progmune-runtime 3.7.59 → 3.7.61

package/CHANGELOG.md

@@ -1,6 +1,71 @@
 # Changelog
 
-## [3.7.58] — 2026-10-04（未发布）
+## [3.7.61] — 2026-10-06（未发布）
+
+### fr-017 点亮：授权身份锚点取自请求输入（修复回归 11/17）
+
+**归属语义漏报根因第一刀**：tinacms 的 `isAuthorized` 把「token 属于哪个
+app/client」的身份锚点从 `req.query.clientID` 读取去问身份服务——攻击者
+注册自己的 app 拿合法 token，即通过任意站点的后端授权（confused-deputy
+变体，GHSA-g74q-6g2f-874x）。修复 = 锚点改从服务端配置取
+（`expectedClientID ?? process.env.NEXT_PUBLIC_TINA_CLIENT_ID`）+ 取不到
+fail-closed。
+
+- 提取器 `src/extract-ir.ts`：`hasRequestAnchoredIdentity`——判据三元组
+  ① 从请求取 token（req.headers.authorization / headers().get('authorization')）
+  ② 从请求输入取 app/client 身份锚点（query/body/params 或 searchParams）
+  ③ 无服务端锚点证据（process.env. / getConfig( / config.）
+  ⇒ 注入 `__progmune_request_anchored_identity__`
+- 规则 "Authorization Identity Anchor from Request"（ts/js，marker-driven，
+  进 safeguard 告警流，与 fr-001/002/003 同族）
+- 边界（写死在判据里）：锚点名不含 tenant（多租户从请求解析租户锚点是
+  合法形态）；OAuth token 端点（req.body.client_id + client_secret，无
+  authorization header）不触发
+- **三态验证**：修复前 2/2 真值函数命中（@tinacms/auth 与
+  next-tinacms-azure 两个变体）/ 修复后 0/0；TS 盲测 119 项目逐函数
+  零漂移（LOST 0/ADDED 0）；fp-pool 真实语料 9 切片 1186 函数 0 命中；
+  定向测试 8/8。快照入库 `blind-benchmark/fr-corpus/fr-017-tinacms/`
+
+### fr-008 / fr-013 判定关闭（修复回归语料全量定性收官）
+
+- **fr-008**（SimpleWebAuthn，密码学协议语义）：证书链 walk 在第一个自签名
+  证书处 break，永不检查链尾拼上的配置信任锚点——「链内部自洽」冒充
+  「链终止于信任锚点」（修复 = break 条件改为 `issuer.equal(anchor)`）。
+  检出需要建模证书链验证协议语义，任何标记/污点/缺席判据都够不着，
+  归入 V1 七类根因「密码学协议语义」，不做。
+- **fr-013**（gitlab-mcp，五子问题全部分类）：F1(a) GraphQL 逗号前导形态
+  = 字符串解析语义；F1(b) execute_graphql 缺项目范围检查 = 缺席型判据
+  **唯一可点亮方向**，但判据是 MCP 工具处理器专属词汇，需 MCP 类公告
+  语料族（≥2-3 条）支撑，单条按三要件不做；F2/F3 配置通道路由（启动校验
+  门缺凭证形态 / SSE 默认无认证 + DNS rebinding）；F4 会话耗尽 DoS；
+  F5 内容级提示注入防御。constant-time 比较属加固建议类不单做。
+- **fr-corpus 17 条全部定性收官：有效 11/17（9 干净 DETECTED + 2
+  with-boundary），6 条判定关闭**（fr-004 闭包晚绑定 / fr-006 黑名单
+  完备性 / fr-008 密码学协议语义 / fr-009 守卫不足 / fr-013 五子问题
+  全出检出面 / fr-015 corpus_invalid+守卫不足）。
+
+## [3.7.60] — 2026-10-05
+
+### fr-002/003 点亮：令牌交换路径检查完备性（修复回归 10/17）
+
+**策略分支漏报根因第一刀**：OAuth 令牌交换路径绕过正常回调路径的检查——
+open-webui 同一函数 `token_exchange` 的两个独立公告：缺角色策略判定
+（fr-002，被角色策略拒绝的用户仍可登录）+ 缺域白名单检查（fr-003）。
+
+- 提取器 `tools/extract_ir.py`：`has_token_exchange_missing_guard`——函数名
+  token exchange 形态 + 函数体（AST 全量文本）缺角色判定或缺域检查 ⇒
+  注入 `__progmune_token_exchange_unguarded__`。缺席证据来自 AST 全量
+  文本（非 TS 侧 calls 通道的盲判，R75 适用边界明确）
+- 引擎规则 "Token Exchange Missing OAuth Guard"（python-only marker-driven）
+- **三态验证**：fr-002 parent 报（role 缺）/ fr-002 fix 0（两项齐）/
+  fr-003 fix 报（该时间点 role 漏洞在场，正确）；Python 盲测 90 项目
+  零触发（2533 条逐条一致）；定向测试 8/8
+- **fr-corpus 战绩：8 干净 DETECTED + 2 with-boundary = 有效 10/17**
+- **fr-006 判定不可点亮**：SSRF 黑名单条目缺失是「配置/词表完备性」
+  知识问题，静态判据无法穷举「该有的条目」，不硬做。归入漏报根因
+  新类「配置/词表完备性」
+
+### fr-014 点亮 + fr-015 关闭（2026-10-05）
 
