narvy-cli 1.1.0__tar.gz → 1.1.1__tar.gz

{narvy_cli-1.1.0 → narvy_cli-1.1.1}/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.1]
+
+### Added
+
+- Flask cookie checks: `set_cookie()` without `httponly=True` or
+  `secure=True`, the same checks Django already had.
+- `scan` warns when files or folders could not be read (permissions) instead
+  of skipping them silently; `-v` lists them and the JSON report has
+  `summary.unreadable_paths`.
+- `scan --format` is accepted as an alias of `--output`, like the other
+  commands.
+
+### Fixed
+
+- A second `scan` of the same folder picked up the report written by the
+  first one (`narvy.sarif`, the JSON report) and flagged the rule text quoted
+  in it as secrets. Narvy reports are now recognized by their content, and
+  the `--file` target is never scanned.
+- `--upload` with only `NARVY_TOKEN` set printed "Uploading ... to  for
+  server-side curation". The line now names the server (`narvy.io`, or
+  `NARVY_URL`), and a failed upload or login says which server refused it.
+- `web-scan http://localhost` said "internal/metadata addresses"; it now says
+  the address is loopback and explains why local and private targets are
+  refused.
+- The web-scan, host-audit and cloud-scan JSON output carries a `tool` field.
+- `narvy doctor` documents its exit codes (0 all required checks pass, 1 one
+  failed).
+
 ## [1.1.0]
 
 First release of the community rule set. The 1.0.x preview releases were

{narvy_cli-1.1.0/narvy_cli.egg-info → narvy_cli-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.1.0
+Version: 1.1.1
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0
@@ -143,6 +143,9 @@ command. `narvy scans` lists recent scans on your account from the terminal.
 | 4 | The scan, login, upload or report write failed |
 | 130 | Interrupted (Ctrl-C, SIGTERM) |
 
+`narvy doctor` exits 0 when every required check passes and 1 when one fails.
+Missing optional tools are shown as INFO and do not change its exit code.
+
 ### Resource limits
 
 The structural analysis pass runs with at most 4 parallel workers and a
@@ -165,7 +168,7 @@ Exactly these fields are sent:
 |-------|---------|
 | `schema` | `1`, the event format version |
 | `install_id` | a random UUID created on first run and stored in `~/.narvy/config.json` (not derived from your machine, user or account) |
-| `cli_version`, `python_version`, `os` | `1.1.0`, `3.11`, `linux` / `darwin` / `windows` / `other` |
+| `cli_version`, `python_version`, `os` | `1.1.1`, `3.11`, `linux` / `darwin` / `windows` / `other` |
 | `ci` | `true` when a CI environment variable is set |
 | `command` | `scan`, `web-scan`, `host-audit`, ... |
 | `surface` | `android`, `ios`, `source`, `web`, `host`, `cloud` or `none` |

{narvy_cli-1.1.0 → narvy_cli-1.1.1}/README.md

@@ -110,6 +110,9 @@ command. `narvy scans` lists recent scans on your account from the terminal.
 | 4 | The scan, login, upload or report write failed |
 | 130 | Interrupted (Ctrl-C, SIGTERM) |
 
+`narvy doctor` exits 0 when every required check passes and 1 when one fails.
+Missing optional tools are shown as INFO and do not change its exit code.
+
 ### Resource limits
 
 The structural analysis pass runs with at most 4 parallel workers and a
@@ -132,7 +135,7 @@ Exactly these fields are sent:
 |-------|---------|
 | `schema` | `1`, the event format version |
 | `install_id` | a random UUID created on first run and stored in `~/.narvy/config.json` (not derived from your machine, user or account) |
-| `cli_version`, `python_version`, `os` | `1.1.0`, `3.11`, `linux` / `darwin` / `windows` / `other` |
+| `cli_version`, `python_version`, `os` | `1.1.1`, `3.11`, `linux` / `darwin` / `windows` / `other` |
 | `ci` | `true` when a CI environment variable is set |
 | `command` | `scan`, `web-scan`, `host-audit`, ... |
 | `surface` | `android`, `ios`, `source`, `web`, `host`, `cloud` or `none` |

{narvy_cli-1.1.0 → narvy_cli-1.1.1}/narvy/__init__.py

@@ -1,3 +1,3 @@
 """Narvy CLI - free, local SAST for Android, iOS and polyglot source."""
 
