security-mcp 1.1.3 → 1.3.1

package/dist/gate/checks/ci-pipeline.js

@@ -5,8 +5,392 @@
 import { sanitizeErrorMessage } from "../result.js";
 import fg from "fast-glob";
 import { readFileSafe } from "../../repo/fs.js";
-export async function runCiPipelineChecks(_opts) {
+// Pattern that identifies an active (non-commented) security gate invocation line.
+const GATE_INVOCATION_RE = /npm run ci:pr-gate|npx security-mcp|security-mcp.*gate|security_gate|run_pr_gate/;
+async function checkGateStepPresent(changedFiles) {
+    const findings = [];
+    try {
+        const workflowFiles = await fg([".github/workflows/*.yml", ".github/workflows/*.yaml"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/.git/**"]
+        });
+        if (workflowFiles.length === 0) {
+            return findings;
+        }
+        let gateInvokedFile = null;
+        let gateDisabledFile = null;
+        for (const file of workflowFiles) {
+            let content;
+            try {
+                content = await readFileSafe(file);
+            }
+            catch {
+                continue;
+            }
+            const lines = content.split("\n");
+            // Check whether the file contains the gate invocation at all (commented or not)
+            const hasGatePattern = lines.some((line) => GATE_INVOCATION_RE.test(line));
+            if (!hasGatePattern)
+                continue;
+            // Distinguish active invocation from commented-out invocation
+            const activeLines = lines.filter((line) => GATE_INVOCATION_RE.test(line) && !/^\s*#/.test(line));
+            if (activeLines.length > 0) {
+                gateInvokedFile = file;
+            }
+            else {
+                // Pattern present but every matching line is commented out
+                gateDisabledFile = file;
+            }
+        }
+        if (!gateInvokedFile && !gateDisabledFile) {
+            findings.push({
+                id: "GATE_STEP_ABSENT",
+                title: "No GitHub Actions workflow found that invokes the security gate",
+                severity: "HIGH",
+                files: [],
+                requiredActions: [
+                    "No GitHub Actions workflow found that invokes the security gate (npm run ci:pr-gate). The gate may not be enforced on PRs.",
+                    "Add a step `run: npm run ci:pr-gate` to your PR workflow (e.g. .github/workflows/security-gate.yml).",
+                    "Without this step, HIGH/CRITICAL security findings will not block pull request merges."
+                ]
+            });
+        }
+        if (gateDisabledFile) {
+            findings.push({
+                id: "GATE_STEP_DISABLED",
+                title: "The security gate step is present in the workflow but appears to be commented out or disabled",
+                severity: "CRITICAL",
+                files: [gateDisabledFile],
+                requiredActions: [
+                    "The security gate step is present in the workflow but appears to be commented out or disabled.",
+                    "Uncomment or re-enable the `npm run ci:pr-gate` step so it blocks PRs with HIGH/CRITICAL findings.",
+                    "A disabled gate provides no protection — attackers can merge vulnerable code without review."
+                ]
+            });
+        }
+        // Check for self-modification: security-gate.yml is being modified AND the gate step would be removed
+        const gateWorkflowChanged = changedFiles.some((f) => f.includes("security-gate.yml"));
+        if (gateWorkflowChanged && gateDisabledFile && gateDisabledFile.includes("security-gate.yml")) {
+            findings.push({
+                id: "GATE_WORKFLOW_SELF_MODIFICATION",
+                title: "security-gate.yml is being modified and the gate step is disabled",
+                severity: "CRITICAL",
+                files: ["security-gate.yml"],
+                requiredActions: [
+                    "security-gate.yml is being modified in this PR and the gate invocation step appears to be commented out or removed.",
+                    "This self-modification could bypass the security gate for all future PRs.",
+                    "Restore the `npm run ci:pr-gate` step before merging this change."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkGateStepPresent] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}
+async function checkWorkflowInjection() {
+    const findings = [];
+    try {
+        const workflowFiles = await fg(["**/.github/workflows/*.yml", "**/.github/workflows/*.yaml"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/.git/**"]
+        });
+        // Covers all attacker-controlled GitHub context tokens that can contain shell metacharacters:
+        // - github.event.{issue,pull_request,comment,review,discussion,inputs,release}.*