 ### fr-001 点亮：身份映射子串匹配（修复回归 6/17）
 
@@ -49,7 +114,7 @@ external-ID）用 JSON 列 `.contains()` 做匹配——contains() 在 JSON 列
   （闭包晚绑定）」。注：fix_commit cd9db21c 是「重构形式的安全修复」
   （fr-013 教训的镜像：fix 性质必须以公告摘要核对）。
 
-## [3.7.57] — 2026-10-04（未发布）
+## [3.7.57] — 2026-10-04（3.7.57~3.7.59 合并条目）
 
 ### §51 held-out 验证 + §52-53 决策门禁 + 修冤枉第一刀（Data Mutation 族移除）
 

package/dist/extract-ir-request-anchored-identity.test.js

@@ -0,0 +1,223 @@
+"use strict";
+/**
+ * fr-017 定向回归：授权身份锚点取自请求输入
+ * （REALWORLD_FIX_REGRESSION fr-017，tinacms GHSA-g74q-6g2f-874x）
+ *
+ * 判据在 extract-ir.ts 的 hasRequestAnchoredIdentity（三元组）：
+ * ① 从请求取 token（req.headers.authorization / headers().get('authorization')）
+ * ② 从请求输入取身份锚点（req.query|body|params.<clientID|clientId|appId…>
+ *    或 searchParams.get('<锚点名>')）
+ * ③ 无服务端锚点证据（process.env. / getConfig( / config.）
+ * 三条件同时成立才注入 __progmune_request_anchored_identity__ 标记。
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const extract_ir_1 = require("./extract-ir");
+const protocol_detector_1 = require("./protocol-detector");
+const TSCONFIG = JSON.stringify({
+    compilerOptions: {
+        target: "ES2020",
+        module: "commonjs",
+        moduleResolution: "node",
+        strict: false,
+        skipLibCheck: true,
+        noEmit: true,
+    },
+    include: ["**/*.ts"],
+});
+function makeProject(files) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-fr017-"));
+    fs.writeFileSync(path.join(dir, "tsconfig.json"), TSCONFIG);
+    fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ name: "fixture", version: "0.0.0", private: true }));
+    for (const [rel, body] of Object.entries(files)) {
+        const abs = path.join(dir, rel);
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, body);
+    }
+    return dir;
+}
+const MARKER = "__progmune_request_anchored_identity__";
+(0, vitest_1.describe)("fr-017 request-anchored identity（提取器标记）", () => {
+    (0, vitest_1.it)("修复前形态：req.query.clientID 锚点 + authorization header → 注入标记", () => {
+        const dir = makeProject({
+            "index.ts": `
+export const isAuthorized = async (req: any): Promise<any> => {
+  const clientID = req.query.clientID;
+  const token = req.headers.authorization;
+  if (typeof clientID === 'string' && typeof token === 'string') {
+    return await isUserAuthorized({ clientID, token });
+  }
+  return undefined;
+};
+
+async function isUserAuthorized(args: { clientID: string; token: string }) {
+  return fetch("https://identity.example/verify", {
+    headers: { authorization: args.token },
+    body: JSON.stringify({ clientID: args.clientID }),
+  });
+}
+`,
+        });
+        const ir = (0, extract_ir_1.extractIR)(dir);
+        const fn = ir.find((f) => f.name === "isAuthorized");
+        const callee = ir.find((f) => f.name === "isUserAuthorized");
+        (0, vitest_1.expect)(fn).toBeDefined();
+        (0, vitest_1.expect)(fn.calls).toContain(MARKER);
+        // 被调用方没有 req 形态，不误标
+        (0, vitest_1.expect)(callee).toBeDefined();
+        (0, vitest_1.expect)(callee.calls).not.toContain(MARKER);
+    });
+    (0, vitest_1.it)("修复前形态（NextRequest）：searchParams.get('clientID') → 注入标记", () => {
+        const dir = makeProject({
+            "auth.ts": `
+export const isAuthorized = async (req: Request): Promise<any> => {
+  const clientID = new URL(req.url).searchParams.get('clientID');
+  const token = (await headers()).get('authorization');
+  if (typeof clientID === 'string' && typeof token === 'string') {
+    return await isUserAuthorized({ clientID, token });
+  }
+  return undefined;
+};
+
+async function isUserAuthorized(args: { clientID: string; token: string }) {
+  return fetch("https://identity.example/verify");
+}
+`,
+        });
+        const ir = (0, extract_ir_1.extractIR)(dir);
+        const fn = ir.find((f) => f.name === "isAuthorized");
+        (0, vitest_1.expect)(fn).toBeDefined();