-__version__ = "1.1.0"
+__version__ = "1.1.1"

{narvy_cli-1.1.0 → narvy_cli-1.1.1}/narvy/main.py

@@ -38,7 +38,7 @@ from narvy import __version__
 from narvy.reporter import generate_sarif_report, sarif_level, sarif_security_severity
 from .decompiler import decompile_apk
 from .rule_engine import load_rules_from_dir, run_rules_on_file
-from . import auth, uploader, telemetry
+from . import auth, own_reports, uploader, telemetry
 from .third_party_filter import get_own_package_roots, resolve_file_scope, check_android_override
 from .scope_config import load_scope_config
 from . import semgrep_engine
@@ -775,7 +775,7 @@ def cmd_login(args):
         raise SystemExit(EXIT_BAD_TARGET)
     status, data = uploader.whoami(token)
     if status != 200:
-        console.print(f"[bold red]Login failed:[/bold red] {data.get('error', status)}")
+        console.print(f"[bold red]Login to {uploader.server_host()} failed:[/bold red] {data.get('error', status)}")
         raise SystemExit(EXIT_ERROR)
     auth.save_token(token, data["email"], data["plan"])
     console.print(f"[bold green]Logged in as {data['email']} ({data['plan']} plan).[/bold green]")
@@ -805,7 +805,7 @@ def cmd_scans(args):
         raise SystemExit(EXIT_ERROR)
     if status != 200:
         error_msg = data.get("error") or data.get("message") or data
-        console.print(f"[bold red]Could not fetch scan history ({status}):[/bold red] {error_msg}")
+        console.print(f"[bold red]Could not fetch scan history from {uploader.server_host()} ({status}):[/bold red] {error_msg}")
         raise SystemExit(EXIT_ERROR)
 
     scans = data.get("scans", [])
@@ -821,7 +821,7 @@ def cmd_scans(args):
         )
         return
 
-    table = Table(title=f"Recent scans ({creds['email']})")
+    table = Table(title=f"Recent scans on {rich_escape(_server_and_account(creds))}")
     table.add_column("Scan ID", style="dim")
     table.add_column("App")
     table.add_column("Platform")
@@ -1370,6 +1370,17 @@ def _ingest_scan_mode_label(scan_mode: str) -> str:
     return "android-binary" if scan_mode == "android" else scan_mode
 
 
+def _server_and_account(creds):
+    """'narvy.io (you@example.com, starter)'; NARVY_TOKEN alone carries no email or plan."""
+    parts = [p for p in ((creds or {}).get("email"), (creds or {}).get("plan")) if p]
+    host = uploader.server_host()
+    return f"{host} ({', '.join(parts)})" if parts else host
+
+
+def _upload_failed_label(status):
+    return f"Upload to {uploader.server_host()} failed ({f'HTTP {status}' if status else 'no response'}):"
+
+
 def _submit_results_ingest(all_findings, scan_mode, target_path):
     """POST results to /api/v1/ingest. Exits with EXIT_ERROR on any failure."""
     creds = auth.load_credentials()
@@ -1382,7 +1393,7 @@ def _submit_results_ingest(all_findings, scan_mode, target_path):
     app_name = re.sub(r"\.(zip|apk|aab|ipa|xapk|apkm|apks)$", "", app_name, flags=re.IGNORECASE) or app_name
 
     console.print(
-        f"[cyan]Uploading {len(all_findings)} finding(s) to {creds['email']} "
+        f"[cyan]Uploading {len(all_findings)} finding(s) to {rich_escape(_server_and_account(creds))} "
         f"for server-side curation...[/cyan]"
     )
     try:
@@ -1391,7 +1402,7 @@ def _submit_results_ingest(all_findings, scan_mode, target_path):
             scan_mode=_ingest_scan_mode_label(scan_mode), findings=all_findings,
         )
     except Exception as e:
-        console.print(f"[bold red]Upload failed:[/bold red] {e}")
+        console.print(f"[bold red]Upload to {uploader.server_host()} failed:[/bold red] {e}")
         raise SystemExit(EXIT_ERROR)
 