+        // - github.head_ref (attacker-controlled branch name on fork PRs)
+        // - github.ref_name (mutable, attacker-influenced on PRs)
+        // - github.actor (attacker-controlled username)
+        // - github.event.workflow_run.head_branch / head_commit.*
+        const injectionRe = /\$\{\{\s*(?:github\.event\.(?:issue|pull_request|comment|review|discussion|inputs|release|workflow_run)\.[a-z_.]+|github\.(?:head_ref|ref_name|actor))\s*\}\}/;
+        const flaggedFiles = [];
+        for (const file of workflowFiles) {
+            let content;
+            try {
+                content = await readFileSafe(file);
+            }
+            catch {
+                continue;
+            }
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                if (!injectionRe.test(lines[i]))
+                    continue;
+                // Check if "run:" appears within the 5 lines before this match
+                const windowStart = Math.max(0, i - 5);
+                const contextLines = lines.slice(windowStart, i);
+                if (contextLines.some((l) => /run:/.test(l))) {
+                    flaggedFiles.push(file);
+                    break;
+                }
+            }
+        }
+        if (flaggedFiles.length > 0) {
+            findings.push({
+                id: "CI_WORKFLOW_INJECTION",
+                title: "GitHub Actions workflow uses github.event.* user input in run: step — workflow injection RCE",
+                severity: "CRITICAL",
+                files: flaggedFiles.slice(0, 10),
+                requiredActions: [
+                    "GitHub Actions workflow uses github.event.* user input in run: step — workflow injection RCE (ATT&CK T1059, GHSL-2021-1167)",
+                    "Never interpolate ${{ github.event.* }} directly into shell run: steps — pass values via environment variables instead (`env: VAL: ${{ github.event.issue.title }}`) and reference $VAL in the shell.",
+                    "An attacker can craft a title/body/branch containing shell metacharacters to achieve arbitrary code execution with the runner's permissions."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkWorkflowInjection] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}
+async function checkCiCachePoisoning() {
     const findings = [];
+    try {
+        const workflowFiles = await fg(["**/.github/workflows/*.yml", "**/.github/workflows/*.yaml"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/.git/**"]
+        });
+        const cacheActionRe = /uses:\s+actions\/cache/;
+        const poisonKeyRe = /key:.*\$\{\{.*github\.(?:head_ref|event\.pull_request\.head)/;
+        const flaggedFiles = [];
+        for (const file of workflowFiles) {
+            let content;
+            try {
+                content = await readFileSafe(file);
+            }
+            catch {
+                continue;
+            }
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                if (!cacheActionRe.test(lines[i]))
+                    continue;
+                const windowEnd = Math.min(lines.length, i + 20);
+                const contextLines = lines.slice(i, windowEnd);
+                if (contextLines.some((l) => poisonKeyRe.test(l))) {
+                    flaggedFiles.push(file);
+                    break;
+                }
+            }
+        }
+        if (flaggedFiles.length > 0) {
+            findings.push({
+                id: "CI_CACHE_POISONING",
+                title: "CI cache key includes attacker-controlled branch name — cache poisoning risk",
+                severity: "HIGH",
+                files: flaggedFiles.slice(0, 10),
+                requiredActions: [
+                    "CI cache key includes attacker-controlled branch name — cache poisoning injects malicious build artifacts (ATT&CK T1195.002)",
+                    "Do not use `github.head_ref` or `github.event.pull_request.head.*` in cache keys — an attacker can craft a branch name to collide with another PR's cache.",
+                    "Use only trusted, non-user-controlled values in cache keys (e.g. `github.ref`, `hashFiles(...)`)."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkCiCachePoisoning] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}
+async function checkDownloadArtifactNoVerify() {
+    const findings = [];
+    try {
+        const workflowFiles = await fg(["**/.github/workflows/*.yml", "**/.github/workflows/*.yaml"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/.git/**"]
+        });
+        const downloadRe = /uses:\s+(?:actions\/download-artifact|dawidd6\/action-download-artifact)/;
+        const verifyRe = /sha256|signature|cosign|sigstore|verify/i;
+        const flaggedFiles = [];
+        for (const file of workflowFiles) {
+            let content;