+        (0, vitest_1.expect)(fn.calls).toContain(MARKER);
+    });
+    (0, vitest_1.it)("修复后形态：expectedClientID ?? process.env → 无标记", () => {
+        const dir = makeProject({
+            "index.ts": `
+export const isAuthorized = async (req: any, expectedClientID?: string): Promise<any> => {
+  const token = req.headers.authorization;
+  const clientID = (expectedClientID ?? process.env.NEXT_PUBLIC_TINA_CLIENT_ID)?.trim();
+  if (typeof clientID !== 'string' || clientID.length === 0) {
+    console.error("isAuthorized could not resolve this site's clientID. Refusing to authorize.");
+    return undefined;
+  }
+  if (typeof token !== 'string') return undefined;
+  return await isUserAuthorized({ clientID, token });
+};
+
+async function isUserAuthorized(args: { clientID: string; token: string }) {
+  return fetch("https://identity.example/verify");
+}
+`,
+        });
+        const ir = (0, extract_ir_1.extractIR)(dir);
+        for (const f of ir) {
+            (0, vitest_1.expect)(f.calls).not.toContain(MARKER);
+        }
+    });
+    (0, vitest_1.it)("负例：OAuth token 端点（req.body.client_id，无 authorization header）→ 无标记", () => {
+        const dir = makeProject({
+            "token.ts": `
+export const tokenEndpoint = async (req: any) => {
+  const clientId = req.body.client_id;
+  const clientSecret = req.body.client_secret;
+  return await exchangeToken({ clientId, clientSecret });
+};
+
+async function exchangeToken(args: { clientId: string; clientSecret: string }) {
+  return fetch("https://identity.example/token");
+}
+`,
+        });
+        const ir = (0, extract_ir_1.extractIR)(dir);
+        for (const f of ir) {
+            (0, vitest_1.expect)(f.calls).not.toContain(MARKER);
+        }
+    });
+    (0, vitest_1.it)("负例：锚点有服务端绑定（getConfig）→ 无标记", () => {
+        const dir = makeProject({
+            "index.ts": `
+export const isAuthorized = async (req: any): Promise<any> => {
+  const token = req.headers.authorization;
+  const clientID = req.query.clientID;
+  const expected = getConfig("client-id", "CLIENT_ID");
+  if (clientID !== expected) return undefined;
+  return await isUserAuthorized({ clientID: expected, token });
+};
+
+async function isUserAuthorized(args: { clientID: string; token: string }) {
+  return fetch("https://identity.example/verify");
+}
+`,
+        });
+        const ir = (0, extract_ir_1.extractIR)(dir);
+        for (const f of ir) {
+            (0, vitest_1.expect)(f.calls).not.toContain(MARKER);
+        }
+    });
+    (0, vitest_1.it)("负例：tenantId 从请求解析（多租户合法形态）→ 无标记", () => {
+        const dir = makeProject({
+            "index.ts": `
+export const isAuthorized = async (req: any): Promise<any> => {
+  const tenantId = req.query.tenantId;
+  const token = req.headers.authorization;
+  return await verifyTenantToken({ tenantId, token });
+};
+
+async function verifyTenantToken(args: { tenantId: string; token: string }) {
+  return fetch("https://identity.example/verify");
+}
+`,
+        });
+        const ir = (0, extract_ir_1.extractIR)(dir);
+        for (const f of ir) {
+            (0, vitest_1.expect)(f.calls).not.toContain(MARKER);
+        }
+    });
+});
+(0, vitest_1.describe)("fr-017 request-anchored identity（规则触发）", () => {
+    (0, vitest_1.it)("TS 语言：标记命中 Authorization Identity Anchor from Request", () => {
+        const svs = (0, protocol_detector_1.detectSafeguardViolations)([MARKER], "isAuthorized", "typescript", []);
+        const hit = svs.find((v) => v.rule === "Authorization Identity Anchor from Request");
+        (0, vitest_1.expect)(hit).toBeDefined();
+    });
+    (0, vitest_1.it)("python 语言：该规则不触发（languages 门）", () => {
+        const svs = (0, protocol_detector_1.detectSafeguardViolations)([MARKER], "is_authorized", "python", []);
+        const hit = svs.find((v) => v.rule === "Authorization Identity Anchor from Request");
+        (0, vitest_1.expect)(hit).toBeUndefined();
+    });
+});