     if status not in (200, 201):
@@ -1400,7 +1411,7 @@ def _submit_results_ingest(all_findings, scan_mode, target_path):
             console.print(f"[bold red]{asset_msg}[/bold red]")
             raise SystemExit(EXIT_ERROR)
         error_msg = data.get("error") or data if isinstance(data, dict) else data
-        console.print(f"[bold red]Upload failed ({status}):[/bold red] {error_msg}")
+        console.print(f"[bold red]{_upload_failed_label(status)}[/bold red] {error_msg}")
         if isinstance(data, dict) and data.get("message"):
             console.print(f"[dim]{data['message']}[/dim]")
         _print_upgrade_hint(status, data)
@@ -1497,6 +1508,9 @@ def _scan_to_json(all_findings, rules, scan_mode, target_path, encrypted, scan_m
     premium = (scan_meta or {}).get("premium_checks_not_run")
     if premium:
         summary["premium_checks_not_run"] = premium
+    unreadable = (scan_meta or {}).get("unreadable_paths")
+    if unreadable:
+        summary["unreadable_paths"] = unreadable
     return {
         "tool": "Narvy CLI",
         "version": __version__,
@@ -1548,8 +1562,33 @@ def _scan_nested_ios_surfaces(target_path, ios_roots, all_findings, rules, scan_
     return all_findings, rules, scan_meta
 
 
+_UNREADABLE_SKIP_DIRS = frozenset({
+    ".git", "node_modules", ".gradle", ".idea", "Pods", "Carthage", "__pycache__",
+    ".venv", "venv", "DerivedData", ".build",
+})
+
+
+def _unreadable_paths(source_dir):
+    """Files and directories under source_dir this user cannot read (vendored dirs aside)."""
+    bad = []
+
+    def _onerror(err):
+        if getattr(err, "filename", None):
+            bad.append(os.path.relpath(err.filename, source_dir) + os.sep)
+
+    for root, dirs, files in os.walk(source_dir, onerror=_onerror):
+        dirs[:] = [d for d in dirs if d not in _UNREADABLE_SKIP_DIRS]
+        for name in files:
+            full = os.path.join(root, name)
+            if not os.path.islink(full) and not os.access(full, os.R_OK):
+                bad.append(os.path.relpath(full, source_dir))
+    return sorted(bad)
+
+
 def cmd_scan(args):
     target_path = args.apk_path
+    own_reports.SKIPPED.clear()
+    own_reports.set_output_path(None)
     if getattr(args, "upload_binary", False):
         args.upload = True
     if not os.path.exists(target_path):
@@ -1593,6 +1632,7 @@ def cmd_scan(args):
             console.print(f"[bold red]Cannot write {args.output.upper()} output to {_preflight_out}: {_werr}.[/bold red]")
             console.print("[dim]Check the parent directory exists and is writable, or pick a different --file path.[/dim]")
             raise SystemExit(EXIT_ERROR)
+        own_reports.set_output_path(_preflight_out)
 
     # Android and iOS-binary paths only: iOS source mode classifies vendored
     # code by directory convention instead.
@@ -1602,6 +1642,8 @@ def cmd_scan(args):
                        f"{len(override_config.own)} 'own' pattern(s), "
                        f"{len(override_config.vendor)} 'vendor' pattern(s).[/dim]")
 
+    unreadable = _unreadable_paths(target_path) if os.path.isdir(target_path) else []
+
     if scan_mode == "ios-source":
         result = _run_ios_source_scan(target_path)
     elif scan_mode == "ios-binary":
@@ -1637,6 +1679,16 @@ def cmd_scan(args):
         all_findings, rules, scan_meta = _scan_nested_ios_surfaces(
             target_path, extra_ios_roots, all_findings, rules, scan_meta)
 
+    # Our own earlier reports (narvy.sarif, results JSON) quote rule text that
+    # the secret rules would match; they are not project code.
+    if os.path.isdir(target_path):
+        all_findings = own_reports.drop_own_reports(all_findings, target_path)
+    if own_reports.SKIPPED:
+        names = ", ".join(sorted(own_reports.SKIPPED)[:5])
+        more = len(own_reports.SKIPPED) - 5
+        console.print(f"[dim]Ignored Narvy report file(s) from an earlier run: {rich_escape(names)}"
+                      f"{f' and {more} more' if more > 0 else ''}.[/dim]")
+
     # Say so when a hybrid repo (RN/Flutter/Capacitor) has code this mode
     # didn't cover, instead of exiting 0 silently.
     uncovered_notes = _uncovered_surface_notes(target_path, scan_mode,
@@ -1655,6 +1707,9 @@ def cmd_scan(args):
     if uncovered_notes:
         scan_meta = dict(scan_meta)
         scan_meta["uncovered_surfaces"] = uncovered_notes
+    if unreadable:
+        scan_meta = dict(scan_meta)
+        scan_meta["unreadable_paths"] = unreadable
 
