codejury 0.10.3__tar.gz → 0.10.4__tar.gz

{codejury-0.10.3 → codejury-0.10.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.10.3
+Version: 0.10.4
 Summary: General-purpose Application Security AI audit framework: five-layer architecture, capabilities as first-class data
 Author: AISecLabs
 License-Expression: MIT
@@ -186,7 +186,7 @@ what `--only` and a task's `capabilities:` accept:
 `authn`, `authz`, `session`, `input_validation`, `output_encoding`, `crypto`,
 `secrets`, `data_protection`, `error_logging`, `business_logic`,
 `dependency_config`, `prompt_injection`, `insecure_output_handling`,
-`excessive_agency`.
+`excessive_agency`, `model_supply_chain`.
 
 To tune for your codebase, edit these files, adding patterns or sharpening
 wording. No code change is needed.

{codejury-0.10.3 → codejury-0.10.4}/README.md

@@ -156,7 +156,7 @@ what `--only` and a task's `capabilities:` accept:
 `authn`, `authz`, `session`, `input_validation`, `output_encoding`, `crypto`,
 `secrets`, `data_protection`, `error_logging`, `business_logic`,
 `dependency_config`, `prompt_injection`, `insecure_output_handling`,
-`excessive_agency`.
+`excessive_agency`, `model_supply_chain`.
 
 To tune for your codebase, edit these files, adding patterns or sharpening
 wording. No code change is needed.

codejury-0.10.4/codejury/data/capabilities/model_supply_chain.yaml

@@ -0,0 +1,59 @@
+# OWASP LLM Top 10 (2025), LLM03: Supply Chain.
+id: model_supply_chain
+name: Model Supply Chain
+asvs_chapter: ""   # OWASP LLM03, not an ASVS chapter
+description: >-
+  Loading a model, its code, or its weights from an untrusted or unverified
+  source. The high-impact cases run code at load time: executing code shipped
+  with a third-party model, or deserializing weights through pickle. Pin and
+  verify artifacts, and do not enable remote code execution for a model you do
+  not control.
+
+sub_capabilities:
+  remote_code:
+    correct_patterns:
+      - id: SC-OK-1
+        description: Load a model with remote code execution off and a pinned revision
+        signals: ["trust_remote_code=False", "revision="]
+        why_ok: The third-party repo cannot run code at load time and the artifact is pinned
+
+    anti_patterns:
+      - id: SC-BAD-1
+        cwe: CWE-494
+        severity: CRITICAL
+        description: >-
+          Load a model with trust_remote_code=True, which executes code shipped in
+          the model repository at load time
+        signals: ["trust_remote_code=True", "from_pretrained"]
+        why_bad: A malicious or compromised model repo runs arbitrary code in your process
+        example_bad: |
+          model = AutoModel.from_pretrained("vendor/model", trust_remote_code=True)
+        example_good: |
+          model = AutoModel.from_pretrained("vendor/model", revision="a1b2c3d")
+
+  artifact_integrity:
+    correct_patterns:
+      - id: SC-OK-2
+        description: Load weights from a data-only format such as safetensors
+        signals: ["safetensors", "load_file"]
+        why_ok: A data-only weights format cannot execute code on load
+
+    anti_patterns:
+      - id: SC-BAD-2
+        cwe: CWE-502
+        severity: HIGH
+        description: >-
+          Deserialize model weights or a checkpoint through pickle, for example
+          torch.load or joblib.load on a downloaded file, which can run code on load
+        signals: ["torch.load", "pickle.load", "joblib.load"]
+        why_bad: Pickle-based loaders execute code embedded in the file during deserialization
+        example_bad: |
+          state = torch.load(downloaded_checkpoint)
+        example_good: |
+          from safetensors.torch import load_file
+          state = load_file("model.safetensors")
+
+trigger_signals:
+  - from_pretrained or a model or dataset download call
+  - trust_remote_code set on a model load
+  - torch.load, pickle.load, or joblib.load of model weights

