALWORLD_FIX_REGRESSION fr-011/fr-010）
+// URL 形参/request 污点 → HTTP fetch sink，函数内无 SSRF 守卫证据
+// （private-IP/loopback/denylist/hostname 校验词汇）→ 注入
+// __progmune_ssrf_user_url__。库形态（mcp-from-openapi fromURL）与
+// Web 形态（req.params）共用同一标记；引擎 IR 层消费。
+// ═══════════════════════════════════════════════════════════════
+const TS_HTTP_FETCH_SINK = /\b(fetch|axios\.(?:get|post|put|delete|head|patch)|http\.request|https\.request|ky\.(?:get|post|put|delete|head|patch)|undici\.request|nodeFetch|got)\s*\(/;
+const SSRF_GUARD_EVIDENCE = /127\.0\.0\.1|0\.0\.0\.0|169\.254\.|::1|localhost|isPrivate|isLoopback|hostname|denylist|blocklist|ssrf|validateUrl|isSafeUrl|getAddresses|ipaddress|forbidden_host|private_ip/i;
+const URL_PARAM_NAME = /^(url|target|endpoint|link|href|webUrl|web_url|sourceUrl|source_url|remoteUrl|remote_url|fetchUrl|fetch_url|specUrl|spec_url|apiUrl|api_url|origin|baseUrl|base_url)$/i;
+function collectUrlParamNames(params) {
+    return params.map((p) => p.name).filter((n) => URL_PARAM_NAME.test(n));
+}
+function augmentSsfrMarkers(project, funcs, absRoot) {
+    const sinkRe = TS_HTTP_FETCH_SINK;
+    for (const sf of project.getSourceFiles()) {
+        if (sf.getFilePath().includes("node_modules"))
+            continue;
+        const relPath = path.relative(absRoot, sf.getFilePath());
+        sf.forEachDescendant((node) => {
+            if (!ts_morph_1.Node.isFunctionDeclaration(node) &&
+                !ts_morph_1.Node.isArrowFunction(node) &&
+                !ts_morph_1.Node.isMethodDeclaration(node)) {
+                return;
+            }
+            const text = node.getText();
+            if (text.length > 12000)
+                return; // 巨型函数跳过（性能 + 噪声）
+            // 预过滤：必须有 fetch sink
+            sinkRe.lastIndex = 0;
+            if (!sinkRe.test(text))
+                return;
+            // 守卫证据：函数内有 SSRF 防护词汇 → 抑制
+            if (SSRF_GUARD_EVIDENCE.test(text))
+                return;
+            // URL 形参污点
+            const urlParams = ts_morph_1.Node.isArrowFunction(node)
+                ? []
+                : collectUrlParamNames(node.getParameters().map((p) => ({ name: p.getName() })));
+            // request 污点（Web 形态）
+            const reqTainted = collectTaintedNames(text);
+            const taintParts = [];
+            if (urlParams.length > 0)
+                taintParts.push(`\\b(?:${urlParams.join("|")})\\b`);
+            if (reqTainted.size > 0)
+                taintParts.push(`\\b(?:${[...reqTainted].join("|")})\\b`);
+            taintParts.push(/\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/.source);
+            const taint = new RegExp(taintParts.join("|"));
+            if (taintParts.length <= 1) {
+                // 只有 request 根模式而无实际污点名——仍需检查 sink 实参
+            }
+            // sink 实参窗口含污点 → 标记
+            let flagged = false;
+            sinkRe.lastIndex = 0;
+            let m;
+            while ((m = sinkRe.exec(text)) !== null) {
+                // 取调用后 300 字符窗口（URL 是首个实参）
+                const after = text.slice(m.index + m[0].length, m.index + m[0].length + 300);
+                if (taint.test(after)) {
+                    flagged = true;
+                    break;
+                }
+            }
+            if (!flagged)
+                return;
+            const nodeName = ts_morph_1.Node.isArrowFunction(node) ? undefined : node.getName();
+            if (ts_morph_1.Node.isFunctionDeclaration(node) && nodeName) {
+                const entry = funcs.find((x) => x.name === nodeName && x.file === relPath);
+                if (entry) {
+                    entry.calls = entry.calls || [];
+                    if (!entry.calls.includes("__progmune_ssrf_user_url__")) {
+                        entry.calls.push("__progmune_ssrf_user_url__");
+                    }
+                }
+            }
+            else if (ts_morph_1.Node.isMethodDeclaration(node) && nodeName) {
+                const cls = node.getParent();
+                if (ts_morph_1.Node.isClassDeclaration(cls) && cls.getName()) {
+                    const entry = funcs.find((x) => x.name === `${cls.getName()}.${nodeName}` && x.file === relPath);
+                    if (entry) {
+                        entry.calls = entry.calls || [];
+                        if (!entry.calls.includes("__progmune_ssrf_user_url__")) {
+                            entry.calls.push("__progmune_ssrf_user_url__");
+                        }
+                    }
+                }
+            }
+        });
+    }
+}
 /**
  * 从 TypeScript 项目提取 IR（函数签名、参数、返回值、协议注解）。
  * @protocol namespace=dev_pipeline pre_states=[] post_states=["IR_EXTRACTED"] invalidate=["IR_STALE"]
@@ -784,6 +874,7 @@ function _extractSingleProject(absRoot, tsconfigPath) {
     // 与 protocol-detector 同名规则（source-level benchmark 路径）。
     // ═══════════════════════════════════════════════════════════════
     augmentPathTraversalMarkers(project, funcs, absRoot);
+    augmentSsfrMarkers(project, funcs, absRoot);
     // ═══════════════════════════════════════════════════════════════
     // Phase 5: Dynamic external function resolution
     // Replaces hardcoded knownExternals