     if args.output in ('sarif', 'json'):
         # Written to a file, never stdout: progress notes would interleave.
@@ -1736,6 +1791,15 @@ def cmd_scan(args):
         for note in uncovered_notes:
             console.print(f"[bold yellow]  - {note}[/bold yellow]")
 
+    if unreadable:
+        console.print(
+            f"\n[bold yellow]{len(unreadable)} file(s) or folder(s) could not be read (permissions) "
+            "and were not scanned.[/bold yellow]"
+            + ("" if getattr(args, "verbose", False) else " [dim]Add -v to list them.[/dim]"))
+        if getattr(args, "verbose", False):
+            for rel in unreadable:
+                console.print(f"[yellow]  - {rich_escape(rel)}[/yellow]")
+
     _premium_note = web_source_analyzer.premium_checks_note(premium_counts)
     if _premium_note:
         console.print(f"\n[dim]{rich_escape(_premium_note)}[/dim]")
@@ -1766,7 +1830,7 @@ def cmd_scan(args):
             raise SystemExit(EXIT_BAD_TARGET)
         upload_platform = "android" if scan_mode in ("android", "android-bundle") else "ios"
         confirm_upload = getattr(args, "confirm_upload", False)
-        console.print(f"\n[cyan]Uploading {os.path.basename(target_path)} to Narvy for the full server-side scan ({creds['email']}, {creds['plan']})...[/cyan]")
+        console.print(f"\n[cyan]Uploading {os.path.basename(target_path)} to {rich_escape(_server_and_account(creds))} for the full server-side scan...[/cyan]")
         status, data = uploader.upload_scan(
             target_path, creds["token"], platform=upload_platform, analysis_type="sast",
             confirm_warning=confirm_upload,
@@ -1801,7 +1865,7 @@ def cmd_scan(args):
             # The malware-triage gate returns a 'triage' dict alongside the
             # top-level error on 400 (refuse) and 409 (warn).
             error_msg = data.get('error') or data.get('warning') or data
-            console.print(f"[bold red]Upload failed ({status}):[/bold red] {error_msg}")
+            console.print(f"[bold red]{_upload_failed_label(status)}[/bold red] {error_msg}")
             _print_upgrade_hint(status, data)
             triage = data.get('triage')
             if isinstance(triage, dict):
@@ -1963,7 +2027,7 @@ def cmd_upload_all(args):
 
     console.print(
         f"[cyan]Found {len(targets)} target(s) under {directory}. "
-        f"Scanning and uploading to {creds['email']} ({creds['plan']})...[/cyan]\n"
+        f"Scanning and uploading to {rich_escape(_server_and_account(creds))}...[/cyan]\n"
     )
 
     succeeded, failed = [], []
@@ -2159,7 +2223,12 @@ def cmd_web_scan(args):
     try:
         web_validate_url(args.url)
     except SSRFBlocked as e:
-        console.print(f"[bold red]ERROR:[/bold red] {e}")
+        console.print(f"[bold red]ERROR:[/bold red] {rich_escape(str(e))}")
+        if any(w in str(e) for w in ("loopback", "internal", "private")):
+            console.print(
+                "[dim]web-scan only scans publicly reachable URLs. Loopback, private-network and "
+                "cloud metadata addresses are refused so a scan can never reach internal services. "
+                "Point it at the app's public or staging URL.[/dim]")
         raise SystemExit(EXIT_BAD_TARGET)
 
     with scan_progress() as progress:
@@ -2186,7 +2255,7 @@ def cmd_web_scan(args):
     findings = result.get("findings", [])
 
     if args.format == "json":
-        output = json.dumps(result, indent=2)
+        output = json.dumps({"tool": "Narvy Web Scanner CLI", **result}, indent=2)
     elif args.format == "sarif":
         output = json.dumps(_web_to_sarif(findings), indent=2)
     else:
@@ -2338,6 +2407,7 @@ def cmd_host_audit(args):
         "Narvy internal host checks + Lynis (GPL-3.0) hardening baseline")
 