codejury-0.10.4/codejury/data/golden/sc_pinned_safe.yaml

@@ -0,0 +1,11 @@
+capability: model_supply_chain
+vulnerable: false
+expected_verdict: SECURE
+cwe: ""
+source: synthetic
+notes: >
+  An ordinary model load: remote code execution is off by default and the
+  revision is pinned, so a plain from_pretrained must not be flagged.
+code: |
+  def load():
+      return AutoModel.from_pretrained("bert-base-uncased", revision="a1b2c3d")

codejury-0.10.4/codejury/data/golden/sc_safetensors_safe.yaml

@@ -0,0 +1,12 @@
+capability: model_supply_chain
+vulnerable: false
+expected_verdict: SECURE
+cwe: ""
+source: synthetic
+notes: >
+  safetensors is a data-only weights format that cannot execute code on load.
+code: |
+  from safetensors.torch import load_file
+
+  def load_checkpoint(path):
+      return load_file(path)

codejury-0.10.4/codejury/data/golden/sc_torch_load_vuln.yaml

@@ -0,0 +1,11 @@
+capability: model_supply_chain
+vulnerable: true
+expected_verdict: VULNERABLE
+cwe: CWE-502
+source: synthetic
+notes: >
+  torch.load deserializes through pickle, so loading a downloaded checkpoint runs
+  any code embedded in the file. Use a data-only format such as safetensors.
+code: |
+  def load_checkpoint(path):
+      return torch.load(path)

codejury-0.10.4/codejury/data/golden/sc_trust_remote_code_vuln.yaml

@@ -0,0 +1,11 @@
+capability: model_supply_chain
+vulnerable: true
+expected_verdict: VULNERABLE
+cwe: CWE-494
+source: synthetic
+notes: >
+  trust_remote_code=True runs code shipped in the third-party model repo at load
+  time, so a malicious or compromised repo executes arbitrary code in the process.
+code: |
+  def load(name):
+      return AutoModel.from_pretrained(name, trust_remote_code=True)

{codejury-0.10.3 → codejury-0.10.4}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.10.3
+Version: 0.10.4
 Summary: General-purpose Application Security AI audit framework: five-layer architecture, capabilities as first-class data
 Author: AISecLabs
 License-Expression: MIT
@@ -186,7 +186,7 @@ what `--only` and a task's `capabilities:` accept:
 `authn`, `authz`, `session`, `input_validation`, `output_encoding`, `crypto`,
 `secrets`, `data_protection`, `error_logging`, `business_logic`,
 `dependency_config`, `prompt_injection`, `insecure_output_handling`,
-`excessive_agency`.
+`excessive_agency`, `model_supply_chain`.
 
 To tune for your codebase, edit these files, adding patterns or sharpening
 wording. No code change is needed.

{codejury-0.10.3 → codejury-0.10.4}/codejury.egg-info/SOURCES.txt

@@ -37,6 +37,7 @@ codejury/data/capabilities/error_logging.yaml
 codejury/data/capabilities/excessive_agency.yaml
 codejury/data/capabilities/input_validation.yaml
 codejury/data/capabilities/insecure_output_handling.yaml
+codejury/data/capabilities/model_supply_chain.yaml
 codejury/data/capabilities/output_encoding.yaml
 codejury/data/capabilities/prompt_injection.yaml
 codejury/data/capabilities/secrets.yaml
@@ -86,6 +87,10 @@ codejury/data/golden/pi_indirect_rag_vuln.yaml
 codejury/data/golden/pi_system_concat_vuln.yaml
 codejury/data/golden/pi_user_content_concat_safe.yaml
 codejury/data/golden/pi_user_role_safe.yaml
+codejury/data/golden/sc_pinned_safe.yaml
+codejury/data/golden/sc_safetensors_safe.yaml
+codejury/data/golden/sc_torch_load_vuln.yaml
+codejury/data/golden/sc_trust_remote_code_vuln.yaml
 codejury/data/golden/secrets_env_safe.yaml
 codejury/data/golden/secrets_hardcoded_vuln.yaml
 codejury/data/golden/session_fixation_vuln.yaml

{codejury-0.10.3 → codejury-0.10.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.10.3"
+version = "0.10.4"
 description = "General-purpose Application Security AI audit framework: five-layer architecture, capabilities as first-class data"
 readme = "README.md"
 requires-python = ">=3.12"