progmune-runtime 3.7.60 → 3.7.61

package/CHANGELOG.md

@@ -1,6 +1,50 @@
 # Changelog
 
-## [3.7.60] — 2026-10-05（未发布）
+## [3.7.61] — 2026-10-06（未发布）
+
+### fr-017 点亮：授权身份锚点取自请求输入（修复回归 11/17）
+
+**归属语义漏报根因第一刀**：tinacms 的 `isAuthorized` 把「token 属于哪个
+app/client」的身份锚点从 `req.query.clientID` 读取去问身份服务——攻击者
+注册自己的 app 拿合法 token，即通过任意站点的后端授权（confused-deputy
+变体，GHSA-g74q-6g2f-874x）。修复 = 锚点改从服务端配置取
+（`expectedClientID ?? process.env.NEXT_PUBLIC_TINA_CLIENT_ID`）+ 取不到
+fail-closed。
+
+- 提取器 `src/extract-ir.ts`：`hasRequestAnchoredIdentity`——判据三元组
+  ① 从请求取 token（req.headers.authorization / headers().get('authorization')）
+  ② 从请求输入取 app/client 身份锚点（query/body/params 或 searchParams）
+  ③ 无服务端锚点证据（process.env. / getConfig( / config.）
+  ⇒ 注入 `__progmune_request_anchored_identity__`
+- 规则 "Authorization Identity Anchor from Request"（ts/js，marker-driven，
+  进 safeguard 告警流，与 fr-001/002/003 同族）
+- 边界（写死在判据里）：锚点名不含 tenant（多租户从请求解析租户锚点是
+  合法形态）；OAuth token 端点（req.body.client_id + client_secret，无
+  authorization header）不触发
+- **三态验证**：修复前 2/2 真值函数命中（@tinacms/auth 与
+  next-tinacms-azure 两个变体）/ 修复后 0/0；TS 盲测 119 项目逐函数
+  零漂移（LOST 0/ADDED 0）；fp-pool 真实语料 9 切片 1186 函数 0 命中；
+  定向测试 8/8。快照入库 `blind-benchmark/fr-corpus/fr-017-tinacms/`
+
+### fr-008 / fr-013 判定关闭（修复回归语料全量定性收官）
+
+- **fr-008**（SimpleWebAuthn，密码学协议语义）：证书链 walk 在第一个自签名
+  证书处 break，永不检查链尾拼上的配置信任锚点——「链内部自洽」冒充
+  「链终止于信任锚点」（修复 = break 条件改为 `issuer.equal(anchor)`）。
+  检出需要建模证书链验证协议语义，任何标记/污点/缺席判据都够不着，
+  归入 V1 七类根因「密码学协议语义」，不做。
+- **fr-013**（gitlab-mcp，五子问题全部分类）：F1(a) GraphQL 逗号前导形态
+  = 字符串解析语义；F1(b) execute_graphql 缺项目范围检查 = 缺席型判据
+  **唯一可点亮方向**，但判据是 MCP 工具处理器专属词汇，需 MCP 类公告
+  语料族（≥2-3 条）支撑，单条按三要件不做；F2/F3 配置通道路由（启动校验
+  门缺凭证形态 / SSE 默认无认证 + DNS rebinding）；F4 会话耗尽 DoS；
+  F5 内容级提示注入防御。constant-time 比较属加固建议类不单做。
+- **fr-corpus 17 条全部定性收官：有效 11/17（9 干净 DETECTED + 2
+  with-boundary），6 条判定关闭**（fr-004 闭包晚绑定 / fr-006 黑名单
+  完备性 / fr-008 密码学协议语义 / fr-009 守卫不足 / fr-013 五子问题
+  全出检出面 / fr-015 corpus_invalid+守卫不足）。
+
+## [3.7.60] — 2026-10-05
 
