websec-validator 0.5.0__tar.gz → 0.6.0__tar.gz

{websec_validator-0.5.0/src/websec_validator.egg-info → websec_validator-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: websec-validator
-Version: 0.5.0
+Version: 0.6.0
 Summary: Local-first security recon that briefs your AI coding agent: facts + tailored probe scripts, code-in / artifacts-out. No LLM, no server, no running app.
 Author: Ricardo Accioly
 License: MIT
@@ -94,7 +94,7 @@ Then point your agent at the output: **"Read `websec-out/AGENT-BRIEFING.md` and
 | **authz** | access-control map | guard coverage + **write endpoints with no visible guard** + roles |
 | tenant | multi-tenancy key candidates | the BOLA boundary, by frequency |
 | **password_policy** | cross-route consistency **+ reuse/history** | complexity drift across routes **+ a set-password path that hashes without a reuse check** |
-| surface | 14 sink classes **+ redirect-SSRF** | user-input-gated sinks + var-arg SSRF + error-disclosure **+ follows-redirects-without-per-hop-guard** |
+| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure **+ follows-redirects-without-per-hop-guard** |
 | **upload_security** | unrestricted upload + unsafe serve | deny-list-only, stored-name-from-filename, trust-client-MIME, accept-SVG, **serve without `nosniff`** |
 | schemas | data models + **privileged fields** | Pydantic/SQLAlchemy/Django/Prisma/Mongoose/TypeORM/Zod → `role`/`isAdmin`/`groupId` for mass-assignment targeting |
 | iac_ci | IaC + CI/CD | GHA injection, unpinned actions, tfstate, **CDK AppSync `API_KEY` anonymous-default-auth + WAF-as-control smell** |
@@ -185,7 +185,7 @@ upload, cross-tenant BOLA, role/authz gaps).
 ## Tests
 
 ```bash
-python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 126 tests
+python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 135 tests
 ```
 
 ## Releasing (maintainer)

{websec_validator-0.5.0 → websec_validator-0.6.0}/README.md

@@ -82,7 +82,7 @@ Then point your agent at the output: **"Read `websec-out/AGENT-BRIEFING.md` and
 | **authz** | access-control map | guard coverage + **write endpoints with no visible guard** + roles |
 | tenant | multi-tenancy key candidates | the BOLA boundary, by frequency |
 | **password_policy** | cross-route consistency **+ reuse/history** | complexity drift across routes **+ a set-password path that hashes without a reuse check** |
-| surface | 14 sink classes **+ redirect-SSRF** | user-input-gated sinks + var-arg SSRF + error-disclosure **+ follows-redirects-without-per-hop-guard** |
+| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure **+ follows-redirects-without-per-hop-guard** |
 | **upload_security** | unrestricted upload + unsafe serve | deny-list-only, stored-name-from-filename, trust-client-MIME, accept-SVG, **serve without `nosniff`** |
 | schemas | data models + **privileged fields** | Pydantic/SQLAlchemy/Django/Prisma/Mongoose/TypeORM/Zod → `role`/`isAdmin`/`groupId` for mass-assignment targeting |
 | iac_ci | IaC + CI/CD | GHA injection, unpinned actions, tfstate, **CDK AppSync `API_KEY` anonymous-default-auth + WAF-as-control smell** |
@@ -173,7 +173,7 @@ upload, cross-tenant BOLA, role/authz gaps).
 ## Tests
 
 ```bash
-python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 126 tests
+python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 135 tests
 ```
 
 ## Releasing (maintainer)

{websec_validator-0.5.0 → websec_validator-0.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "websec-validator"
-version = "0.5.0"
+version = "0.6.0"
 description = "Local-first security recon that briefs your AI coding agent: facts + tailored probe scripts, code-in / artifacts-out. No LLM, no server, no running app."
 readme = "README.md"
 requires-python = ">=3.11"

{websec_validator-0.5.0 → websec_validator-0.6.0}/src/websec_validator/briefing.py

@@ -157,6 +157,7 @@ credentials** — ask the human, never fabricate, never hit production.
 - **Auth scheme:** `{auth.get("scheme","?")}` (token in {auth.get("token_location","?")})  ·  guard files: {len(auth.get("guard_files", []))}
 - **Route engine:** {routes.get("engine","?")}  ·  **{routes.get('count',0)} endpoints**  ·  by method: {routes.get("by_method", {})}
 {("> " + routes["note"]) if routes.get("note") else ""}
+{("> " + routes["coverage_warning"]) if routes.get("coverage_warning") else ""}
 
 ## 2. ★ Tenant boundary (confirm first — highest value, easiest to get wrong)
 
@@ -167,6 +168,7 @@ credentials** — ask the human, never fabricate, never hit production.
 
