security-mcp 1.1.4 → 1.3.1

package/defaults/checklists/mobile.json

@@ -20,6 +20,28 @@
     { "id": "mobile_threat_model", "description": "Threat model completed and reviewed for this mobile surface change", "critical": true },
     { "id": "mobile_data_residency", "description": "Data residency requirements met — no user data stored on device beyond session", "critical": false },
     { "id": "mobile_backup_prevention", "description": "allowBackup=false in Android manifest — sensitive data not included in backups", "critical": true },
-    { "id": "mobile_logging", "description": "No sensitive data logged in production builds — crash reporting sanitized", "critical": true }
+    { "id": "mobile_logging", "description": "No sensitive data logged in production builds — crash reporting sanitized", "critical": true },
+    { "id": "mobile_tapjacking_prevention", "description": "Android tapjacking prevention: FLAG_SECURE set on sensitive screens; filterTouchesWhenObscured=true on clickable elements handling auth or payments", "critical": true },
+    { "id": "mobile_memory_zeroing", "description": "Sensitive data (passwords, keys, PAN) explicitly zeroed from memory after use — not relying on GC; no sensitive data in String objects (use char[] or SecureString)", "critical": false },
+    { "id": "mobile_anti_debugging", "description": "Anti-debugging and anti-tampering controls in place for high-risk operations; ptrace detection and integrity attestation verified before sensitive operations", "critical": false },
+    { "id": "mobile_ios_temp_sensitive", "title": "iOS: Sensitive data not written to NSTemporaryDirectory or NSCachesDirectory without explicit cleanup", "severity": "high", "automated": true },
+    { "id": "mobile_ios_file_protection_none", "title": "iOS: NSFileProtectionNone not set on any file containing sensitive data", "severity": "critical", "automated": true },
+    { "id": "mobile_ios_appstorage_sensitive", "title": "iOS: @AppStorage not used for sensitive credentials or tokens", "severity": "high", "automated": true },
+    { "id": "mobile_ios_sqlite_unencrypted", "title": "iOS: SQLite databases encrypted with SQLCipher when storing sensitive data", "severity": "high", "automated": true },
+    { "id": "mobile_ios_webview_http", "title": "iOS: WKWebView does not load http:// URLs when JavaScript is enabled", "severity": "critical", "automated": true },
+    { "id": "mobile_ios_universal_links", "title": "iOS: Universal Links configured with HTTPS AASA and restrictive path patterns", "severity": "high", "automated": true },
+    { "id": "mobile_android_root_detection", "title": "Android: Root detection implemented for high-risk operations", "severity": "medium", "automated": true },
+    { "id": "mobile_android_frida_magisk_detection", "title": "Android: Frida/Magisk/Xposed detection in place for high-risk app flows", "severity": "medium", "automated": true },
+    { "id": "mobile_android_webview_ssl_error", "title": "Android: WebViewClient.onReceivedSslError does not call proceed() unconditionally", "severity": "critical", "automated": true },
+    { "id": "mobile_android_firebase_rules", "title": "Android: Firebase Realtime Database and Firestore rules deny unauthenticated access", "severity": "critical", "automated": true },
+    { "id": "mobile_android_maps_api_key", "title": "Android: Google Maps API key not hardcoded in manifest or resource files", "severity": "high", "automated": true },
+    { "id": "mobile_android_deeplink_traversal", "title": "Android: Deep link path parameters validated and sanitized before use in file or URL operations", "severity": "high", "automated": true },
+    { "id": "mobile_android_sharedprefs_world", "title": "Android: SharedPreferences not opened with MODE_WORLD_READABLE or MODE_WORLD_WRITEABLE", "severity": "critical", "automated": true },
+    { "id": "mobile_android_content_provider_permission", "title": "Android: ContentProvider with exported=true has explicit readPermission and writePermission", "severity": "high", "automated": true },
+    { "id": "mobile_rn_async_storage_sensitive", "title": "React Native: AsyncStorage not used for credentials or tokens — use react-native-keychain or Expo SecureStore", "severity": "high", "automated": true },
+    { "id": "mobile_rn_codepush_integrity", "title": "React Native: OTA bundle updates verified with code signing before execution", "severity": "high", "automated": true },
+    { "id": "mobile_flutter_sharedprefs_sensitive", "title": "Flutter: Sensitive data stored in flutter_secure_storage, not shared_preferences", "severity": "high", "automated": true },
+    { "id": "mobile_expo_async_vs_secure", "title": "Expo: Credentials and tokens stored in SecureStore, not AsyncStorage", "severity": "high", "automated": true },
+    { "id": "mobile_certificate_transparency", "title": "Certificate Transparency enforcement enabled for production domains", "severity": "medium", "automated": true }
   ]
 }