package/dist/extract-ir.js

@@ -2891,6 +2891,41 @@ const URL_PARAM_NAME = /^(url|target|endpoint|link|href|webUrl|web_url|sourceUrl
 function collectUrlParamNames(params) {
     return params.map((p) => p.name).filter((n) => URL_PARAM_NAME.test(n));
 }
+// ═══════════════════════════════════════════════════════════════
+// 请求锚定身份标记（2026-10-06，fr-017 tinacms GHSA-g74q-6g2f-874x）
+//
+// 身份校验把「token 属于哪个 app/client」这一身份锚点从**请求输入**读取
+// （req.query.clientID / searchParams.get('clientID')）。攻击者注册自己的
+// app 拿到合法 token，再对受害者后端指定自己的 clientID——后端问身份服务
+// 「这 token 是不是该 app 的」→ 是 → 授权通过。修复形态 = 锚点改从服务端
+// 配置取（expectedClientID ?? process.env.NEXT_PUBLIC_TINA_CLIENT_ID），
+// 且取不到 fail-closed。
+//
+// 判据三元组（与 fr-002/003 的缺席判据同族）：
+//   ① 从请求取 token（req.headers.authorization / headers().get('authorization')）
+//   ② 从请求输入取身份锚点（req.query|body|params.<锚点名> 或 searchParams.get）
+//   ③ 无服务端锚点证据（process.env. / getConfig( / config.）
+// 锚点名不含 tenant——多租户从请求解析租户锚点是合法形态，只有 app/client
+// 身份才是「服务器该知道自己的身份」的一侧。
+// 消费方：protocol-detector 的 "Authorization Identity Anchor from Request"。
+// ═══════════════════════════════════════════════════════════════
+const REQUEST_ANCHORED_IDENTITY_MARKER = "__progmune_request_anchored_identity__";
+const IDENTITY_ANCHOR_NAMES = /clientID|clientId|client_id|appId|appID|app_id|applicationId|applicationID|application_id/;
+/** ① 从请求取 token（NextApiRequest 与 NextRequest 两种形态） */
+const REQ_TOKEN_SRC = /req\.headers\.authorization|\.get\(\s*["']authorization["']\s*\)/i;
+/** ② 从请求输入取身份锚点（query/body/params 成员或 searchParams.get） */
+const REQ_ANCHOR_SRC = new RegExp(`(?:req\\.(?:query|body|params)\\.(?:${IDENTITY_ANCHOR_NAMES.source})\\b|searchParams\\.get\\(\\s*["'](?:${IDENTITY_ANCHOR_NAMES.source})["']\\s*\\))`);
+/** ③ 服务端锚点证据：出现即视为锚点有服务端绑定（配置/环境/配置对象），不标记 */
+const SERVER_ANCHOR_EVIDENCE = /process\.env\.|\bgetConfig\s*\(|\bconfig\./i;
+function hasRequestAnchoredIdentity(text) {
+    if (!REQ_TOKEN_SRC.test(text))
+        return false;
+    if (!REQ_ANCHOR_SRC.test(text))
+        return false;
+    if (SERVER_ANCHOR_EVIDENCE.test(text))
+        return false;
+    return true;
+}
 /**
  * 标记增强的内联实现（2026-09-15 性能重构）：消费主循环已获取的
  * 函数文本与形参名，输出该函数应附加的合成标记。
@@ -2974,6 +3009,12 @@ function computeMarkerCalls(text, paramNames, sinkParams, onMethodHit, guardFns,
             }
         }
     }
+    // ── 请求锚定身份（2026-10-06，fr-017）──
+    // 纯函数体文本判据，无需函数名——isUserAuthorized（被调用方）体内没有
+    // req.headers.authorization 形态，不会误标；只有面向请求的校验入口会命中。
+    if (hasRequestAnchoredIdentity(text)) {
+        markers.push(REQUEST_ANCHORED_IDENTITY_MARKER);
+    }
     return markers;
 }
 /**