 ## 3. ★ Attack surface & targeting (point the probes HERE)
 
+{"_⚠ route discovery may be INCOMPLETE (see §1) — treat empty lists below as 'couldn't map', not 'nothing there'._" if routes.get("coverage_warning") else ""}
 {_section("IDOR / BOLA candidates — endpoints with a path/object id", tgt.get("idor_candidates"))}
 {_section("SSRF candidates — endpoints taking a url/domain-ish param", tgt.get("ssrf_candidates"))}
 {_section("Open-redirect candidates", tgt.get("open_redirect_candidates"))}

{websec_validator-0.5.0 → websec_validator-0.6.0}/src/websec_validator/extractors/auth.py

@@ -16,6 +16,11 @@ JWT_LIBS = re.compile(r"jsonwebtoken|\bjose\b|\bPyJWT\b|import\s+jwt\b|get_jwt_i
 PASSPORT = re.compile(r"\bpassport\b|passport-jwt|passport-local")
 SESSION = re.compile(r"express-session|cookie-session|iron-session|flask\.session|request\.session|getServerSession|getToken", re.I)
 APIKEY = re.compile(r"x-api-key|api[_-]?key|apikey", re.I)
+# HMAC-signed session cookies / payloads — the app authenticates by VERIFYING an HMAC (common in
+# Cloudflare Workers / edge via crypto.subtle.sign/verify), NOT a JWT. Without this the scheme
+# misreads as "api-key" and JWT-specific probes get staged for a no-JWT app (P2).
+HMAC_AUTH = re.compile(r"crypto\.subtle\.(?:sign|verify)|createHmac|\bhmac\.new\b|compare_digest"
+                       r"|timingSafeEqual|HMAC-SHA", re.I)
 GUARDS = re.compile(r"requireAuth|requirePermission|requireRole|isAuthenticated|@login_required|@require|ensureAuth|withAuth|getServerSession|verifyToken|authMiddleware|@roles_required|can\(|ability\.", re.I)
 # Cookie READ sites — the names the app pulls a token/session from. The forged-token probe
 # forges into these (not just Authorization: Bearer) so a cookie-ONLY session app isn't a
@@ -26,6 +31,10 @@ COOKIE_READ = re.compile(
     r"""|\.cookies\.([A-Za-z_][A-Za-z0-9_]{1,63})\b(?!\s*\()""")          # req.cookies.X (not a .get()/.set() call)
 _COOKIE_RESERVED = {"get", "set", "getall", "has", "delete", "clear", "tostring",
                     "foreach", "entries", "keys", "values", "size", "name", "value", "length"}
+# Any cookie usage at all (set/read/header) — qualifies an HMAC app as cookie-SESSION vs webhook-only,
+# even when the exact cookie name isn't captured by COOKIE_READ (e.g. a Worker parsing the Cookie header).
+COOKIE_PRESENT = re.compile(r"set-cookie|getCookie|setCookie|req\.cookies|\.cookies\b|c\.req\.cookie"
+                            r"|headers\.get\(\s*['\"]cookie|document\.cookie", re.I)
 
 # Insecure DEFAULT signing secret — a hard-coded fallback on a secret/key var (the forgeable-JWT
 # class, REF-PENTEST #8). JS/TS: `process.env.JWT_SECRET || 'dev-secret-do-not-use-in-prod'`;
@@ -63,11 +72,12 @@ class AuthExtractor(Extractor):
         auth_eps = (routes.get("targeting") or {}).get("auth_endpoints", [])
 
         # scheme: framework/route signals first, then grep
-        jwt = passport = session = apikey = 0
+        jwt = passport = session = apikey = hmac = 0
         guard_files = []
         cookie_names: list[str] = []
         secret_defaults: list = []          # (file, literal) hard-coded fallback signing secrets
         jwt_sign_verify = False             # does the repo actually sign/verify JWTs?
+        cookie_present = False              # any cookie usage (qualifies HMAC as cookie-session)
         for _p, rel, text in ctx.iter_code():
             if JWT_LIBS.search(text):
                 jwt += 1
@@ -77,6 +87,8 @@ class AuthExtractor(Extractor):
                 session += 1
             if APIKEY.search(text):
                 apikey += 1
+            if HMAC_AUTH.search(text):
+                hmac += 1
             if GUARDS.search(text) and len(guard_files) < 25:
                 guard_files.append(rel)
             if len(cookie_names) < 20:
@@ -86,6 +98,8 @@ class AuthExtractor(Extractor):
                         cookie_names.append(name)
             if JWT_SIGN_VERIFY.search(text):
                 jwt_sign_verify = True
+            if not cookie_present and COOKIE_PRESENT.search(text):
+                cookie_present = True
             if not _looks_like_example(rel):
                 for mm in SECRET_DEFAULT_JS.finditer(text):
                     secret_defaults.append((rel, mm.group(1)))
@@ -112,11 +126,16 @@ class AuthExtractor(Extractor):
         # that also wires Passport for SSO must read as primary=jwt, not passport
         # (Passport is often SSO-only). Priority: nextauth > jwt > session > passport > api-key.
         route_count = len(routes.get("endpoints", []))
+        # an HMAC-signed cookie is a real session mechanism — rank it above api-key (an x-api-key may
+        # just be a secondary admin header), but below JWT/nextauth.
+        hmac_cookie = bool(hmac and (cookie_names or session or cookie_present))
         detected = []
         if nextauth:
             detected.append("nextauth (session JWT in cookie)")
         if jwt:
             detected.append("jwt (bearer)")
+        if hmac_cookie:
+            detected.append("hmac-signed-cookie")
         if session:
             detected.append("session-cookie")
         if passport:
@@ -124,7 +143,7 @@ class AuthExtractor(Extractor):
         if apikey:
             detected.append("api-key")
         primary = detected[0] if detected else "unknown"
-        token_location = ("cookie" if primary.startswith("nextauth") or primary.startswith("session")
+        token_location = ("cookie" if primary.startswith(("nextauth", "session", "hmac"))
                           else "bearer" if primary.startswith("jwt")
                           else "header" if primary.startswith("api-key")
                           else "cookie-or-bearer" if primary.startswith("passport") else "unknown")
@@ -136,7 +155,7 @@ class AuthExtractor(Extractor):
             "login_endpoints": auth_eps,
             "cookie_names": cookie_names[:15],
             "guard_files": guard_files,
-            "signal_counts": {"jwt": jwt, "passport": passport, "session": session, "api_key": apikey},
+            "signal_counts": {"jwt": jwt, "passport": passport, "session": session, "api_key": apikey, "hmac": hmac},
             "insecure_secret_defaults": insecure_secret_defaults,   # CRITICAL-class (forgeable JWT #8)
             "jwt_sign_verify_present": jwt_sign_verify,
             "route_count": route_count,

{websec_validator-0.5.0 → websec_validator-0.6.0}/src/websec_validator/extractors/routes.py

@@ -138,12 +138,45 @@ def _normalize_noir(eps: list) -> tuple:
     return rows, spec
 
 
-# ---- regex fallback (only when Noir is absent) ---------------------------------------------
+# ---- generic router-call heuristic (ALWAYS runs — SUPPLEMENTS Noir + powers the fallback) ----
+# Noir collapses hand-rolled routers (itty-router / Hono / Cloudflare Workers / custom dispatch) to
+# ~1 endpoint; this fills the gap. Matches `<obj>.<verb>('/path', handler)` for ANY object name, and
+# Hono's `<obj>.on('METHOD','/path')`. The leading-'/' on the path is the FP guard — so `arr.get('x')`
+# / `el.on('click')` / `cache.get('k')` are NOT mistaken for routes.
+ROUTER_CALL = re.compile(
+    r"\b\w+\.(get|post|put|patch|delete|head|options|all)\s*\(\s*['\"`](/[^'\"`]*)['\"`]", re.I)
+ROUTER_ON = re.compile(r"\b\w+\.on\s*\(\s*['\"]([A-Za-z]+)['\"]\s*,\s*['\"`](/[^'\"`]*)['\"`]")
+# "handler-ish" signatures — ONLY for the coverage-confidence warning (handlers >> routes ⇒ discovery
+# likely incomplete). Express (req,res), Hono/itty (c)=>, Workers fetch entrypoints.
+HANDLER_SIG = re.compile(
+    r"\(\s*req\s*,\s*res\b|\(\s*request\s*,\s*(?:res|reply|env|ctx|context)\b|\(\s*c\s*\)\s*=>"
+    r"|async\s*\(\s*c\s*\)|\(\s*ctx\s*\)\s*=>|export\s+default\s*\{[^}]*\bfetch\b"
+    r"|addEventListener\(\s*['\"]fetch['\"]", re.I)
+
+
+def _router_calls(ctx: RepoContext) -> list:
+    rows = []
+    for _p, rel, text in ctx.iter_code():
+        for verb, path in ROUTER_CALL.findall(text):
+            rows.append({"method": "ANY" if verb.lower() == "all" else verb.upper(), "path": path,
+                         "params": [], "technology": "router", "code_path": rel, "source": "router-heuristic"})
+        for method, path in ROUTER_ON.findall(text):
+            rows.append({"method": method.upper(), "path": path, "params": [],
+                         "technology": "router", "code_path": rel, "source": "router-heuristic"})
+    return rows
+
+
+def _handler_signal_count(ctx: RepoContext) -> int:
+    return sum(len(HANDLER_SIG.findall(text)) for _p, _rel, text in ctx.iter_code())
+
+
+# ---- regex fallback (Noir absent — decorator/file frameworks the heuristic doesn't cover) ----
 
 def _fallback(ctx: RepoContext) -> list:
     rows = []
     rows += _fallback_next_app_router(ctx)
     rows += _fallback_regex(ctx)
+    rows += _router_calls(ctx)           # generic router calls (Express/itty/Hono/Workers)
     # clean + filter noise + de-dup on (method, path)
     seen, out = set(), []
     for r in rows:
@@ -178,13 +211,9 @@ def _fallback_next_app_router(ctx: RepoContext) -> list:
 
 def _fallback_regex(ctx: RepoContext) -> list:
     rows = []
-    express = re.compile(r"\b(?:router|app)\.(get|post|put|patch|delete)\s*\(\s*['\"`]([^'\"`]+)")
     flask = re.compile(r"@\w+\.route\s*\(\s*['\"]([^'\"]+)['\"](?:.*methods\s*=\s*\[([^\]]*)\])?", re.S)
     fastapi = re.compile(r"@\w+\.(get|post|put|patch|delete)\s*\(\s*['\"]([^'\"]+)")
     for _p, rel, text in ctx.iter_code():
-        for verb, path in express.findall(text):
-            rows.append({"method": verb.upper(), "path": path, "params": [],
-                         "technology": "express", "code_path": rel, "source": "fallback"})
         for verb, path in fastapi.findall(text):
             rows.append({"method": verb.upper(), "path": path, "params": [],
                          "technology": "fastapi", "code_path": rel, "source": "fallback"})
@@ -245,11 +274,38 @@ class RoutesExtractor(Extractor):
         # SKIP_DIRS is matched RELATIVE to the scan root (a skip-named ANCESTOR must not nuke
         # the whole route list).
         routes = [r for r in routes if not _in_skip_dir(r.get("code_path", ""), ctx.root)]
+
+        # P1: when NOIR produced the routes, SUPPLEMENT with the generic router-call heuristic — Noir
+        # collapses hand-rolled routers (itty/Hono/Workers) to ~1 endpoint, so without this the entire
+        # dynamic half no-ops. (The fallback path already includes the heuristic.) Dedupe on (method,path).
+        if eps:
+            existing = {(r["method"], r["path"]) for r in routes}
+            _excl = getattr(ctx, "excludes", None)
+            for r in _router_calls(ctx):
+                r["path"] = _clean_path(r["path"])
+                if _is_noise(r["path"]) or _in_skip_dir(r.get("code_path", ""), ctx.root):
+                    continue
+                if _excl and ctx._excluded(r.get("code_path", "")):
+                    continue
+                k = (r["method"], r["path"])
+                if k not in existing:
+                    existing.add(k)
+                    routes.append(r)
+
         by_method: dict = {}
         by_tech: dict = {}
         for r in routes:
             by_method[r["method"]] = by_method.get(r["method"], 0) + 1
             by_tech[r["technology"]] = by_tech.get(r["technology"], 0) + 1
+        # P1: surface-coverage confidence — many handler-ish fns but few routes ⇒ discovery likely
+        # INCOMPLETE (hand-rolled / dynamic routing). An empty §3 then means "unmapped", not "clean".
+        handler_sigs = _handler_signal_count(ctx)
+        coverage_warning = None
+        if handler_sigs >= 5 and len(routes) <= handler_sigs // 3:
+            coverage_warning = (f"⚠ surface-coverage: mapped {len(routes)} route(s) but found ~{handler_sigs} "
+                                "handler-ish function(s) — route discovery is likely INCOMPLETE (a hand-rolled or "
+                                "dynamic router the engine can't follow). Treat empty §3 candidate lists as "
+                                "\"couldn't map\", NOT \"nothing there\" — map routes by hand before trusting the probes.")
         out = {
             "engine": engine,
             "count": len(routes),
@@ -257,6 +313,8 @@ class RoutesExtractor(Extractor):
             "by_technology": by_tech,
             "endpoints": routes,
             "targeting": _derive(routes),
+            "handler_signals": handler_sigs,
+            "coverage_warning": coverage_warning,
         }
         if spec_derived:
             from collections import Counter

{websec_validator-0.5.0 → websec_validator-0.6.0}/src/websec_validator/extractors/stack.py

@@ -8,6 +8,8 @@ result is stashed on ctx.stack for later extractors.
 
 from __future__ import annotations
 
+import re
+
 from .base import Extractor, RepoContext
 
 NODE_FRAMEWORKS = {"express": "express", "fastify": "fastify", "koa": "koa",
@@ -68,11 +70,38 @@ class StackExtractor(Extractor):
         if ctx.glob("**/Gemfile", 1):
             langs.add("ruby")
 
+        # P5: managed-platform config (wrangler / vercel / netlify / serverless) declares the framework
+        # + datastore + cron surface that package.json deps don't reveal — so a KV/Workers app no
+        # longer reads as `datastores: ?` (which down-ranks SQLi noise) and the cron surface is shown.
+        cron_triggers: list = []
+        wrangler = ctx.manifest("wrangler.jsonc") + ctx.manifest("wrangler.toml") + ctx.manifest("wrangler.json")
+        if wrangler:
+            frameworks.add("cloudflare-workers")
+            if re.search(r"kv_namespaces|KVNamespace", wrangler, re.I):
+                datastores.add("cloudflare-kv")
+            if re.search(r"d1_databases|D1Database", wrangler, re.I):
+                datastores.add("sqlite")                 # D1 is SQLite-backed
+            if re.search(r"r2_buckets|R2Bucket", wrangler, re.I):
+                datastores.add("r2-object-store")
+            if re.search(r"durable_objects|DurableObjectNamespace", wrangler, re.I):
+                datastores.add("durable-objects")
+            for mm in re.finditer(r"crons?\s*[=:]\s*\[([^\]]*)\]", wrangler):
+                cron_triggers += re.findall(r"['\"]([^'\"]+)['\"]", mm.group(1))
+        vercel = ctx.manifest("vercel.json")
+        if vercel:
+            frameworks.add("vercel")
+            cron_triggers += re.findall(r'"schedule"\s*:\s*"([^"]+)"', vercel)
+        if ctx.manifest("netlify.toml"):
+            frameworks.add("netlify")
+        if ctx.manifest("serverless.yml") + ctx.manifest("serverless.yaml"):
+            frameworks.add("serverless")
+
         result = {
             "languages": sorted(langs),
             "frameworks": sorted(frameworks),
             "package_managers": sorted(managers),
             "datastores": sorted(datastores),
+            "cron_triggers": sorted(set(cron_triggers)),
             "monorepo": len(pkgs) > 1 or ctx.exists("pnpm-workspace.yaml", "lerna.json", "nx.json", "turbo.json"),
             "services": len(pkgs),
         }

{websec_validator-0.5.0 → websec_validator-0.6.0}/src/websec_validator/extractors/surface.py