package/defaults/checklists/payments.json

@@ -20,6 +20,20 @@
     { "id": "pci_chargeback_monitoring", "description": "Chargeback monitoring and alerting configured with defined response process", "critical": false },
     { "id": "pci_data_retention", "description": "Payment data retention policy enforced — data purged per PCI DSS schedule", "critical": true },
     { "id": "pci_ir_playbook", "description": "Payment fraud and PCI breach IR playbooks exist and are current", "critical": true },
-    { "id": "pci_threat_model", "description": "Threat model completed and reviewed for this payment surface change", "critical": true }
+    { "id": "pci_threat_model", "description": "Threat model completed and reviewed for this payment surface change", "critical": true },
+    { "id": "pci_magecart_prevention", "description": "Magecart/digital-skimming prevention: SRI hashes on all checkout page scripts; CSP blocks unauthorized exfiltration destinations; DOM mutation monitoring detects injected form skimmers", "critical": true },
+    { "id": "pci_3ds_enforced", "description": "EMV 3D Secure 2.2+ enforced for card-not-present transactions above risk threshold; step-up authentication triggered by anomaly score; 3DS bypass attempts logged and alerted", "critical": true },
+    { "id": "pci_currency_validation", "title": "Payment currency fixed server-side — client-supplied currency code rejected or validated against strict allowlist", "severity": "critical", "automated": true },
+    { "id": "pci_discount_stacking", "title": "Discount/coupon stacking limited server-side — maximum one promotion per order enforced atomically", "severity": "high", "automated": true },
+    { "id": "pci_payment_confirmation_server_side", "title": "Order/fulfillment status derived exclusively from payment processor API response — never from client-supplied status field", "severity": "critical", "automated": true },
+    { "id": "pci_webhook_timestamp_tolerance", "title": "Webhook timestamp tolerance ≤ 300 seconds — stale events rejected", "severity": "high", "automated": true },
+    { "id": "pci_server_side_totals", "title": "Tax, shipping, and discount amounts computed server-side — never sourced from client request body", "severity": "high", "automated": true },
+    { "id": "pci_total_revalidation", "title": "Final charge amount re-computed server-side from canonical item prices — client-supplied total field never used as charge amount", "severity": "critical", "automated": true },
+    { "id": "pci_referral_abuse_prevention", "title": "Referral/signup bonus protected against self-referral and multi-account abuse with deduplication", "severity": "high", "automated": true },
+    { "id": "biz_email_normalization", "title": "Email addresses normalised before uniqueness check — duplicate account creation via aliasing prevented", "severity": "high", "automated": true },
+    { "id": "biz_feature_flag_server_side", "title": "Feature entitlements derived from server-side session/database record — not from client-supplied plan/tier/featureFlag parameters", "severity": "high", "automated": true },
+    { "id": "biz_api_version_controls_parity", "title": "All security controls applied uniformly across all live API versions — deprecated versions sunset or mirrored", "severity": "high", "automated": false },
+    { "id": "pci_trial_abuse_prevention", "title": "Free trial creation checked for velocity on payment method fingerprint, BIN prefix, IP, and device identifier", "severity": "high", "automated": true },
+    { "id": "pci_payment_intent_idempotency", "title": "Payment intent charge guarded by distributed lock or unique constraint — concurrent double-charge prevented", "severity": "critical", "automated": true }
   ]
 }

package/defaults/checklists/web.json

@@ -25,6 +25,16 @@
     { "id": "web_sast_pass", "description": "SAST scan passed with no CRITICAL findings", "critical": true },
     { "id": "web_secrets_scan", "description": "Secrets scan clean — no credentials or tokens in source code", "critical": true },
     { "id": "web_logging", "description": "Required security events logged — no PII, tokens, or secrets in logs", "critical": false },
-    { "id": "web_staging_verified", "description": "Security headers verified in staging environment with automated check", "critical": false }
+    { "id": "web_staging_verified", "description": "Security headers verified in staging environment with automated check", "critical": false },
+    { "id": "web_dom_clobbering", "description": "DOM clobbering prevention reviewed — named form inputs, anchors, and embeds do not shadow window/document properties used in application logic", "critical": true },
+    { "id": "web_cache_poisoning", "description": "Web cache poisoning prevented — unkeyed headers (X-Forwarded-Host, X-Original-URL, X-Rewrite-URL) are not reflected in cached responses or redirects", "critical": true },
+    { "id": "web_websocket_auth", "description": "WebSocket upgrade validates authentication independently (token in first message or query param signed); does not rely solely on session cookies which bypass CORS", "critical": true },
+    { "id": "web_postmessage_origin", "description": "postMessage listeners validate event.origin against an explicit allowlist before processing any message data — no wildcard '*' as trusted origin", "critical": true },
+    { "id": "web_dangling_markup", "description": "Dangling markup injection reviewed — no user-controlled partial HTML tags output across multi-step page generation; prevents attribute-injection data exfiltration", "critical": false },
+    { "id": "web_css_injection", "title": "User input not written into CSS style attributes, CSS-in-JS template literals, or <style> blocks", "severity": "high", "automated": true },
+    { "id": "web_dangling_markup_check", "title": "Dangling markup injection prevention — no user-controlled partial HTML tags in server-rendered output", "severity": "high", "automated": true },
+    { "id": "web_postmessage_wildcard", "title": "postMessage sender does not use wildcard '*' as targetOrigin for sensitive data", "severity": "medium", "automated": true },
+    { "id": "web_cache_poisoning_headers", "title": "Unkeyed headers (X-Forwarded-Host, X-Original-URL) not reflected in cached responses or redirects", "severity": "medium", "automated": true },
+    { "id": "web_missing_sri", "title": "All external scripts and stylesheets loaded with Subresource Integrity (SRI) integrity= attribute", "severity": "medium", "automated": true }
   ]
 }