+            try {
+                content = await readFileSafe(file);
+            }
+            catch {
+                continue;
+            }
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                if (!downloadRe.test(lines[i]))
+                    continue;
+                const windowEnd = Math.min(lines.length, i + 10);
+                const contextLines = lines.slice(i, windowEnd);
+                if (!contextLines.some((l) => verifyRe.test(l))) {
+                    flaggedFiles.push(file);
+                    break;
+                }
+            }
+        }
+        if (flaggedFiles.length > 0) {
+            findings.push({
+                id: "CI_ARTIFACT_NO_VERIFY",
+                title: "CI downloads build artifact without integrity verification",
+                severity: "HIGH",
+                files: flaggedFiles.slice(0, 10),
+                requiredActions: [
+                    "CI downloads build artifact without integrity verification — artifact poisoning risk (ATT&CK T1195.002)",
+                    "After downloading an artifact, verify its SHA-256 checksum or use Sigstore/cosign attestations before executing it.",
+                    "An unverified artifact from a compromised or malicious workflow run can silently introduce backdoors into the build."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkDownloadArtifactNoVerify] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}
+async function checkGithubTokenWriteAll() {
+    const findings = [];
+    try {
+        const workflowFiles = await fg(["**/.github/workflows/*.yml", "**/.github/workflows/*.yaml"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/.git/**"]
+        });
+        const writePermRe = /permissions:\s*write-all|packages:\s*write|contents:\s*write|pull-requests:\s*write/;
+        const prTriggerRe = /pull_request(?:_target)?:/;
+        const flaggedFiles = [];
+        for (const file of workflowFiles) {
+            let content;
+            try {
+                content = await readFileSafe(file);
+            }
+            catch {
+                continue;
+            }
+            if (writePermRe.test(content) && prTriggerRe.test(content)) {
+                flaggedFiles.push(file);
+            }
+        }
+        if (flaggedFiles.length > 0) {
+            findings.push({
+                id: "CI_GITHUB_TOKEN_WRITE_ALL",
+                title: "GITHUB_TOKEN granted write permissions in workflow triggered by external PRs",
+                severity: "HIGH",
+                files: flaggedFiles.slice(0, 10),
+                requiredActions: [
+                    "GITHUB_TOKEN granted write permissions in workflow triggered by external PRs — token theft enables repo write (ATT&CK T1552.001)",
+                    "Restrict permissions to the minimum required scopes; avoid `write-all` on workflows that process untrusted pull requests.",
+                    "Use `permissions: read-all` as the default and elevate only the specific scopes needed (e.g. `issues: write`)."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkGithubTokenWriteAll] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}
+async function checkForkSecretExposure() {
+    const findings = [];
+    try {
+        const workflowFiles = await fg(["**/.github/workflows/*.yml", "**/.github/workflows/*.yaml"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/.git/**"]
+        });
+        const secretsRe = /secrets\./;
+        const flaggedFiles = [];
+        for (const file of workflowFiles) {
+            let content;
+            try {
+                content = await readFileSafe(file);
+            }
+            catch {
+                continue;
+            }
+            // Match "pull_request:" but NOT "pull_request_target:"
+            if (/^\s*pull_request:/m.test(content) && secretsRe.test(content)) {
+                flaggedFiles.push(file);
+            }
+        }
+        if (flaggedFiles.length > 0) {
+            findings.push({
+                id: "CI_FORK_SECRET_EXPOSURE",
+                title: "Secrets referenced in pull_request-triggered workflow — exposed to fork PR contributors",
+                severity: "CRITICAL",
+                files: flaggedFiles.slice(0, 10),
+                requiredActions: [
+                    "Secrets referenced in pull_request-triggered workflow — exposed to fork PR contributors (ATT&CK T1552.001)",
+                    "Workflows triggered by `pull_request` from forks do not have access to secrets by default, but referencing them signals intent and may expose them in other contexts.",
+                    "Move secret-dependent steps to a separate workflow triggered by `pull_request_target` with explicit trust checks, or use environment protection rules to gate secret access."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkForkSecretExposure] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}
+async function checkNpmIgnoreScriptsCi() {
+    const findings = [];
+    try {
+        const workflowFiles = await fg(["**/.github/workflows/*.yml", "**/.github/workflows/*.yaml"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/.git/**"]
+        });
+        // Check whether .npmrc already sets ignore-scripts=true
+        let npmrcDisablesScripts = false;
+        const npmrcFiles = await fg([".npmrc", "**/.npmrc"], {
+            dot: true,
+            ignore: ["**/node_modules/**", "**/.git/**"]
+        });
+        for (const rc of npmrcFiles) {
+            let rcContent;
+            try {
+                rcContent = await readFileSafe(rc);
+            }
+            catch {
+                continue;
+            }
+            if (/^\s*ignore-scripts\s*=\s*true/m.test(rcContent)) {
+                npmrcDisablesScripts = true;
+                break;
+            }
+        }
+        if (npmrcDisablesScripts) {
+            return findings;
+        }
+        // npm install/ci without --ignore-scripts (and not already covered by .npmrc)
+        const npmBareRe = /npm\s+(?:install|ci)(?!.*--ignore-scripts)/;
+        const flaggedFiles = [];
+        for (const file of workflowFiles) {
+            let content;
+            try {
+                content = await readFileSafe(file);
+            }
+            catch {
+                continue;
+            }
+            if (npmBareRe.test(content)) {
+                flaggedFiles.push(file);
+            }
+        }
+        if (flaggedFiles.length > 0) {
+            findings.push({
+                id: "CI_NPM_MISSING_IGNORE_SCRIPTS",
+                title: "npm install/ci in CI without --ignore-scripts",
+                severity: "MEDIUM",
+                files: flaggedFiles.slice(0, 10),
+                requiredActions: [
+                    "npm install/ci in CI without --ignore-scripts — postinstall scripts execute automatically (ATT&CK T1195.001)",
+                    "Add `--ignore-scripts` to all `npm install` / `npm ci` invocations in CI, or set `ignore-scripts=true` in .npmrc.",
+                    "Malicious or compromised dependencies can use postinstall/preinstall lifecycle scripts to exfiltrate secrets or modify build artifacts."
+                ]
+            });
+        }
+    }
+    catch (err) {
+        console.warn("[checkNpmIgnoreScriptsCi] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
+    }
+    return findings;
+}
+export async function runCiPipelineChecks(_opts) {
+    const findings = [
+        ...await checkGateStepPresent(_opts.changedFiles)
+    ];
     try {
         const workflowFiles = await fg([".github/workflows/*.yml", ".github/workflows/*.yaml"], {
             dot: true,
@@ -29,15 +413,17 @@ export async function runCiPipelineChecks(_opts) {
                 continue;
             }
             // Check 1: Third-party actions not pinned to a full 40-char SHA
-            // Matches `uses: owner/repo@tag` but NOT `uses: owner/repo@<40hex chars>`
+            // Matches `uses: owner/repo@tag` but NOT `uses: owner/repo@<exactly 40 hex chars>`
             // Also skip `uses: ./.github/actions/` (local actions are fine)
             const actionLines = content.split("\n").filter((line) => /uses:\s+[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+@/.test(line));
             const unpinnedActions = actionLines.filter((line) => {
                 // Skip local actions
                 if (/uses:\s+\.\//.test(line))
                     return false;
-                // Flag anything not pinned to a 40-char hex SHA
-                return !/uses:\s+[a-zA-Z0-9_.\-/]+@[0-9a-f]{40}/.test(line);
+                // Flag anything not pinned to EXACTLY a 40-char hex SHA.
+                // The negative lookahead (?![0-9a-f]) prevents 41+ char hex strings from
+                // being mistakenly treated as valid SHA-1 digests.
+                return !/uses:\s+[a-zA-Z0-9_.\-/]+@[0-9a-f]{40}(?![0-9a-f])/.test(line);
             });
             if (unpinnedActions.length > 0) {
                 unpinnedFiles.push(file);
@@ -131,5 +517,14 @@ export async function runCiPipelineChecks(_opts) {
     catch (err) {
         console.warn("[runCiPipelineChecks] Internal error:", sanitizeErrorMessage(err instanceof Error ? err.message : String(err)));
     }
+    const additional = await Promise.all([
+        checkWorkflowInjection(),
+        checkCiCachePoisoning(),
+        checkDownloadArtifactNoVerify(),
+        checkGithubTokenWriteAll(),
+        checkForkSecretExposure(),
+        checkNpmIgnoreScriptsCi()
+    ]);
+    findings.push(...additional.flat());
     return findings;
 }