@@ -44,6 +44,13 @@ SINKS = {
         r"libxmljs\.parseXml\s*\(|lxml\.etree\.(?:parse|fromstring|XML)\s*\(|xml\.etree\.ElementTree\.(?:parse|fromstring)\s*\(|new\s+DOMParser")),
     "prototype-pollution": ("mass-assignment", None, re.compile(
         r"(?:_\.merge|_\.mergeWith|_\.defaultsDeep|Object\.assign)\s*\([^)]*(?:req\.|request\.)|\.update\s*\([^)]*request\.(?:json|get_json|form)")),
+    # Mass-assignment via object SPREAD — `{...record, ...req.body}` lets the client overwrite ANY
+    # field of the persisted record (role/tier/isAdmin → privilege escalation; the tier-downgrade
+    # class). User-input marker is inline → no gate. Precise double-spread/Object.assign forms only.
+    "mass-assignment": ("mass-assignment", None, re.compile(
+        r"\{\s*\.\.\.[\w.$]+\s*,\s*\.\.\.(?:(?:req\w*|request|ctx|c)\.(?:body|json|payload|data|params|query)"
+        r"|body|reqBody|requestBody|userInput|updates|patch)\b"
+        r"|Object\.assign\s*\(\s*[\w.$]+\s*,\s*(?:req|request|ctx|c)\.(?:body|json|payload|data)\b")),
     "redos": ("ssrf-probes", None, re.compile(
         r"new\s+RegExp\s*\([^)]*(?:req\.|request\.|\+)|re\.(?:compile|match|search|fullmatch)\s*\([^,)]*(?:request\.|f['\"])")),
     "eval-injection": ("bola-write-verbs", None, re.compile(

{websec_validator-0.5.0 → websec_validator-0.6.0}/src/websec_validator/extractors/transport_security.py

@@ -37,6 +37,9 @@ HSTS_PRELOAD = re.compile(r"\bpreload\b", re.I)
 # spot the "HSTS on /api but not the page" partial-coverage smell — heuristic, framed as "verify".
 API_SCOPED = re.compile(r"(?:^|/)(?:api|routes?|server|lambda|handler|functions?|controllers?)(?:/|\.|$)", re.I)
 HTML_SURFACE = re.compile(r"\.(?:html|tsx|jsx|vue|svelte|astro)$|_document|app/layout|index\.html", re.I)
+# HTML built/served in CODE (a Worker / server-rendered app emitting template-literal HTML) — so CSP
+# applies even with no frontend framework. This is the gap that missed a Cloudflare Worker's CSP.
+HTML_CONTENT = re.compile(r"<!DOCTYPE\s+html|<html[\s>]|text/html|res\.send\(\s*[`'\"]\s*<|c\.html\(", re.I)
 FRONTEND_FW = {"react", "next", "nextjs", "vue", "nuxt", "svelte", "sveltekit", "angular", "astro", "remix", "solid"}
 
 
@@ -60,7 +63,7 @@ class TransportSecurityExtractor(Extractor):
                                "netlify.toml", "public/_headers", "static/_headers", "nginx.conf"))
 
         for _p, rel, text in ctx.iter_code():
-            if HTML_SURFACE.search(rel):
+            if HTML_SURFACE.search(rel) or HTML_CONTENT.search(text):
                 html_surface = True
             blob = text
             if CSP_ANY.search(blob):

{websec_validator-0.5.0 → websec_validator-0.6.0}/src/websec_validator/findings.py

@@ -319,7 +319,8 @@ def build_ledger(facts: dict, unified: dict | None, dynamic: dict | None = None,
     # On a purely-NoSQL datastore, classic SQL-injection alerts are almost always FPs —
     # down-rank them (the inflation the field test flagged) rather than ranking them MEDIUM.
     _ds = {d.lower() for d in (facts.get("stack", {}).get("datastores") or [])}
-    _nosql = {"dynamodb", "dynamo", "mongodb", "mongo", "firestore", "cosmos", "cosmosdb", "couchdb", "cassandra"}
+    _nosql = {"dynamodb", "dynamo", "mongodb", "mongo", "firestore", "cosmos", "cosmosdb", "couchdb",
+              "cassandra", "cloudflare-kv", "kv", "durable-objects", "r2-object-store", "redis"}
     # Include the ORM-ish labels stack.py actually emits (prisma(sql)/sql-orm) — and treat any label
     # CONTAINING "sql" (but not "nosql") as SQL — so a SQL-ORM app + Mongo isn't misread as nosql-only
     # and its SQLi findings wrongly down-ranked.

{websec_validator-0.5.0 → websec_validator-0.6.0}/src/websec_validator/probes.py

@@ -65,9 +65,11 @@ PROBES = {
                        "a TEST account token + CURRENT_PW + the set-password path(s)"),
 }
 
-# unauth-baseline is ALWAYS staged: it's the cheapest probe and directly exercises the
-# #1 lead class (missing authentication) — the one a no-creds run can confirm immediately.
-ALWAYS = ["unauth-baseline", "forged-token", "jwt-attacks", "hs256-brute-force", "rate-limit-burst"]
+# Truly universal probes — cheapest, exercise the #1 lead class (missing authentication) + rate
+# limits on any HTTP app. The AUTH-SCHEME-SPECIFIC probes (forged-token / jwt-attacks / hs256) are
+# staged in applicable() ONLY when the detected scheme justifies them (P2 — JWT probes on a no-JWT
+# app are noise that erodes trust).
+ALWAYS = ["unauth-baseline", "rate-limit-burst"]
 
 # which targeting bucket each probe should be pointed at (for the manifest's real targets)
 _TARGET_KEYS = {
@@ -114,6 +116,17 @@ def applicable(facts: dict) -> list:
     targeting = (facts.get("routes") or {}).get("targeting", {})
     tenant = (facts.get("tenant") or {}).get("candidates")
 
+    # P2: stage AUTH probes by the DETECTED scheme. forged-token forges an unsigned token into the
+    # bearer OR the signed cookie (fits JWT and HMAC-cookie apps); jwt-attacks/hs256 are JWT-specific
+    # and must NOT be staged for a no-JWT app.
+    auth = facts.get("auth") or {}
+    sc = auth.get("signal_counts") or {}
+    if (sc.get("jwt") or sc.get("session") or sc.get("hmac") or auth.get("cookie_names")
+            or str(auth.get("scheme", "")).startswith(("nextauth", "jwt", "hmac", "session", "passport"))):
+        chosen += ["forged-token"]
+    if sc.get("jwt") or auth.get("jwt_sign_verify_present"):
+        chosen += ["jwt-attacks", "hs256-brute-force"]
+
     if targeting.get("write_endpoints"):
         chosen += ["mass-assignment"]
     if tenant:

{websec_validator-0.5.0 → websec_validator-0.6.0}/src/websec_validator/scanners.py

@@ -221,6 +221,35 @@ def _aws_secret_tier(secret: str, match: str):
     return None, None
 
 
+# P4: name a secret by its provider PREFIX (so triage isn't "generic, verify") and tier by whether
+# the prefix denotes a real SECRET. A NAMED live-provider secret is HIGH, not MEDIUM-generic — and the
+# remediation ORDER matters: rotate FIRST (gitignoring or deleting a committed key does NOT scrub it
+# from pushed history — anyone who cloned still has it). Prefix-keyed → cloud-agnostic.
+_ROTATE = " — ROTATE at the provider FIRST; deleting/gitignoring a committed key does NOT scrub pushed history (use BFG/git-filter-repo after rotating)."
+_PROVIDER_PREFIXES = [
+    (re.compile(r"\bwhsec_[A-Za-z0-9]{16,}"), "HIGH", "Stripe/svix webhook signing secret (whsec_)"),
+    (re.compile(r"\bsk_live_[A-Za-z0-9]{16,}"), "HIGH", "Stripe LIVE secret key (sk_live_)"),
+    (re.compile(r"\brk_live_[A-Za-z0-9]{16,}"), "HIGH", "Stripe restricted LIVE key (rk_live_)"),
+    (re.compile(r"\bsk_test_[A-Za-z0-9]{16,}"), "LOW", "Stripe TEST secret key (sk_test_ — sandbox)"),
+    (re.compile(r"\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{30,}|\bgithub_pat_[A-Za-z0-9_]{40,}"), "HIGH", "GitHub token (gh*_/github_pat_)"),
+    (re.compile(r"\bglpat-[A-Za-z0-9_\-]{20,}"), "HIGH", "GitLab personal access token (glpat-)"),
+    (re.compile(r"\bxox[baprs]-[A-Za-z0-9-]{10,}"), "HIGH", "Slack token (xox*-)"),
+    (re.compile(r"\bSG\.[A-Za-z0-9_\-]{16,}\.[A-Za-z0-9_\-]{16,}"), "HIGH", "SendGrid API key (SG.)"),
+    (re.compile(r"\bnpm_[A-Za-z0-9]{36}\b"), "HIGH", "npm access token (npm_)"),
+    (re.compile(r"\bdop_v1_[a-f0-9]{64}\b"), "HIGH", "DigitalOcean token (dop_v1_)"),
+    (re.compile(r"\bshpat_[a-fA-F0-9]{32}\b"), "HIGH", "Shopify access token (shpat_)"),
+    (re.compile(r"\bAIza[0-9A-Za-z_\-]{35}\b"), "MEDIUM", "Google API key (AIza — often domain/API-restricted; verify scope)"),
+    (re.compile(r"\bpk_live_[A-Za-z0-9]{16,}"), "LOW", "publishable key (pk_live_ — usually PUBLIC by design; verify with the provider)"),
+]
+
+
+def _provider_secret_tier(blob: str):
+    for rx, sev, note in _PROVIDER_PREFIXES:
+        if rx.search(blob or ""):
+            return sev, note + (_ROTATE if sev in ("HIGH", "MEDIUM") else "")
+    return None, None
+
+
 # gitleaks/trivy "generic" + entropy/keyword rules are high-recall, low-precision: they fire on
 # public keys, wallet addresses, hashes, env-var refs and test fixtures about as often as real
 # credentials. Tier those to MEDIUM + a verify note (NEVER hide them) so the HIGH secret tier
@@ -271,6 +300,8 @@ def _norm_trivy(data: dict) -> list:
         for s in (res.get("Secrets") or []):
             rid = s.get("RuleID", "")
             sev, note = _aws_secret_tier(s.get("Match", ""), s.get("Code", "") or "")
+            if not sev:
+                sev, note = _provider_secret_tier(f"{s.get('Match','')} {s.get('Code','') or ''}")
             if not sev and _generic_secret(rid):
                 sev, note = "MEDIUM", _GENERIC_NOTE
             if _is_doc_or_example(tgt):
@@ -292,6 +323,8 @@ def _norm_gitleaks(data) -> list:
     for x in rows:
         f, rule = x.get("File", ""), x.get("RuleID", "")
         sev, note = _aws_secret_tier(x.get("Secret", ""), x.get("Match", ""))
+        if not sev:
+            sev, note = _provider_secret_tier(f"{x.get('Secret','')} {x.get('Match','')}")
         if not sev and _generic_secret(rule):
             sev, note = "MEDIUM", _GENERIC_NOTE
         if _is_doc_or_example(f):

{websec_validator-0.5.0 → websec_validator-0.6.0/src/websec_validator.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: websec-validator
-Version: 0.5.0
+Version: 0.6.0
 Summary: Local-first security recon that briefs your AI coding agent: facts + tailored probe scripts, code-in / artifacts-out. No LLM, no server, no running app.
 Author: Ricardo Accioly
 License: MIT
@@ -94,7 +94,7 @@ Then point your agent at the output: **"Read `websec-out/AGENT-BRIEFING.md` and
 | **authz** | access-control map | guard coverage + **write endpoints with no visible guard** + roles |
 | tenant | multi-tenancy key candidates | the BOLA boundary, by frequency |
 | **password_policy** | cross-route consistency **+ reuse/history** | complexity drift across routes **+ a set-password path that hashes without a reuse check** |
-| surface | 14 sink classes **+ redirect-SSRF** | user-input-gated sinks + var-arg SSRF + error-disclosure **+ follows-redirects-without-per-hop-guard** |
+| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure **+ follows-redirects-without-per-hop-guard** |
 | **upload_security** | unrestricted upload + unsafe serve | deny-list-only, stored-name-from-filename, trust-client-MIME, accept-SVG, **serve without `nosniff`** |
 | schemas | data models + **privileged fields** | Pydantic/SQLAlchemy/Django/Prisma/Mongoose/TypeORM/Zod → `role`/`isAdmin`/`groupId` for mass-assignment targeting |
 | iac_ci | IaC + CI/CD | GHA injection, unpinned actions, tfstate, **CDK AppSync `API_KEY` anonymous-default-auth + WAF-as-control smell** |
@@ -185,7 +185,7 @@ upload, cross-tenant BOLA, role/authz gaps).
 ## Tests
 
 ```bash
-python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 126 tests
+python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 135 tests
 ```
 
 ## Releasing (maintainer)

{websec_validator-0.5.0 → websec_validator-0.6.0}/tests/test_hardening.py

@@ -209,10 +209,18 @@ class WriteAuthEnforcement500Tests(unittest.TestCase):
 
 
 class ProbeRegistrationTests(unittest.TestCase):
-    def test_forged_token_always_staged(self):
-        self.assertIn("forged-token", probes.ALWAYS)
+    def test_auth_probes_gated_by_scheme(self):
+        # P2: forged-token forges into bearer OR signed cookie → staged for token/cookie auth, NOT
+        # for an app with no detected auth scheme. JWT-specific probes need actual JWT presence.
         self.assertIn("forged-token", probes.PROBES)
-        self.assertIn("forged-token", probes.applicable({"routes": {"targeting": {}}}))
+        self.assertIn("forged-token", probes.applicable({"auth": {"signal_counts": {"jwt": 2}}}))
+        self.assertIn("forged-token", probes.applicable(
+            {"auth": {"scheme": "hmac-signed-cookie", "signal_counts": {"hmac": 3}}}))
+        self.assertNotIn("forged-token", probes.applicable({"routes": {"targeting": {}}}))
+        # jwt-attacks / hs256 only when JWT is actually present (not for an HMAC-cookie app)
+        self.assertNotIn("jwt-attacks", probes.applicable(
+            {"auth": {"signal_counts": {"hmac": 3}, "cookie_names": ["sid"]}}))
+        self.assertIn("hs256-brute-force", probes.applicable({"auth": {"signal_counts": {"jwt": 2}}}))
 
     def test_context_has_reads(self):
         ctx = probes.build_context({"routes": {"endpoints": [

{websec_validator-0.5.0 → websec_validator-0.6.0}/tests/test_pentest_regressions.py

@@ -558,5 +558,61 @@ class FalsePositiveRegressionTests(unittest.TestCase):
         self.assertEqual(ctv["file"], "app/Pay.tsx")
 