package/defaults/security-policy.json

@@ -4,8 +4,8 @@
   "description": "Default security gate policy for security-mcp. Copy to .mcp/policies/security-policy.json and customize for your project.",
   "required_checks": {
     "secrets_scan": { "severity_block": ["HIGH", "CRITICAL"] },
-    "dependency_scan": { "severity_block": ["CRITICAL"] },
-    "sast": { "severity_block": ["CRITICAL"] },
+    "dependency_scan": { "severity_block": ["HIGH", "CRITICAL"] },
+    "sast": { "severity_block": ["HIGH", "CRITICAL"] },
     "iac_scan": { "severity_block": ["HIGH", "CRITICAL"] }
   },
   "environments": {

package/dist/gate/baseline.js

@@ -5,7 +5,39 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { join } from "node:path";
+// ---------------------------------------------------------------------------
+// HMAC integrity helpers — TM-013 fix
+// ---------------------------------------------------------------------------
+// HMAC-SHA256 requires at least 32 bytes (256 bits) per NIST SP 800-107 §5.3.4.
+const HMAC_MIN_KEY_BYTES = 32;
+/**
+ * Returns the HMAC key from env, or null if not configured.
+ * Throws if the key is present but too short.
+ */
+function getHmacKey() {
+    const key = process.env["SECURITY_POLICY_HMAC_KEY"];
+    if (!key)
+        return null;
+    if (Buffer.byteLength(key, "utf-8") < HMAC_MIN_KEY_BYTES) {
+        throw new Error(`SECURITY_POLICY_HMAC_KEY is too short (${Buffer.byteLength(key, "utf-8")} bytes). ` +
+            `Provide at least ${HMAC_MIN_KEY_BYTES} bytes — generate one with: ` +
+            `node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`);
+    }
+    return key;
+}
+function signBaseline(json, key) {
+    return createHmac("sha256", key).update(json, "utf-8").digest("hex");
+}
+function verifyBaselineHmac(json, stored, key) {
+    const expected = createHmac("sha256", key).update(json, "utf-8").digest("hex");
+    const storedBuf = Buffer.from(stored, "hex");
+    const expectedBuf = Buffer.from(expected, "hex");
+    if (storedBuf.length !== expectedBuf.length)
+        return false;
+    return timingSafeEqual(storedBuf, expectedBuf);
+}
 const execFileAsync = promisify(execFile);
 const BASELINE_DIR = join(process.cwd(), ".mcp", "baselines");
 async function ensureDir(dir) {
@@ -32,37 +64,53 @@ export async function getCommitHash() {
 /**
  * Saves a gate result as baseline for the given commit hash.
  * Also updates the latest baseline copy.
+ *
+ * TM-013 fix: When SECURITY_POLICY_HMAC_KEY is set, the serialised payload is
+ * HMAC-SHA256 signed and the signature is stored in the envelope. Unsigned
+ * writes are still permitted when no key is configured (graceful degradation),
+ * but loadBaseline will reject a previously-signed file whose signature no
+ * longer matches (tamper detection).
  */
 export async function saveBaseline(runId, result, commitHash) {
     await ensureDir(BASELINE_DIR);
     const payload = { runId, commitHash, savedAt: new Date().toISOString(), result };
     const json = JSON.stringify(payload, null, 2);
+    // Sign if a key is available
+    const hmacKey = getHmacKey();
+    const envelope = hmacKey
+        ? JSON.stringify({ payload, hmacSha256: signBaseline(json, hmacKey) }, null, 2)
+        : json;
     // Write to temp file then rename (atomic)
     const safehash = commitHash.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 64);
     const targetPath = join(BASELINE_DIR, `${safehash}.json`);
     const latestPath = join(BASELINE_DIR, "latest.json");
-    const tmpPath = `${targetPath}.tmp`;
+    const tmpPath = `${targetPath}.${randomBytes(8).toString("hex")}.tmp`;
     try {
-        await writeFile(tmpPath, json, "utf-8");
+        await writeFile(tmpPath, envelope, "utf-8");
         await rename(tmpPath, targetPath);
     }
     catch {
         // fallback: write directly
-        await writeFile(targetPath, json, "utf-8").catch(() => { });
