tewip-ai 0.69.10 → 0.70.1

package/dist/engine/attest/attest-command.js

@@ -14,7 +14,9 @@ export function verifyAttestation(file, keyFile) {
     const bundle = JSON.parse(readFileSync(resolve(file), 'utf8'));
     const publicKey = keyFile ? readFileSync(resolve(keyFile), 'utf8') : undefined;
     const checked = check(bundle, publicKey);
-    const ok = checked.contentMatches && checked.signature !== 'invalid';
+    // 'stripped' counts as a failure: the caller supplied a key, so it asked who made this, and a
+    // bundle with no signature cannot answer. See `check` in seal.ts for the attack that exposed it.
+    const ok = checked.contentMatches && checked.signature !== 'invalid' && checked.signature !== 'stripped';
     const report = [
         `# ${ok ? 'Checked' : 'Do not trust this bundle'}: ${file.split(/[\/]/).pop()}`,
         '',

package/dist/engine/attest/seal.js

@@ -20,18 +20,24 @@ import { createHash, createPrivateKey, createPublicKey, sign as cryptoSign, veri
  * different bundle.
  */
 export function canonical(bundle) {
-    const ordered = (value) => {
+    // The seal is left out of its own digest, which it has to be - but only the **top-level** one.
+    // The filter used to apply at every depth, so any field named `seal` anywhere inside the bundle
+    // was invisible to the digest: content could be added under `claims[0].seal` without changing the
+    // digest or invalidating the signature over it. Nothing reads such a field today, which is why
+    // this is small rather than serious; the claim being made is that the digest covers the content,
+    // and a digest with a hole in it is not that claim.
+    const ordered = (value, top = false) => {
         if (Array.isArray(value))
-            return value.map(ordered);
+            return value.map((v) => ordered(v));
         if (value && typeof value === 'object') {
             return Object.fromEntries(Object.entries(value)
-                .filter(([k]) => k !== 'seal')
+                .filter(([k]) => !(top && k === 'seal'))
                 .sort(([a], [b]) => a.localeCompare(b))
                 .map(([k, v]) => [k, ordered(v)]));
         }
         return value;
     };
-    return JSON.stringify(ordered(bundle));
+    return JSON.stringify(ordered(bundle, true));
 }
 export const digestOf = (bundle) => createHash('sha256').update(canonical(bundle)).digest('hex');
 /**
@@ -65,10 +71,27 @@ export function check(bundle, publicKeyPem) {
         return { contentMatches: false, signature: bundle.seal?.signature ? 'invalid' : 'absent', says: 'the content does not match the digest recorded inside it: it has been changed since it was written' };
     }
     if (!bundle.seal?.signature) {
+        // A key was given, so authorship is what was asked about - and there is nothing here to answer
+        // with. This used to return the same pass as an unsigned bundle checked without a key, so:
+        // change a fact, erase the "what was not checked" list, delete the signature, recompute the
+        // digest, and `attest --verify bundle.json --key release.pem` printed "Content matches its
+        // digest: yes" and **exited 0**. Any gate scripted on it passed. Removing a signature is the
+        // oldest attack on one, and "there is nothing to check" is a failure to establish what was
+        // asked, not a pass.
+        if (publicKeyPem?.trim()) {
+            return {
+                contentMatches: true,
+                signature: 'stripped',
+                says: 'a public key was given but this bundle carries no signature, so who produced it cannot be established. ' +
+                    'The content does match the digest recorded inside it, and that is worth nothing here: anyone who edits a bundle can recompute its digest, which is exactly what removing the signature would look like',
+            };
+        }
         return {
             contentMatches: true,
             signature: 'absent',
-            says: 'the content matches its own digest, and nothing more: no signature was made, so this shows the bundle is undamaged, not that nobody edited it - an editor can recompute a digest',
+            // "no signature was made" asserted something about the bundle's history that cannot be known
+            // from the bundle: it may have been removed. What is observable is that it carries none.
+            says: 'the content matches its own digest, and nothing more: this bundle carries no signature, so this shows it is undamaged, not that nobody edited it - an editor can recompute a digest',
         };
     }
     if (!publicKeyPem?.trim()) {

package/dist/engine/secure/web.js

@@ -169,12 +169,54 @@ export async function scanWeb(url, { timeoutMs = 15_000, probeExposed = true, pa
     return { findings, requests, note: null };
 }
 /** Localhost, a private address, or a name only this machine resolves. */
+/** The four octets of a dotted IPv4 address, or null for anything else - including a name. */
+function ipv4(host) {
+    const parts = host.split('.');
+    if (parts.length !== 4)
+        return null;
+    const numbers = parts.map((p) => (/^\d{1,3}$/.test(p) ? Number(p) : -1));
+    return numbers.every((n) => n >= 0 && n <= 255) ? numbers : null;
+}
+/**
+ * Is this address the person's own machine or network?
+ *
+ * **This is a consent control, not a convenience.** `secure --url` refuses a non-local address
+ * without `--i-am-authorised`, because scanning a system you do not run is not Tewip's decision to
+ * make - so anything this returns `true` for is scanned with no questions asked.
+ *
+ * It was a prefix match, and five hostnames walked straight past it: `localhost.evil.example`,
+ * `localhostile.example`, `10.evil.example`, `127.0.0.1.evil.example` and `172.16.evil.example` were
+ * all "this machine", because each *starts with* something local-looking. `localhost.<anything>` is
+ * one of the oldest allowlist bypasses there is, and a careless paste reaches it as easily as a
+ * malicious one.
+ *
+ * So a name is local only if it **is** `localhost` or ends in a reserved local suffix, and an address
+ * is local only if its octets really fall in a private range. Link-local 169.254/16 is deliberately
+ * **not** local: `169.254.169.254` is the cloud metadata endpoint, and asking before touching it is
+ * exactly the point of this function.
+ */
 export function isLocal(url) {
+    let host;
     try {
-        const host = new URL(url).hostname;
-        return /^(?:localhost|127\.|0\.0\.0\.0|\[::1\]|::1|10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.)/.test(host) || host.endsWith('.local') || host.endsWith('.localhost');
+        host = new URL(url).hostname.toLowerCase();
     }
     catch {
         return false;
     }
+    // `new URL('http://[::1]').hostname` is "[::1]" in Node, so both spellings are accepted.
+    if (host === 'localhost' || host === '::1' || host === '[::1]')
+        return true;
+    if (host.endsWith('.localhost') || host.endsWith('.local'))
+        return true;
+    const octets = ipv4(host);
+    if (!octets)
+        return false;
+    const [a, b] = octets;
+    if (a === 0 || a === 127)
+        return true; // 0.0.0.0 and the whole loopback range
+    if (a === 10)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    return a === 172 && b >= 16 && b <= 31;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.69.10",
+  "version": "0.70.1",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [