security-mcp 1.1.4 → 1.3.1

package/dist/gate/diff.js

@@ -1,4 +1,5 @@
 import { execa } from "execa";
+import { access } from "node:fs/promises";
 // Allowlist for git ref strings. Blocks option injection (e.g. --upload-pack=…)
 // and git pathspec magic characters. CWE-88 / MITRE ATT&CK T1059.
 // Note: ~ and ^ are intentionally included — they are safe because { and } are NOT
@@ -12,12 +13,23 @@ function validateRef(name, value) {
 export async function getChangedFiles(opts) {
     validateRef("baseRef", opts.baseRef);
     validateRef("headRef", opts.headRef);
-    // Uses git diff in CI. Assumes checkout has full history for baseRef.
-    const { stdout } = await execa("git", ["diff", "--name-only", `${opts.baseRef}...${opts.headRef}`], {
-        stdio: ["ignore", "pipe", "pipe"]
-    });
-    return stdout
+    // Fix 9: --diff-filter=ACMRT excludes deleted-only files; -M detects renames
+    // so renamed files appear as renames rather than delete+add pairs.
+    const { stdout } = await execa("git", ["diff", "--diff-filter=ACMRT", "-M", "--name-only", `${opts.baseRef}...${opts.headRef}`], { stdio: ["ignore", "pipe", "pipe"] });
+    const candidates = stdout
         .split("\n")
         .map((s) => s.trim())
         .filter(Boolean);
+    // Fix 9: skip any file that no longer exists on disk (deleted/moved away edge cases)
+    const results = [];
+    for (const file of candidates) {
+        try {
+            await access(file);
+            results.push(file);
+        }
+        catch {
+            // file does not exist on disk — skip gracefully
+        }
+    }
+    return results;
 }

package/dist/gate/evidence.js

@@ -8,7 +8,14 @@ const PKG_ROOT = resolve(__dirname, "../..");
 async function loadEvidenceMap() {
     const overridePath = process.env["SECURITY_GATE_EVIDENCE_MAP"];
     if (overridePath) {
-        const raw = await readFile(join(process.cwd(), overridePath), "utf-8");
+        // Guard against path traversal (VULN-002 / CWE-22): join() normalises '..' sequences
+        // but does NOT prevent escape; resolve() + startsWith() is the correct check.
+        const cwd = process.cwd();
+        const resolved = resolve(cwd, overridePath);
+        if (resolved !== cwd && !resolved.startsWith(cwd + "/")) {
+            throw new Error("SECURITY_GATE_EVIDENCE_MAP path escapes the project directory");
+        }
+        const raw = await readFile(resolved, "utf-8");
         return JSON.parse(raw);
     }
     try {

package/dist/gate/exceptions.js

@@ -1,3 +1,4 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -13,13 +14,51 @@ const ExceptionSchema = z.object({
     owner: z.string(),
     approver: z.string(),
     approval_role: z.string(),
+    // Fix 1: enforce YYYY-MM-DD format and max 365-day TTL
     expires_on: z.string()
+        .regex(/^\d{4}-\d{2}-\d{2}$/, "expires_on must be YYYY-MM-DD")
+        .refine((val) => {
+        const expiry = new Date(val);
+        const maxExpiry = new Date();
+        maxExpiry.setDate(maxExpiry.getDate() + 365);
+        return expiry <= maxExpiry;
+    }, { message: "expires_on cannot be more than 365 days in the future" })
+})
+    // Fix 2: prevent self-approval (owner === approver)
+    .superRefine((data, ctx) => {
+    if (data.owner.toLowerCase() === data.approver.toLowerCase()) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `Exception self-approval is not permitted: owner and approver must be different (got '${data.owner}')`,
+            path: ["approver"]
+        });
+    }
 });
 const ExceptionFileSchema = z.object({
     version: z.string(),
-    exceptions: z.array(ExceptionSchema).default([])
+    exceptions: z.array(ExceptionSchema).default([]),
+    hmacSha256: z.string().optional()
 });
+// Fix 3: HMAC helper — sign the exceptions array for tamper detection
+export function signExceptionsFile(exceptions, key) {
+    const canonical = JSON.stringify(exceptions, (_, v) => (v && typeof v === "object" && !Array.isArray(v)
+        ? Object.fromEntries(Object.entries(v).sort())
+        : v));
+    return createHmac("sha256", key).update(canonical, "utf-8").digest("hex");
+}
+const EXCEPTIONS_HMAC_MIN_KEY_BYTES = 32;
+function getExceptionsHmacKey() {
+    const key = process.env["SECURITY_POLICY_HMAC_KEY"];
+    if (!key)
+        return null;
+    if (Buffer.byteLength(key, "utf-8") < EXCEPTIONS_HMAC_MIN_KEY_BYTES) {
+        throw new Error(`SECURITY_POLICY_HMAC_KEY is too short (${Buffer.byteLength(key, "utf-8")} bytes). ` +
+            `Minimum ${EXCEPTIONS_HMAC_MIN_KEY_BYTES} bytes required.`);
+    }
+    return key;
+}
 async function readExceptionsJson() {
+    const warnings = [];
     const overridePath = process.env["SECURITY_GATE_EXCEPTIONS"];
     if (overridePath) {
         // CWE-22: ensure path stays within the project directory
@@ -27,21 +66,89 @@ async function readExceptionsJson() {
         if (!resolved.startsWith(process.cwd() + "/") && resolved !== process.cwd()) {
             throw new Error(`SECURITY_GATE_EXCEPTIONS path '${overridePath}' escapes the project directory`);
         }
-        return await readFile(resolved, "utf-8");
+        const raw = await readFile(resolved, "utf-8");
+        return { raw, isCiFile: false, warnings };
+    }
+    // Project-level CI exceptions file (suppresses self-scan false positives)
+    try {
+        const raw = await readFile(join(process.cwd(), ".github", "security-exceptions-ci.json"), "utf-8");
+        // Fix 4: warn when CI exceptions are loaded outside CI context
+        const isCI = !!(process.env["CI"] || process.env["GITHUB_ACTIONS"]);
+        if (!isCI) {
+            const count = (() => {
+                try {
+                    const parsed = JSON.parse(raw);
+                    return Array.isArray(parsed.exceptions) ? parsed.exceptions.length : 0;
+                }
+                catch {
+                    return 0;
+                }
+            })();
+            warnings.push({
+                id: "CI_EXCEPTIONS_IN_LOCAL_SCAN",
+                title: "CI self-scan exceptions applied to local scan",
+                severity: "HIGH",
+                evidence: [
+                    "CI exceptions file: .github/security-exceptions-ci.json",
+                    `Suppressed controls: ${count}`,
+                    "CI env var not set — this appears to be a local scan"
+                ],
+                requiredActions: [
+                    `CI self-scan exceptions (.github/security-exceptions-ci.json) are being applied to a local scan. This suppresses ${count} controls. Set SECURITY_GATE_EXCEPTIONS to point to your project's exceptions file.`
+                ]
+            });
+        }
+        return { raw, isCiFile: true, warnings };
     }
+    catch { /* not present — continue */ }
     try {
-        return await readFile(join(process.cwd(), ".mcp", "exceptions", "security-exceptions.json"), "utf-8");
+        const raw = await readFile(join(process.cwd(), ".mcp", "exceptions", "security-exceptions.json"), "utf-8");
+        return { raw, isCiFile: false, warnings };
     }
     catch {
-        return await readFile(join(PKG_ROOT, "defaults", "security-exceptions.json"), "utf-8");
+        const raw = await readFile(join(PKG_ROOT, "defaults", "security-exceptions.json"), "utf-8");
+        return { raw, isCiFile: false, warnings };
     }
 }
 export async function loadSecurityExceptions() {
-    const raw = await readExceptionsJson();
-    return ExceptionFileSchema.parse(JSON.parse(raw)).exceptions;
+    const { raw, warnings } = await readExceptionsJson();
+    const parsed = ExceptionFileSchema.parse(JSON.parse(raw));
+    // Fix 3: HMAC verification of exceptions file
+    const hmacKey = getExceptionsHmacKey();
+    const extraWarnings = [];
+    if (hmacKey) {
+        if (!parsed.hmacSha256) {
+            extraWarnings.push({
+                id: "EXCEPTIONS_FILE_UNSIGNED",
+                title: "Security exceptions file is not integrity-protected",
+                severity: "MEDIUM",
+                evidence: [
+                    "SECURITY_POLICY_HMAC_KEY is set but exceptions file has no hmacSha256 field"
+                ],
+                requiredActions: [
+                    "Security exceptions file is not integrity-protected. Set SECURITY_POLICY_HMAC_KEY and re-save exceptions to enable tamper detection."
+                ]
+            });
+        }
+        else {
+            const expected = signExceptionsFile(parsed.exceptions, hmacKey);
+            const storedBuf = Buffer.from(parsed.hmacSha256, "hex");
+            const expectedBuf = Buffer.from(expected, "hex");
+            const valid = storedBuf.length === expectedBuf.length &&
+                timingSafeEqual(storedBuf, expectedBuf);
+            if (!valid) {
+                throw new Error("[loadSecurityExceptions] HMAC verification failed for exceptions file — file may have been tampered. " +
+                    "Re-sign exceptions with the signExceptionsFile helper and store the result in hmacSha256.");
+            }
+        }
+    }
+    return {
+        exceptions: parsed.exceptions,
+        warnings: [...warnings, ...extraWarnings]
+    };
 }
-export async function applySecurityExceptions(findings) {
-    const exceptions = await loadSecurityExceptions();
+export async function applySecurityExceptions(findings, opts) {
+    const { exceptions, warnings } = await loadSecurityExceptions();
     const active = [];
     const suppressed = [];
     const exceptionFindings = [];
@@ -75,6 +182,20 @@ export async function applySecurityExceptions(findings) {
             });
             continue;
         }
+        // Fix 7: enforce require_ticket when set in policy
+        if (opts?.requireTicket && !match.ticket) {
+            active.push(finding);
+            exceptionFindings.push({
+                id: "EXCEPTION_MISSING_TICKET",
+                title: `Exception ${match.id} is missing a required ticket reference`,
+                severity: "MEDIUM",
+                evidence: [`Finding: ${finding.id}`, `Exception: ${match.id}`, `Owner: ${match.owner}`],
+                requiredActions: [
+                    `Exception ${match.id} for finding ${finding.id} is missing a required ticket reference. Set require_ticket: false in policy or add a ticket field.`
+                ]
+            });
+            continue;
+        }
         suppressed.push({
             finding,
             exceptionId: match.id,
@@ -85,6 +206,7 @@ export async function applySecurityExceptions(findings) {
         findings: active,
         suppressed,
         exceptionFindings,
-        activeControlExceptionIds: Array.from(activeControlExceptionIds)
+        activeControlExceptionIds: Array.from(activeControlExceptionIds),
+        warnings
     };
 }