     result = {
+        "tool": "Narvy Host Audit CLI",
         "target": f"{args.user}@{args.host}:{args.port}",
         "duration_seconds": round(duration, 1),
         "scan_engine": scan_engine,
@@ -2483,7 +2553,7 @@ def cmd_cloud_scan(args):
         )
 
     if args.format == "json":
-        output = json.dumps(report, indent=2, default=str)
+        output = json.dumps({"tool": "Narvy Cloud Scanner CLI", **report}, indent=2, default=str)
     elif args.format == "sarif":
         sarif = _cloud_to_sarif(findings)
         sarif["runs"][0]["properties"] = {"coverage": coverage}
@@ -2640,7 +2710,11 @@ def cli():
     p_scans.add_argument("--format", choices=["text", "json"], default="text", help="Output format (default: text)")
     p_scans.set_defaults(func=cmd_scans)
 
-    p_doctor = sub.add_parser("doctor", allow_abbrev=False, help="Check your Java/jadx/network/iOS-tooling setup before scanning")
+    p_doctor = sub.add_parser(
+        "doctor", allow_abbrev=False, help="Check your Java/jadx/network/iOS-tooling setup before scanning",
+        epilog="exit codes:\n  0  every required check passed (missing optional tools are INFO only)\n"
+               "  1  at least one required check failed",
+        formatter_class=argparse.RawDescriptionHelpFormatter)
     p_doctor.set_defaults(func=lambda args: run_doctor())
 
     p_scan = sub.add_parser(
@@ -2653,8 +2727,10 @@ def cli():
     p_scan.add_argument("--max-mem", default="4g", help="Max memory for jadx, e.g. '2g' or '4096m' (default: 4g). Android only.")
     p_scan.add_argument("--force", action="store_true",
                         help="Decompile anyway when the memory estimate says jadx will likely run out of memory.")
-    p_scan.add_argument("--output", "-o", default="console", choices=["console", "sarif", "json"],
+    p_scan.add_argument("--output", "-o", "--format", dest="output", default="console", choices=["console", "sarif", "json"],
                         type=str.lower, help="Output format: console (default), sarif or json. sarif and json are written to --file.")
+    p_scan.add_argument("-v", "--verbose", action="store_true",
+                        help="List every file the scan could not read, not just the count.")
     p_scan.add_argument("--file", "-f", default=None, help="Output file for --output sarif/json (default: narvy-results.sarif or narvy-results.json). Ignored for console output.")
     p_scan.add_argument("--upload", action="store_true", help="Send the findings (never your code or binary) to your Narvy dashboard after the scan. Needs `narvy login` and a paid plan.")
     p_scan.add_argument("--upload-binary", action="store_true", help="Upload the binary itself (.apk/.aab/.ipa) for a server-side scan instead of the results. Implies --upload.")

narvy_cli-1.1.1/narvy/own_reports.py

@@ -0,0 +1,72 @@
+"""Recognize report files written by narvy itself, so a re-run never scans them."""
+import json
+import os
+from typing import Dict, Optional, Set
+
+# A real report of ours is far below this; bigger files are left to the rules.
+_MAX_REPORT_BYTES = 256 * 1024 * 1024
+
+_output_path: Optional[str] = None
+_cache: Dict[str, bool] = {}
+# Report files whose findings were dropped this run, for the end-of-scan note.
+SKIPPED: Set[str] = set()
+
+
+def set_output_path(path: Optional[str]) -> None:
+    """The --file target of this run: whatever it holds now gets overwritten."""
+    global _output_path
+    _output_path = os.path.realpath(path) if path and path != "-" else None
+
+
+def _has_narvy_marker(data) -> bool:
+    if not isinstance(data, dict):
+        return False
+    tool = data.get("tool")
+    if isinstance(tool, str) and tool.startswith("Narvy"):
+        return True
+    runs = data.get("runs")
+    if isinstance(runs, list) and runs:
+        for run in runs:
+            tool = run.get("tool") if isinstance(run, dict) else None
+            driver = tool.get("driver") if isinstance(tool, dict) else None
+            name = driver.get("name") if isinstance(driver, dict) else None
+            if not (isinstance(name, str) and name.startswith("Narvy")):
+                return False
+        return True
+    return False
+
+
+def is_own_report(path: str) -> bool:
+    """True for this run's --file target or a JSON/SARIF report narvy wrote."""
+    try:
+        real = os.path.realpath(path)
+    except (OSError, ValueError):
+        return False
+    if _output_path and real == _output_path:
+        return True
+    if real in _cache:
+        return _cache[real]
+    result = False
+    try:
+        if os.path.isfile(real) and os.path.getsize(real) <= _MAX_REPORT_BYTES:
+            with open(real, "rb") as f:
+                if f.read(256).lstrip(b"\xef\xbb\xbf \t\r\n").startswith(b"{"):
+                    f.seek(0)
+                    result = _has_narvy_marker(json.load(f))
+    except (OSError, ValueError, RecursionError):
+        result = False
+    _cache[real] = result
+    return result
+
+
+def drop_own_reports(findings, target_dir: str):
+    """Findings minus those inside narvy report files, for a source-directory scan."""
+    kept = []
+    for f in findings:
+        fp = f.get("file_path") or ""
+        full = fp if os.path.isabs(fp) else os.path.join(target_dir, fp)
+        if fp and is_own_report(full):
+            SKIPPED.add(os.path.relpath(full, target_dir))
+        else:
+            kept.append(f)
+    return kept