+        await writeFile(targetPath, envelope, "utf-8").catch(() => { });
     }
     // Update latest (best-effort atomic)
-    const latestTmp = `${latestPath}.tmp`;
+    const latestTmp = `${latestPath}.${randomBytes(8).toString("hex")}.tmp`;
     try {
-        await writeFile(latestTmp, json, "utf-8");
+        await writeFile(latestTmp, envelope, "utf-8");
         await rename(latestTmp, latestPath);
     }
     catch {
-        await writeFile(latestPath, json, "utf-8").catch(() => { });
+        await writeFile(latestPath, envelope, "utf-8").catch(() => { });
     }
 }
 /**
  * Loads a baseline by commit hash, or the latest baseline if no hash given.
  * Returns null if no baseline exists or it's corrupted.
+ *
+ * TM-013 fix: If the file is stored in the HMAC envelope format AND
+ * SECURITY_POLICY_HMAC_KEY is configured, the HMAC is verified before the
+ * payload is returned. A tampered baseline (missing or wrong HMAC) is
+ * rejected — the gate will run without a baseline rather than trust forged data.
  */
 export async function loadBaseline(commitHash) {
     await ensureDir(BASELINE_DIR);
@@ -76,7 +124,34 @@ export async function loadBaseline(commitHash) {
     }
     try {
         const raw = await readFile(filePath, "utf-8");
-        const parsed = JSON.parse(raw);
+        const top = JSON.parse(raw);
+        // Detect envelope format (has both "payload" and "hmacSha256")
+        if ("payload" in top && "hmacSha256" in top) {
+            const envelope = top;
+            const hmacKey = getHmacKey();
+            if (hmacKey) {
+                // Re-serialise the inner payload the same way saveBaseline did
+                const expectedInput = JSON.stringify(envelope.payload, null, 2);
+                if (!verifyBaselineHmac(expectedInput, envelope.hmacSha256, hmacKey)) {
+                    console.error("[baseline] HMAC verification failed — baseline may have been tampered. Ignoring.");
+                    return null;
+                }
+            }
+            else {
+                // Key not configured: we can't verify, but we can warn
+                console.warn("[baseline] Baseline is signed but SECURITY_POLICY_HMAC_KEY is not set — skipping HMAC verification.");
+            }
+            return envelope.payload.result ?? null;
+        }
+        // Legacy format (unsigned) — parse directly
+        const parsed = top;
+        const hmacKey = getHmacKey();
+        if (hmacKey) {
+            // A key is configured but the file is unsigned — reject it to prevent
+            // an attacker from stripping the HMAC wrapper to bypass verification.
+            console.error("[baseline] SECURITY_POLICY_HMAC_KEY is set but baseline is unsigned — ignoring to prevent tampering bypass.");
+            return null;
+        }
         return parsed.result ?? null;
     }
     catch {

package/dist/gate/catalog.js

@@ -23,8 +23,16 @@ async function readJsonWithFallback(relPath, fallbackName) {
         ".mcp/catalog/control-catalog.json": "SECURITY_GATE_CONTROL_CATALOG"
     };
     const overrideEnv = overrideEnvMap[relPath];
-    if (overrideEnv && process.env[overrideEnv]) {
-        return await readFile(join(process.cwd(), process.env[overrideEnv]), "utf-8");
+    const overridePath = overrideEnv ? process.env[overrideEnv] : undefined;
+    if (overridePath) {
+        // Guard against path traversal (VULN-003 / CWE-22): resolve() + startsWith() is required;
+        // join() alone normalises '..' but does not prevent escape from the project directory.
+        const cwd = process.cwd();
+        const resolved = resolve(cwd, overridePath);
+        if (resolved !== cwd && !resolved.startsWith(cwd + "/")) {
+            throw new Error(`${overrideEnv} path escapes the project directory`);
+        }
+        return await readFile(resolved, "utf-8");
     }
     try {
         return await readFile(join(process.cwd(), relPath), "utf-8");