package/dist/protocol-detector-identity-substring.test.js

@@ -137,3 +137,55 @@ async def get_oauth_subject_from_claim(claim, db=None):
         }
     });
 });
+(0, vitest_1.describe)("fr-002/003 token exchange missing guard（提取器标记）", () => {
+    const TK_MARKER = "__progmune_token_exchange_unguarded__";
+    (0, vitest_1.it)("修复前形态：token_exchange 缺角色判定 → 注入标记（fr-002）", () => {
+        write("auths.py", `
+async def token_exchange(request, provider, token_data, db=None):
+    email = token_data.get('email', '').lower()
+    user = await Users.get_user_by_oauth_sub(provider, token_data.get('sub'), db)
+    return await create_session_response(request, user, db, source='oauth')
+`);
+        const ir = (0, extract_ir_python_1.extractIRPython)(dir);
+        const fn = ir.find((f) => f.name === "token_exchange");
+        (0, vitest_1.expect)(fn).toBeDefined();
+        (0, vitest_1.expect)(fn.calls).toContain(TK_MARKER);
+    });
+    (0, vitest_1.it)("修复前形态：token_exchange 缺域检查 → 注入标记（fr-003）", () => {
+        write("auths.py", `
+async def token_exchange(request, provider, token_data, db=None):
+    email = token_data.get('email', '').lower()
+    user = await Users.get_user_by_oauth_sub(provider, token_data.get('sub'), db)
+    role = await oauth_manager.get_user_role(user, user_data)
+    return await create_session_response(request, user, db, source='oauth')
+`);
+        const ir = (0, extract_ir_python_1.extractIRPython)(dir);
+        const fn = ir.find((f) => f.name === "token_exchange");
+        (0, vitest_1.expect)(fn.calls).toContain(TK_MARKER);
+    });
+    (0, vitest_1.it)("修复后形态：角色判定 + 域检查都有 → 无标记", () => {
+        write("auths.py", `
+async def token_exchange(request, provider, token_data, db=None):
+    email = token_data.get('email', '').lower()
+    if '*' not in auth_manager_config.OAUTH_ALLOWED_DOMAINS and email.split('@')[-1] not in auth_manager_config.OAUTH_ALLOWED_DOMAINS:
+        raise HTTPException(status_code=403)
+    user = await Users.get_user_by_oauth_sub(provider, token_data.get('sub'), db)
+    user = await oauth_manager.update_user_from_oauth(request=request, user=user, user_data=user_data, provider=provider, token=token_data, db=db)
+    return await create_session_response(request, user, db, source='oauth')
+`);
+        const ir = (0, extract_ir_python_1.extractIRPython)(dir);
+        const fn = ir.find((f) => f.name === "token_exchange");
+        (0, vitest_1.expect)(fn).toBeDefined();
+        (0, vitest_1.expect)(fn.calls).not.toContain(TK_MARKER);
+    });
+    (0, vitest_1.it)("负例：非 token exchange 函数 → 无标记", () => {
+        write("utils.py", `
+async def refresh_token(request, db=None):
+    return await create_session_response(request, None, db)
+`);
+        const ir = (0, extract_ir_python_1.extractIRPython)(dir);