 ### fr-002/003 点亮：令牌交换路径检查完备性（修复回归 10/17）
 

package/dist/extract-ir-request-anchored-identity.test.js

@@ -0,0 +1,223 @@
+"use strict";
+/**
+ * fr-017 定向回归：授权身份锚点取自请求输入
+ * （REALWORLD_FIX_REGRESSION fr-017，tinacms GHSA-g74q-6g2f-874x）
+ *
+ * 判据在 extract-ir.ts 的 hasRequestAnchoredIdentity（三元组）：
+ * ① 从请求取 token（req.headers.authorization / headers().get('authorization')）
+ * ② 从请求输入取身份锚点（req.query|body|params.<clientID|clientId|appId…>
+ *    或 searchParams.get('<锚点名>')）
+ * ③ 无服务端锚点证据（process.env. / getConfig( / config.）
+ * 三条件同时成立才注入 __progmune_request_anchored_identity__ 标记。
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const extract_ir_1 = require("./extract-ir");
+const protocol_detector_1 = require("./protocol-detector");
+const TSCONFIG = JSON.stringify({
+    compilerOptions: {
+        target: "ES2020",
+        module: "commonjs",
+        moduleResolution: "node",
+        strict: false,
+        skipLibCheck: true,
+        noEmit: true,
+    },
+    include: ["**/*.ts"],
+});
+function makeProject(files) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-fr017-"));
+    fs.writeFileSync(path.join(dir, "tsconfig.json"), TSCONFIG);
+    fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ name: "fixture", version: "0.0.0", private: true }));
+    for (const [rel, body] of Object.entries(files)) {
+        const abs = path.join(dir, rel);
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, body);
+    }
+    return dir;
+}
+const MARKER = "__progmune_request_anchored_identity__";
+(0, vitest_1.describe)("fr-017 request-anchored identity（提取器标记）", () => {
+    (0, vitest_1.it)("修复前形态：req.query.clientID 锚点 + authorization header → 注入标记", () => {
+        const dir = makeProject({
+            "index.ts": `
+export const isAuthorized = async (req: any): Promise<any> => {
+  const clientID = req.query.clientID;
+  const token = req.headers.authorization;
+  if (typeof clientID === 'string' && typeof token === 'string') {
+    return await isUserAuthorized({ clientID, token });
+  }
+  return undefined;
+};
+
+async function isUserAuthorized(args: { clientID: string; token: string }) {
+  return fetch("https://identity.example/verify", {
+    headers: { authorization: args.token },
+    body: JSON.stringify({ clientID: args.clientID }),
+  });
+}
+`,
+        });
+        const ir = (0, extract_ir_1.extractIR)(dir);
+        const fn = ir.find((f) => f.name === "isAuthorized");
+        const callee = ir.find((f) => f.name === "isUserAuthorized");
+        (0, vitest_1.expect)(fn).toBeDefined();
+        (0, vitest_1.expect)(fn.calls).toContain(MARKER);
+        // 被调用方没有 req 形态，不误标
+        (0, vitest_1.expect)(callee).toBeDefined();
+        (0, vitest_1.expect)(callee.calls).not.toContain(MARKER);
+    });
+    (0, vitest_1.it)("修复前形态（NextRequest）：searchParams.get('clientID') → 注入标记", () => {
+        const dir = makeProject({
+            "auth.ts": `
+export const isAuthorized = async (req: Request): Promise<any> => {
+  const clientID = new URL(req.url).searchParams.get('clientID');
+  const token = (await headers()).get('authorization');
+  if (typeof clientID === 'string' && typeof token === 'string') {
+    return await isUserAuthorized({ clientID, token });
+  }
+  return undefined;
+};
+
+async function isUserAuthorized(args: { clientID: string; token: string }) {
+  return fetch("https://identity.example/verify");
+}
+`,
+        });
+        const ir = (0, extract_ir_1.extractIR)(dir);
+        const fn = ir.find((f) => f.name === "isAuthorized");
+        (0, vitest_1.expect)(fn).toBeDefined();
+        (0, vitest_1.expect)(fn.calls).toContain(MARKER);
+    });
+    (0, vitest_1.it)("修复后形态：expectedClientID ?? process.env → 无标记", () => {
+        const dir = makeProject({
+            "index.ts": `
+export const isAuthorized = async (req: any, expectedClientID?: string): Promise<any> => {
+  const token = req.headers.authorization;
+  const clientID = (expectedClientID ?? process.env.NEXT_PUBLIC_TINA_CLIENT_ID)?.trim();
+  if (typeof clientID !== 'string' || clientID.length === 0) {
+    console.error("isAuthorized could not resolve this site's clientID. Refusing to authorize.");
+    return undefined;
+  }
+  if (typeof token !== 'string') return undefined;
+  return await isUserAuthorized({ clientID, token });
+};
+
+async function isUserAuthorized(args: { clientID: string; token: string }) {
+  return fetch("https://identity.example/verify");
+}
+`,
+        });
+        const ir = (0, extract_ir_1.extractIR)(dir);
+        for (const f of ir) {
+            (0, vitest_1.expect)(f.calls).not.toContain(MARKER);
+        }
+    });
+    (0, vitest_1.it)("负例：OAuth token 端点（req.body.client_id，无 authorization header）→ 无标记", () => {
+        const dir = makeProject({
+            "token.ts": `
+export const tokenEndpoint = async (req: any) => {
+  const clientId = req.body.client_id;
+  const clientSecret = req.body.client_secret;
+  return await exchangeToken({ clientId, clientSecret });
+};
+
+async function exchangeToken(args: { clientId: string; clientSecret: string }) {
+  return fetch("https://identity.example/token");
+}
+`,
+        });
+        const ir = (0, extract_ir_1.extractIR)(dir);
+        for (const f of ir) {
+            (0, vitest_1.expect)(f.calls).not.toContain(MARKER);
+        }
+    });
+    (0, vitest_1.it)("负例：锚点有服务端绑定（getConfig）→ 无标记", () => {
+        const dir = makeProject({
+            "index.ts": `
+export const isAuthorized = async (req: any): Promise<any> => {
+  const token = req.headers.authorization;
+  const clientID = req.query.clientID;
+  const expected = getConfig("client-id", "CLIENT_ID");
+  if (clientID !== expected) return undefined;
+  return await isUserAuthorized({ clientID: expected, token });
+};
+
+async function isUserAuthorized(args: { clientID: string; token: string }) {
+  return fetch("https://identity.example/verify");
+}
+`,
+        });
+        const ir = (0, extract_ir_1.extractIR)(dir);
+        for (const f of ir) {
+            (0, vitest_1.expect)(f.calls).not.toContain(MARKER);
+        }
+    });
+    (0, vitest_1.it)("负例：tenantId 从请求解析（多租户合法形态）→ 无标记", () => {
+        const dir = makeProject({
+            "index.ts": `
+export const isAuthorized = async (req: any): Promise<any> => {
+  const tenantId = req.query.tenantId;
+  const token = req.headers.authorization;
+  return await verifyTenantToken({ tenantId, token });
+};
+
+async function verifyTenantToken(args: { tenantId: string; token: string }) {
+  return fetch("https://identity.example/verify");
+}
+`,
+        });
+        const ir = (0, extract_ir_1.extractIR)(dir);
+        for (const f of ir) {
+            (0, vitest_1.expect)(f.calls).not.toContain(MARKER);
+        }
+    });
+});
+(0, vitest_1.describe)("fr-017 request-anchored identity（规则触发）", () => {
+    (0, vitest_1.it)("TS 语言：标记命中 Authorization Identity Anchor from Request", () => {
+        const svs = (0, protocol_detector_1.detectSafeguardViolations)([MARKER], "isAuthorized", "typescript", []);
+        const hit = svs.find((v) => v.rule === "Authorization Identity Anchor from Request");
+        (0, vitest_1.expect)(hit).toBeDefined();
+    });
+    (0, vitest_1.it)("python 语言：该规则不触发（languages 门）", () => {
+        const svs = (0, protocol_detector_1.detectSafeguardViolations)([MARKER], "is_authorized", "python", []);
+        const hit = svs.find((v) => v.rule === "Authorization Identity Anchor from Request");
+        (0, vitest_1.expect)(hit).toBeUndefined();
+    });
+});

package/dist/extract-ir.js

@@ -2891,6 +2891,41 @@ const URL_PARAM_NAME = /^(url|target|endpoint|link|href|webUrl|web_url|sourceUrl
 function collectUrlParamNames(params) {
     return params.map((p) => p.name).filter((n) => URL_PARAM_NAME.test(n));
 }
+// ═══════════════════════════════════════════════════════════════
+// 请求锚定身份标记（2026-10-06，fr-017 tinacms GHSA-g74q-6g2f-874x）
+//
+// 身份校验把「token 属于哪个 app/client」这一身份锚点从**请求输入**读取
+// （req.query.clientID / searchParams.get('clientID')）。攻击者注册自己的
+// app 拿到合法 token，再对受害者后端指定自己的 clientID——后端问身份服务
+// 「这 token 是不是该 app 的」→ 是 → 授权通过。修复形态 = 锚点改从服务端
+// 配置取（expectedClientID ?? process.env.NEXT_PUBLIC_TINA_CLIENT_ID），
+// 且取不到 fail-closed。
+//
+// 判据三元组（与 fr-002/003 的缺席判据同族）：
+//   ① 从请求取 token（req.headers.authorization / headers().get('authorization')）
+//   ② 从请求输入取身份锚点（req.query|body|params.<锚点名> 或 searchParams.get）
+//   ③ 无服务端锚点证据（process.env. / getConfig( / config.）
+// 锚点名不含 tenant——多租户从请求解析租户锚点是合法形态，只有 app/client
+// 身份才是「服务器该知道自己的身份」的一侧。
+// 消费方：protocol-detector 的 "Authorization Identity Anchor from Request"。
+// ═══════════════════════════════════════════════════════════════
+const REQUEST_ANCHORED_IDENTITY_MARKER = "__progmune_request_anchored_identity__";
+const IDENTITY_ANCHOR_NAMES = /clientID|clientId|client_id|appId|appID|app_id|applicationId|applicationID|application_id/;
+/** ① 从请求取 token（NextApiRequest 与 NextRequest 两种形态） */
+const REQ_TOKEN_SRC = /req\.headers\.authorization|\.get\(\s*["']authorization["']\s*\)/i;
+/** ② 从请求输入取身份锚点（query/body/params 成员或 searchParams.get） */
+const REQ_ANCHOR_SRC = new RegExp(`(?:req\\.(?:query|body|params)\\.(?:${IDENTITY_ANCHOR_NAMES.source})\\b|searchParams\\.get\\(\\s*["'](?:${IDENTITY_ANCHOR_NAMES.source})["']\\s*\\))`);
+/** ③ 服务端锚点证据：出现即视为锚点有服务端绑定（配置/环境/配置对象），不标记 */
+const SERVER_ANCHOR_EVIDENCE = /process\.env\.|\bgetConfig\s*\(|\bconfig\./i;
+function hasRequestAnchoredIdentity(text) {
+    if (!REQ_TOKEN_SRC.test(text))
+        return false;
+    if (!REQ_ANCHOR_SRC.test(text))
+        return false;
+    if (SERVER_ANCHOR_EVIDENCE.test(text))
+        return false;
+    return true;
+}
 /**
  * 标记增强的内联实现（2026-09-15 性能重构）：消费主循环已获取的
  * 函数文本与形参名，输出该函数应附加的合成标记。
@@ -2974,6 +3009,12 @@ function computeMarkerCalls(text, paramNames, sinkParams, onMethodHit, guardFns,
             }
         }
     }
+    // ── 请求锚定身份（2026-10-06，fr-017）──
+    // 纯函数体文本判据，无需函数名——isUserAuthorized（被调用方）体内没有
+    // req.headers.authorization 形态，不会误标；只有面向请求的校验入口会命中。
+    if (hasRequestAnchoredIdentity(text)) {
+        markers.push(REQUEST_ANCHORED_IDENTITY_MARKER);
+    }
     return markers;
 }
 /**

package/dist/protocol-detector.js

@@ -878,6 +878,23 @@ const SAFEGUARD_RULES = [
         conceptMissing: ["RolePolicyOnTokenExchange", "DomainAllowlistOnTokenExchange"],
         conceptExpected: ["get_user_role before session creation", "OAUTH_ALLOWED_DOMAINS check"],
     },
+    {
+        name: "Authorization Identity Anchor from Request",
+        category: "auth",
+        // 2026-10-06（REALWORLD_FIX_REGRESSION fr-017）：身份校验的锚点
+        // （token 属于哪个 app/client）从请求输入读取——tinacms 的 isAuthorized
+        // 从 req.query.clientID 取锚点去问身份服务「这 token 是不是该 app 的」，
+        // 攻击者注册自己的 app 拿合法 token 即通过任意站点的后端授权
+        // （GHSA-g74q-6g2f-874x）。修复 = 锚点改从服务端配置/环境取 +
+        // 取不到 fail-closed。判据在提取器侧 hasRequestAnchoredIdentity
+        // （三元组：请求取 token + 请求取 app/client 锚点 + 无服务端锚点证据）。
+        languages: ["typescript", "javascript"],
+        trigger: /\b(__progmune_request_anchored_identity__)\b/,
+        safeguards: [],
+        violationMessage: "Authorization validates a token against an app/client identity read from the request (query/body/searchParams) rather than server configuration — an attacker registers their own app identity, supplies a token that IS valid for it, and passes authorization on any endpoint using this function. Anchor the identity in server config/env and fail closed when it cannot be resolved.",
+        conceptMissing: ["ServerConfiguredIdentityAnchor"],
+        conceptExpected: ["expectedClientID from config/env", "fail-closed when anchor unresolved"],
+    },
     {
         name: "XSS (Unsafe Template Rendering)",
         category: "xss",

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.60";
+exports.RUNTIME_VERSION = "3.7.61";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.60",
+  "version": "3.7.61",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",