{narvy_cli-1.1.0 → narvy_cli-1.1.1}/narvy/rules/web/python.yml

@@ -2017,6 +2017,73 @@ rules:
       ...
 
       '
+- id: narvy.python.session.flask-set-cookie-missing-httponly.flask-set-cookie-missing-httponly
+  message: '`set_cookie()` is called without `httponly=True`. A cookie without HttpOnly is readable from
+    JavaScript via `document.cookie`, so any XSS on the page can exfiltrate it (session hijack). CWE-1004.
+    Set `httponly=True`, or `SESSION_COOKIE_HTTPONLY = True` globally.'
+  severity: WARNING
+  languages:
+  - python
+  metadata:
+    cwe:
+    - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag'
+    owasp:
+    - A05:2021 - Security Misconfiguration
+    category: security
+    subcategory:
+    - vuln
+    technology:
+    - flask
+    likelihood: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    vulnerability_class:
+    - Cookie Security
+  patterns:
+  - pattern-either:
+    - pattern-inside: |
+        import flask
+        ...
+    - pattern-inside: |
+        from flask import $FLASK_NAME
+        ...
+  - pattern: $RESP.set_cookie($NAME, $VALUE, ...)
+  - pattern-not: $RESP.set_cookie($NAME, $VALUE, ..., httponly=True, ...)
+  - pattern-not: $RESP.set_cookie($NAME, $VALUE, ..., httponly=$X, ...)
+- id: narvy.python.session.flask-set-cookie-missing-secure.flask-set-cookie-missing-secure
+  message: '`set_cookie()` is called without `secure=True`. Without the Secure flag, the browser will
+    also send this cookie over plain HTTP, exposing it to network eavesdroppers and active MITM (CWE-614).
+    Set `secure=True` for any cookie carrying session/auth state, or set `SESSION_COOKIE_SECURE = True`
+    globally in Flask config.'
+  severity: WARNING
+  languages:
+  - python
+  metadata:
+    cwe:
+    - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute'
+    owasp:
+    - A05:2021 - Security Misconfiguration
+    category: security
+    subcategory:
+    - vuln
+    technology:
+    - flask
+    likelihood: MEDIUM
+    impact: MEDIUM
+    confidence: MEDIUM
+    vulnerability_class:
+    - Cookie Security
+  patterns:
+  - pattern-either:
+    - pattern-inside: |
+        import flask
+        ...
+    - pattern-inside: |
+        from flask import $FLASK_NAME
+        ...
+  - pattern: $RESP.set_cookie($NAME, $VALUE, ...)
+  - pattern-not: $RESP.set_cookie($NAME, $VALUE, ..., secure=True, ...)
+  - pattern-not: $RESP.set_cookie($NAME, $VALUE, ..., secure=$X, ...)
 - id: narvy.python.sqli.pymongo-eval-where-injection.pymongo-eval-where-injection
   message: MongoDB `$where` clause (or `db.eval()`) built with a tainted string. `$where` executes JavaScript
     server-side against every document; an attacker-controlled fragment here is server-side NoSQL code