+        for (const f of ir) {
+            (0, vitest_1.expect)(f.calls).not.toContain(TK_MARKER);
+        }
+    });
+});

package/dist/protocol-detector.js

@@ -862,6 +862,39 @@ const SAFEGUARD_RULES = [
         conceptMissing: ["ExactIdentityMatch", "SubscriptExtraction"],
         conceptExpected: ["oauth[provider]['sub'] == sub", "scim[provider]['external_id'] == external_id"],
     },
+    {
+        name: "Token Exchange Missing OAuth Guard",
+        category: "auth",
+        // 2026-10-05（REALWORLD_FIX_REGRESSION_V1 fr-002/fr-003）：OAuth 令牌
+        // 交换路径绕过正常回调路径的检查——open-webui 的 token_exchange 函数
+        // 缺角色策略判定（fr-002）与域白名单检查（fr-003）两个独立公告。
+        // Python 提取器在「函数名 token exchange 形态 + 函数体（AST 全量）
+        // 缺角色判定或缺域检查」时注入标记。缺席证据来自 AST 全量文本，
+        // 非 TS 侧 calls 通道（R75 的适用范围：calls 有损的盲判不适用）。
+        languages: ["python"],
+        trigger: /\b(__progmune_token_exchange_unguarded__)\b/,
+        safeguards: [],
+        violationMessage: "OAuth token exchange endpoint is missing the authorization checks the normal OAuth callback enforces — role policy (get_user_role / OAUTH_ALLOWED_ROLES) and/or email domain allowlist (OAUTH_ALLOWED_DOMAINS). Users rejected by role policy or outside the domain allowlist can still sign in through the token exchange path.",
+        conceptMissing: ["RolePolicyOnTokenExchange", "DomainAllowlistOnTokenExchange"],
+        conceptExpected: ["get_user_role before session creation", "OAUTH_ALLOWED_DOMAINS check"],
+    },
+    {
+        name: "Authorization Identity Anchor from Request",
+        category: "auth",
+        // 2026-10-06（REALWORLD_FIX_REGRESSION fr-017）：身份校验的锚点
+        // （token 属于哪个 app/client）从请求输入读取——tinacms 的 isAuthorized
+        // 从 req.query.clientID 取锚点去问身份服务「这 token 是不是该 app 的」，
+        // 攻击者注册自己的 app 拿合法 token 即通过任意站点的后端授权
+        // （GHSA-g74q-6g2f-874x）。修复 = 锚点改从服务端配置/环境取 +
+        // 取不到 fail-closed。判据在提取器侧 hasRequestAnchoredIdentity
+        // （三元组：请求取 token + 请求取 app/client 锚点 + 无服务端锚点证据）。
+        languages: ["typescript", "javascript"],
+        trigger: /\b(__progmune_request_anchored_identity__)\b/,
+        safeguards: [],
+        violationMessage: "Authorization validates a token against an app/client identity read from the request (query/body/searchParams) rather than server configuration — an attacker registers their own app identity, supplies a token that IS valid for it, and passes authorization on any endpoint using this function. Anchor the identity in server config/env and fail closed when it cannot be resolved.",
+        conceptMissing: ["ServerConfiguredIdentityAnchor"],
+        conceptExpected: ["expectedClientID from config/env", "fail-closed when anchor unresolved"],
+    },
     {
         name: "XSS (Unsafe Template Rendering)",
         category: "xss",