package/dist/protocol-detector.js

@@ -658,12 +658,17 @@ const SAFEGUARD_RULES = [
     {
         name: "SSRF (User-Controlled URL Fetch)",
         category: "ssrf",
-        languages: ["python"],
-        // Source-level detection: the Python extractor emits a synthetic marker
-        // call when an HTTP fetch (requests.*/urllib.*/httpx.*/aiohttp.*/urlopen)
-        // receives a URL tainted by request-derived user input (directly or via
-        // single-hop assignment). No satisfier possible — the marker IS the
-        // violation evidence.
+        // 2026-09-14（A3 fr-011/fr-010）：TS 提取器（extract-ir.ts）自 2026-09-14
+        // 起同样注入该标记（URL 形参/request 污点 → HTTP fetch sink，无 SSRF
+        // 守卫），Python 侧同版扩展形参污点——语言面扩展。
+        languages: ["typescript", "javascript", "python"],
+        // Source-level detection: the language extractors emit a synthetic marker
+        // call when an HTTP fetch (requests.*/urllib.*/httpx.*/aiohttp.*/urlopen;
+        // TS: fetch/axios.*/http.request/ky.*/got/undici.request) receives a URL
+        // tainted by request-derived user input or a URL-shaped function parameter
+        // (directly or via single-hop assignment) with no SSRF guard in the
+        // function (private-IP/loopback/denylist/hostname validation evidence).
+        // No satisfier possible — the marker IS the violation evidence.
         trigger: /\b(__progmune_ssrf_user_url__)\b/,
         safeguards: [],
         violationMessage: "HTTP fetch whose URL derives from user-controlled request input — server-side request forgery.",

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.27";
+exports.RUNTIME_VERSION = "3.7.28";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -1282,6 +1282,20 @@ async function collectProtocolViolations(ctx, callGraph) {
                                 policy_ref: "protocol-safety.specific",
                             });
                         }
+                        if (calls.includes("__progmune_ssrf_user_url__")) {
+                            violations.push({
+                                severity: "medium",
+                                rule_id: "SSRF",
+                                file: f.file,
+                                function: f.name || "unknown",
+                                message: "HTTP fetch whose URL derives from user-controlled input or a URL-shaped function parameter with no SSRF guard — server-side request forgery.",
+                                evidence: "__progmune_ssrf_user_url__",
+                                why: "Extractor-verified: fetch sink receives request-tainted or URL-parameter input " +
+                                    "with no private-IP/loopback/denylist/hostname validation evidence in the function.",
+                                fix: "Validate the URL (scheme allowlist, private-IP/loopback block, DNS pinning) before fetching.",
+                                policy_ref: "protocol-safety.specific",
+                            });
+                        }
                         if (calls.includes("__progmune_cross_user_write__")) {
                             violations.push({
                                 severity: "medium",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.27",
+  "version": "3.7.28",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",

package/tools/extract_ir.py

@@ -105,40 +105,50 @@ SSRF_MARKER = "__progmune_ssrf_user_url__"
 HTTP_FETCH_RECEIVERS = ("requests", "httpx", "urllib", "urllib2", "aiohttp", "http")
 
 
-def is_request_rooted(node):
+def is_request_rooted(node, request_params=None):
     """True if the expression derives from the request object
-    (request.POST.get(...), request.GET['x'], request.body ...)."""
+    (request.POST.get(...), request.GET['x'], request.body ...).
+    2026-09-14 收紧：裸名 "request" 仅当它是函数形参（Web 处理器签名）
+    时才算 request 根——此前任何局部变量命名为 request 都被误判
+    （skyvern _fetch_discovery：request = urllib.request.Request(url)，
+    局部变量撞词 → SSRF 误报）。request_params=None 保持旧行为。"""
     if isinstance(node, ast.Name):
-        return node.id == "request"
+        if node.id != "request":
+            return False
+        return request_params is None or "request" in request_params
     if isinstance(node, ast.Attribute):
-        return is_request_rooted(node.value)
+        return is_request_rooted(node.value, request_params)
     if isinstance(node, ast.Subscript):
-        return is_request_rooted(node.value)
+        return is_request_rooted(node.value, request_params)
     if isinstance(node, ast.Call):
-        return (is_request_rooted(node.func)
-                or any(is_request_rooted(a) for a in node.args)
-                or any(is_request_rooted(k.value) for k in node.keywords))
+        return (is_request_rooted(node.func, request_params)
+                or any(is_request_rooted(a, request_params) for a in node.args)
+                or any(is_request_rooted(k.value, request_params) for k in node.keywords))
     return False
 
 
-def is_tainted(node, assigns, depth=0):
+def _func_param_names(node):
+    return {a.arg for a in node.args.args + node.args.posonlyargs + node.args.kwonlyargs}
+
+
+def is_tainted(node, assigns, depth=0, request_params=None):
     """Single-hop taint: request-rooted, variable assigned from a tainted
     value, or dynamic formatting containing tainted parts."""
     if node is None or depth > 2:
         return False
-    if is_request_rooted(node):
+    if is_request_rooted(node, request_params):
         return True
     if isinstance(node, ast.Name):
-        return is_tainted(assigns.get(node.id), assigns, depth + 1)
+        return is_tainted(assigns.get(node.id), assigns, depth + 1, request_params)
     if isinstance(node, ast.JoinedStr):
-        return any(is_tainted(v.value, assigns, depth + 1)
+        return any(is_tainted(v.value, assigns, depth + 1, request_params)
                    for v in node.values if isinstance(v, ast.FormattedValue))
     if isinstance(node, ast.BinOp):
-        return (is_tainted(node.left, assigns, depth)
-                or is_tainted(node.right, assigns, depth))
+        return (is_tainted(node.left, assigns, depth, request_params)
+                or is_tainted(node.right, assigns, depth, request_params))
     if isinstance(node, ast.Call):
-        return (any(is_tainted(a, assigns, depth) for a in node.args)
-                or any(is_tainted(k.value, assigns, depth) for k in node.keywords))
+        return (any(is_tainted(a, assigns, depth, request_params) for a in node.args)
+                or any(is_tainted(k.value, assigns, depth, request_params) for k in node.keywords))
     return False
 
 
@@ -162,15 +172,57 @@ def is_http_fetch_call(node):
     return False
 
 
+URL_PARAM_NAMES = re.compile(
+    r"^(url|target|endpoint|link|href|web_url|source_url|remote_url|"
+    r"fetch_url|spec_url|api_url|base_url|origin)$",
+    re.I,
+)
+
+SSRF_GUARD_EVIDENCE = re.compile(
+    r"127\.0\.0\.1|0\.0\.0\.0|169\.254\.|::1|localhost|is_private|"
+    r"is_loopback|hostname|deny_?list|block_?list|validate_url|"
+    r"is_safe_url|get_addresses|ipaddress|forbidden_host|private_ip|"
+    r"safe_http|get_ssrf_safe|assert_url_safe|is_blocked_hostname|"
+    r"is_blocked_address|blocked_hostnames",
+    re.I,
+)
+
+
 def has_ssrf(node):
     """SSRF check: an HTTP fetch call whose URL argument is tainted by
-    request-derived user input (directly or via single-hop assignment)."""
+    request-derived user input (directly or via single-hop assignment)
+    or references a URL-shaped function parameter (library form, e.g.
+    from_url(url)) — with no SSRF guard evidence in the function
+    (private-IP/loopback/denylist/hostname validation vocabulary).
+    2026-09-14 扩展（fr-010/fr-011）：形参污点 + 守卫抑制。"""
+    # 守卫证据：函数体内有 SSRF 防护词汇 → 不报（fr-009 证明
+    # 「守卫存在但不足」的 DNS 重绑定类是标记模型的边界，如实不覆盖）
+    try:
+        text = ast.unparse(node)
+    except Exception:
+        text = ""
+    if text and SSRF_GUARD_EVIDENCE.search(text):
+        return False
     assigns = collect_assignments(node)
+    request_params = _func_param_names(node)
+    url_params = {
+        a for a in request_params if URL_PARAM_NAMES.match(a or "")
+    }
+
+    def refs_url_param(n):
+        if isinstance(n, ast.Name):
+            return n.id in url_params
+        if isinstance(n, (ast.Attribute, ast.Subscript)):
+            return refs_url_param(n.value)
+        return False
+
     for child in ast.walk(node):
         if isinstance(child, ast.Call) and is_http_fetch_call(child):
-            if any(is_tainted(a, assigns) for a in child.args):
+            if any(is_tainted(a, assigns, request_params=request_params) for a in child.args):
+                return True
+            if any(is_tainted(k.value, assigns, request_params=request_params) for k in child.keywords):
                 return True
-            if any(is_tainted(k.value, assigns) for k in child.keywords):
+            if any(refs_url_param(a) for a in child.args):
                 return True
     return False
 
@@ -827,12 +879,13 @@ def has_path_traversal(node):
     request-derived user input (directly or via single-hop assignment —
     os.path.join chains resolve through assignment tracking)."""
     assigns = collect_assignments(node)
+    request_params = _func_param_names(node)
     for child in ast.walk(node):
         if not isinstance(child, ast.Call) or not is_file_sink_call(child):
             continue
-        if any(is_tainted(a, assigns) for a in child.args):
+        if any(is_tainted(a, assigns, request_params=request_params) for a in child.args):
             return True
-        if any(is_tainted(k.value, assigns) for k in child.keywords):
+        if any(is_tainted(k.value, assigns, request_params=request_params) for k in child.keywords):
             return True
         # Path(...).read_text(): the tainted path lives in the receiver —
         # either the direct call or a variable assigned from a Path(...) call.