{narvy_cli-1.1.0 → narvy_cli-1.1.1}/narvy/uploader.py

@@ -1,4 +1,5 @@
 import os
+from urllib.parse import urlparse
 
 import requests
 
@@ -6,6 +7,11 @@ import requests
 API_BASE = (os.environ.get("NARVY_URL") or "https://narvy.io").rstrip("/")
 
 
+def server_host():
+    """Host the CLI talks to, for messages (narvy.io unless NARVY_URL says otherwise)."""
+    return urlparse(API_BASE).netloc or API_BASE
+
+
 def _network_error(exc):
     """Return the (status, data) shape callers handle; status 0 never matches a real HTTP code."""
     return 0, {

{narvy_cli-1.1.0 → narvy_cli-1.1.1}/narvy/web/source_analyzer.py

@@ -9,7 +9,7 @@ from typing import Any, Dict, List, Optional, Set, Tuple
 
 import yaml
 
-from narvy import semgrep_engine
+from narvy import own_reports, semgrep_engine
 from narvy.proc import run_tree
 
 _HERE = os.path.dirname(__file__)
@@ -43,7 +43,7 @@ def pro_rules_available() -> bool:
 # can say what it didn't run.
 PREMIUM_CHECKS: Dict[str, Tuple[str, int]] = {
     "django": ("Django / Django REST framework", 24),
-    "flask": ("Flask", 12),
+    "flask": ("Flask", 10),
     "fastapi": ("FastAPI", 1),
     "express": ("Express", 2),
     "laravel": ("Laravel", 7),
@@ -735,6 +735,9 @@ def _parse_semgrep_data(data: Dict[str, Any], source_dir: str,
             skipped_generated += 1
             continue
         rel_path = os.path.relpath(abs_path, source_dir)
+        if own_reports.is_own_report(abs_path):
+            own_reports.SKIPPED.add(rel_path)
+            continue
         extra = r.get("extra", {})
         meta = extra.get("metadata", {})
         check_id = r.get("check_id", "semgrep-finding").rsplit(".", 1)[-1]

{narvy_cli-1.1.0 → narvy_cli-1.1.1}/narvy/web/ssrf_guard.py

@@ -154,6 +154,8 @@ def validate_url(url: str) -> Tuple[str, str, int]:
             except SSRFBlocked:
                 raise
 
+    if hostname == 'localhost':
+        raise SSRFBlocked("localhost is this machine (loopback); scanning it is not allowed")
     if hostname in METADATA_HOSTNAMES:
         raise SSRFBlocked("Scanning internal/metadata addresses is not allowed")
 

{narvy_cli-1.1.0 → narvy_cli-1.1.1/narvy_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.1.0
+Version: 1.1.1
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0
@@ -143,6 +143,9 @@ command. `narvy scans` lists recent scans on your account from the terminal.
 | 4 | The scan, login, upload or report write failed |
 | 130 | Interrupted (Ctrl-C, SIGTERM) |
 
+`narvy doctor` exits 0 when every required check passes and 1 when one fails.
+Missing optional tools are shown as INFO and do not change its exit code.
+
 ### Resource limits
 
 The structural analysis pass runs with at most 4 parallel workers and a
@@ -165,7 +168,7 @@ Exactly these fields are sent:
 |-------|---------|
 | `schema` | `1`, the event format version |
 | `install_id` | a random UUID created on first run and stored in `~/.narvy/config.json` (not derived from your machine, user or account) |
-| `cli_version`, `python_version`, `os` | `1.1.0`, `3.11`, `linux` / `darwin` / `windows` / `other` |
+| `cli_version`, `python_version`, `os` | `1.1.1`, `3.11`, `linux` / `darwin` / `windows` / `other` |
 | `ci` | `true` when a CI environment variable is set |
 | `command` | `scan`, `web-scan`, `host-audit`, ... |
 | `surface` | `android`, `ios`, `source`, `web`, `host`, `cloud` or `none` |

{narvy_cli-1.1.0 → narvy_cli-1.1.1}/narvy_cli.egg-info/SOURCES.txt

@@ -15,6 +15,7 @@ narvy/decompiler.py
 narvy/doctor.py
 narvy/main.py
 narvy/native_hardening.py
+narvy/own_reports.py
 narvy/proc.py
 narvy/reporter.py
 narvy/rule_engine.py