 
+class AuthSchemeTests(unittest.TestCase):
+    """P2: HMAC-signed cookies must not misread as api-key (which staged JWT probes for a no-JWT app)."""
+
+    def test_hmac_cookie_not_mislabeled_apikey(self):
+        out = AuthExtractor().extract(repo({"src/auth.ts":
+            "const sig = await crypto.subtle.sign('HMAC', key, data);\n"
+            "const c = getCookie(req, 'session');\nres.headers.set('Set-Cookie', cookie);\n"
+            "const k = req.headers.get('x-api-key');\n"}), {})
+        self.assertEqual(out["scheme"], "hmac-signed-cookie")
+        self.assertEqual(out["token_location"], "cookie")
+        self.assertEqual(out["signal_counts"]["hmac"], 1)
+
+    def test_jwt_app_stays_jwt(self):
+        out = AuthExtractor().extract(repo({"src/a.ts": "import jwt from 'jsonwebtoken';\njwt.verify(t, S);\n"}), {})
+        self.assertTrue(out["scheme"].startswith("jwt"))
+
+
+class StaticCheckP3Tests(unittest.TestCase):
+    """P3: CSP linter fires for SERVER-RENDERED / template-literal HTML (not just frontend frameworks);
+    mass-assignment via object spread `{...record, ...req.body}`."""
+
+    def test_csp_fires_for_worker_template_html(self):
+        out = TransportSecurityExtractor().extract(repo({"src/index.ts":
+            "const html = `<!DOCTYPE html><html><body>hi</body></html>`;\n"
+            "return new Response(html, {headers: {'content-type': 'text/html',\n"
+            "  'Content-Security-Policy': \"script-src 'self' 'unsafe-inline'\"}});\n"}), {})
+        self.assertTrue(out["html_surface"])                 # template HTML counts — no framework needed
+        self.assertTrue(any(f["attack_class"] == "missing-csp" for f in out["findings"]))
+
+    def test_mass_assignment_via_spread(self):
+        out = SurfaceExtractor().extract(repo({"src/h.ts":
+            "const saved = {...record, ...req.body};\nawait db.put(saved);\n"}), {})
+        self.assertIn("mass-assignment", out["sinks"])
+        # benign spreads don't fire
+        clean = SurfaceExtractor().extract(repo({"src/h.ts": "const s = {...defaults, ...config};\n"}), {})
+        self.assertNotIn("mass-assignment", clean["sinks"])
+
+
+class ProviderSecretTierTests(unittest.TestCase):
+    """P4: name a secret by provider PREFIX (HIGH + rotation order), not 'MEDIUM generic, verify'."""
+
+    def test_provider_prefixes_tiered_and_named(self):
+        self.assertEqual(scanners._provider_secret_tier("whsec_" + "a" * 20)[0], "HIGH")
+        self.assertEqual(scanners._provider_secret_tier("sk_live_" + "a" * 20)[0], "HIGH")
+        self.assertEqual(scanners._provider_secret_tier("sk_test_" + "a" * 20)[0], "LOW")   # sandbox
+        self.assertEqual(scanners._provider_secret_tier("pk_live_" + "a" * 20)[0], "LOW")   # public by design
+        self.assertIsNone(scanners._provider_secret_tier("just-random-entropy")[0])
+
+    def test_named_provider_key_is_high_not_generic_via_gitleaks(self):
+        row = scanners._norm_gitleaks({"findings": [{"File": "cfg.ts", "RuleID": "generic-api-key",
+              "Secret": "sk_live_" + "a" * 20, "Match": "sk_live_...", "StartLine": 1}]})[0]
+        self.assertEqual(row["severity"], "HIGH")
+        self.assertIn("Stripe", row["title"])
+        self.assertIn("ROTATE", row["title"])
+
+
 if __name__ == "__main__":
     unittest.main()

{websec_validator-0.5.0 → websec_validator-0.6.0}/tests/test_recon.py

@@ -45,6 +45,15 @@ class StackTests(unittest.TestCase):
         self.assertIn("python", f["languages"])
         self.assertIn("flask", f["frameworks"])
 
+    def test_wrangler_config_detects_kv_and_workers(self):
+        # P5: managed-platform config reveals framework + datastore that deps don't (KV ⇒ down-rank SQLi).
+        d = Path(tempfile.mkdtemp())
+        (d / "wrangler.jsonc").write_text('{ "name": "x", "kv_namespaces": [{"binding": "CACHE"}] }\n')
+        (d / "src.ts").write_text("export default { fetch() {} };\n")
+        out = StackExtractor().extract(RepoContext(d), {})
+        self.assertIn("cloudflare-workers", out["frameworks"])
+        self.assertIn("cloudflare-kv", out["datastores"])
+
 
 class AuthTests(unittest.TestCase):
     def test_python_jwt(self):
@@ -364,6 +373,34 @@ class RouteUnitTests(unittest.TestCase):
         self.assertIn(("GET", "/api/users/{id}"), paths)
         self.assertIn(("POST", "/api/groups/{groupId}/items"), paths)
 
+    def test_router_heuristic_catches_modern_routers_and_guards_fps(self):
+        # P1: generic router-call heuristic — hand-rolled / itty / Hono / Workers, ANY object name.
+        d = Path(tempfile.mkdtemp())
+        (d / "index.ts").write_text(
+            "router.get('/api/health', h);\n"
+            "api.post('/api/todos/:id', h);\n"
+            "r.delete('/api/items/:id', h);\n"
+            "app.on('PUT', '/api/users/:id', h);\n"
+            "const cache = new Map(); cache.get('lookup-key');\n"   # FP guard: no leading slash
+            "btn.on('click', fn);\n")                                # FP guard: .on(non-method, non-path)
+        paths = {(r["method"], r["path"]) for r in routes._router_calls(RepoContext(d))}
+        self.assertIn(("GET", "/api/health"), paths)
+        self.assertIn(("POST", "/api/todos/:id"), paths)
+        self.assertIn(("DELETE", "/api/items/:id"), paths)
+        self.assertIn(("PUT", "/api/users/:id"), paths)
+        self.assertNotIn(("GET", "lookup-key"), paths)              # cache.get('lookup-key') is not a route
+        self.assertFalse(any("click" in p for _, p in paths))      # btn.on('click') is not a route
+
+    def test_coverage_warning_when_handlers_outnumber_routes(self):
+        # P1: many handler-ish fns but ~0 mapped routes ⇒ coverage warning (the hand-rolled-router failure mode).
+        d = Path(tempfile.mkdtemp())
+        (d / "w.ts").write_text(
+            "export default { fetch(request, env, ctx) { return dispatch(request); } };\n"
+            + "".join(f"const h{i} = (req, res) => res.end();\n" for i in range(8)))
+        out = routes.RoutesExtractor().extract(RepoContext(d), {})
+        self.assertIsNotNone(out["coverage_warning"])
+        self.assertIn("INCOMPLETE", out["coverage_warning"])
+
 
 class DedupTests(unittest.TestCase):
     def test_within_tool_dedup_and_counts(self):