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.59";
+exports.RUNTIME_VERSION = "3.7.61";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.59",
+  "version": "3.7.61",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",

package/tools/extract_ir.py

@@ -782,6 +782,32 @@ def has_identity_substring_match(node):
     return False
 
 
+TOKEN_EXCHANGE_UNGUARDED_MARKER = "__progmune_token_exchange_unguarded__"
+
+
+def has_token_exchange_missing_guard(node):
+    """OAuth 令牌交换路径绕过正常回调路径的检查（REALWORLD_FIX_REGRESSION_V1
+    fr-002/fr-003 open-webui——同一函数 token_exchange 的两个独立公告）：
+    fr-002 角色策略（OAUTH_ALLOWED_ROLES/ADMIN_ROLES）未在令牌交换路径执行，
+    被角色策略拒绝的用户仍可登录；fr-003 域白名单（OAUTH_ALLOWED_DOMAINS）
+    同样只在正常 callback 检查、token_exchange 跳过。
+    判据（语义定义，正向证据）：函数名是 token exchange 形态，且函数体
+    （AST 全量文本）缺角色判定或缺域检查——Python 提取器有 AST 全量函数体，
+    缺席证据不是 TS 侧「calls 通道有损」的盲判（R75 的适用范围说明）。"""
+    try:
+        name = getattr(node, "name", "")
+        if not re.search(r"token[_\s]?exchange", name, re.I):
+            return False
+        text = ast.unparse(node)
+    except Exception:
+        return False
+    has_role = bool(re.search(r"get_user_role|update_user_from_oauth|determined_role", text))
+    has_domain = bool(
+        re.search(r"OAUTH_ALLOWED_DOMAINS|ALLOWED_DOMAINS|email\.split\([^)]*@", text)
+    )
+    return not has_role or not has_domain
+
+
 def has_cross_user_resource_write(node):
     """跨用户资源写入（REALWORLD_FIX_REGRESSION_V1 fr-005 open-webui）：
     函数把请求 payload 里的外来资源 id（folder_id 等）连同持久化调用
@@ -995,6 +1021,8 @@ def extract_calls(node, unsafe_vars=None, imports=None, module_constants=None, g
         calls.append(CROSS_USER_WRITE_MARKER)
     if has_identity_substring_match(node) and IDENTITY_SUBSTRING_MARKER not in calls:
         calls.append(IDENTITY_SUBSTRING_MARKER)
+    if has_token_exchange_missing_guard(node) and TOKEN_EXCHANGE_UNGUARDED_MARKER not in calls:
+        calls.append(TOKEN_EXCHANGE_UNGUARDED_MARKER)
     if has_command_taint_flow(node) and CMD_FLOW_MARKER not in calls:
         calls.append(CMD_FLOW_MARKER)
     if has_csrf_exempt(node) and CSRF_MARKER not in calls: