security-mcp 1.1.3 → 1.3.1

package/dist/gate/baseline.js

@@ -5,7 +5,39 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { join } from "node:path";
+// ---------------------------------------------------------------------------
+// HMAC integrity helpers — TM-013 fix
+// ---------------------------------------------------------------------------
+// HMAC-SHA256 requires at least 32 bytes (256 bits) per NIST SP 800-107 §5.3.4.
+const HMAC_MIN_KEY_BYTES = 32;
+/**
+ * Returns the HMAC key from env, or null if not configured.
+ * Throws if the key is present but too short.
+ */
+function getHmacKey() {
+    const key = process.env["SECURITY_POLICY_HMAC_KEY"];
+    if (!key)
+        return null;
+    if (Buffer.byteLength(key, "utf-8") < HMAC_MIN_KEY_BYTES) {
+        throw new Error(`SECURITY_POLICY_HMAC_KEY is too short (${Buffer.byteLength(key, "utf-8")} bytes). ` +
+            `Provide at least ${HMAC_MIN_KEY_BYTES} bytes — generate one with: ` +
+            `node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`);
+    }
+    return key;
+}
+function signBaseline(json, key) {
+    return createHmac("sha256", key).update(json, "utf-8").digest("hex");
+}
+function verifyBaselineHmac(json, stored, key) {
+    const expected = createHmac("sha256", key).update(json, "utf-8").digest("hex");
+    const storedBuf = Buffer.from(stored, "hex");
+    const expectedBuf = Buffer.from(expected, "hex");
+    if (storedBuf.length !== expectedBuf.length)
+        return false;
+    return timingSafeEqual(storedBuf, expectedBuf);
+}
 const execFileAsync = promisify(execFile);
 const BASELINE_DIR = join(process.cwd(), ".mcp", "baselines");
 async function ensureDir(dir) {
@@ -32,37 +64,53 @@ export async function getCommitHash() {
 /**
  * Saves a gate result as baseline for the given commit hash.
  * Also updates the latest baseline copy.
+ *
+ * TM-013 fix: When SECURITY_POLICY_HMAC_KEY is set, the serialised payload is
+ * HMAC-SHA256 signed and the signature is stored in the envelope. Unsigned
+ * writes are still permitted when no key is configured (graceful degradation),
+ * but loadBaseline will reject a previously-signed file whose signature no
+ * longer matches (tamper detection).
  */
 export async function saveBaseline(runId, result, commitHash) {
     await ensureDir(BASELINE_DIR);
     const payload = { runId, commitHash, savedAt: new Date().toISOString(), result };
     const json = JSON.stringify(payload, null, 2);
+    // Sign if a key is available
+    const hmacKey = getHmacKey();
+    const envelope = hmacKey
+        ? JSON.stringify({ payload, hmacSha256: signBaseline(json, hmacKey) }, null, 2)
+        : json;
     // Write to temp file then rename (atomic)
     const safehash = commitHash.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 64);
     const targetPath = join(BASELINE_DIR, `${safehash}.json`);
     const latestPath = join(BASELINE_DIR, "latest.json");
-    const tmpPath = `${targetPath}.tmp`;
+    const tmpPath = `${targetPath}.${randomBytes(8).toString("hex")}.tmp`;
     try {
-        await writeFile(tmpPath, json, "utf-8");
+        await writeFile(tmpPath, envelope, "utf-8");
         await rename(tmpPath, targetPath);
     }
     catch {
         // fallback: write directly
-        await writeFile(targetPath, json, "utf-8").catch(() => { });
+        await writeFile(targetPath, envelope, "utf-8").catch(() => { });
     }
     // Update latest (best-effort atomic)
-    const latestTmp = `${latestPath}.tmp`;
+    const latestTmp = `${latestPath}.${randomBytes(8).toString("hex")}.tmp`;
     try {
-        await writeFile(latestTmp, json, "utf-8");
+        await writeFile(latestTmp, envelope, "utf-8");
         await rename(latestTmp, latestPath);
     }
     catch {
-        await writeFile(latestPath, json, "utf-8").catch(() => { });
+        await writeFile(latestPath, envelope, "utf-8").catch(() => { });
     }
 }
 /**
  * Loads a baseline by commit hash, or the latest baseline if no hash given.
  * Returns null if no baseline exists or it's corrupted.
+ *
+ * TM-013 fix: If the file is stored in the HMAC envelope format AND
+ * SECURITY_POLICY_HMAC_KEY is configured, the HMAC is verified before the
+ * payload is returned. A tampered baseline (missing or wrong HMAC) is
+ * rejected — the gate will run without a baseline rather than trust forged data.
  */
 export async function loadBaseline(commitHash) {
     await ensureDir(BASELINE_DIR);
@@ -76,7 +124,34 @@ export async function loadBaseline(commitHash) {
     }
     try {
         const raw = await readFile(filePath, "utf-8");
-        const parsed = JSON.parse(raw);
+        const top = JSON.parse(raw);
+        // Detect envelope format (has both "payload" and "hmacSha256")
+        if ("payload" in top && "hmacSha256" in top) {
+            const envelope = top;
+            const hmacKey = getHmacKey();
+            if (hmacKey) {
+                // Re-serialise the inner payload the same way saveBaseline did
+                const expectedInput = JSON.stringify(envelope.payload, null, 2);
+                if (!verifyBaselineHmac(expectedInput, envelope.hmacSha256, hmacKey)) {
+                    console.error("[baseline] HMAC verification failed — baseline may have been tampered. Ignoring.");
+                    return null;
+                }
+            }
+            else {
+                // Key not configured: we can't verify, but we can warn
+                console.warn("[baseline] Baseline is signed but SECURITY_POLICY_HMAC_KEY is not set — skipping HMAC verification.");
+            }
+            return envelope.payload.result ?? null;
+        }
+        // Legacy format (unsigned) — parse directly
+        const parsed = top;
+        const hmacKey = getHmacKey();
+        if (hmacKey) {
+            // A key is configured but the file is unsigned — reject it to prevent
+            // an attacker from stripping the HMAC wrapper to bypass verification.
+            console.error("[baseline] SECURITY_POLICY_HMAC_KEY is set but baseline is unsigned — ignoring to prevent tampering bypass.");
+            return null;
+        }
         return parsed.result ?? null;
     }
     catch {

package/dist/gate/catalog.js

@@ -23,8 +23,16 @@ async function readJsonWithFallback(relPath, fallbackName) {
         ".mcp/catalog/control-catalog.json": "SECURITY_GATE_CONTROL_CATALOG"
     };
     const overrideEnv = overrideEnvMap[relPath];
-    if (overrideEnv && process.env[overrideEnv]) {
-        return await readFile(join(process.cwd(), process.env[overrideEnv]), "utf-8");
+    const overridePath = overrideEnv ? process.env[overrideEnv] : undefined;
+    if (overridePath) {
+        // Guard against path traversal (VULN-003 / CWE-22): resolve() + startsWith() is required;
+        // join() alone normalises '..' but does not prevent escape from the project directory.
+        const cwd = process.cwd();
+        const resolved = resolve(cwd, overridePath);
+        if (resolved !== cwd && !resolved.startsWith(cwd + "/")) {
+            throw new Error(`${overrideEnv} path escapes the project directory`);
+        }
+        return await readFile(resolved, "utf-8");
     }
     try {
         return await readFile(join(process.cwd(), relPath), "utf-8");