websec-validator 0.6.0__tar.gz → 0.6.2__tar.gz

{websec_validator-0.6.0/src/websec_validator.egg-info → websec_validator-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: websec-validator
-Version: 0.6.0
+Version: 0.6.2
 Summary: Local-first security recon that briefs your AI coding agent: facts + tailored probe scripts, code-in / artifacts-out. No LLM, no server, no running app.
 Author: Ricardo Accioly
 License: MIT
@@ -185,7 +185,7 @@ upload, cross-tenant BOLA, role/authz gaps).
 ## Tests
 
 ```bash
-python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 135 tests
+python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 139 tests
 ```
 
 ## Releasing (maintainer)

{websec_validator-0.6.0 → websec_validator-0.6.2}/README.md

@@ -173,7 +173,7 @@ upload, cross-tenant BOLA, role/authz gaps).
 ## Tests
 
 ```bash
-python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 135 tests
+python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 139 tests
 ```
 
 ## Releasing (maintainer)

{websec_validator-0.6.0 → websec_validator-0.6.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "websec-validator"
-version = "0.6.0"
+version = "0.6.2"
 description = "Local-first security recon that briefs your AI coding agent: facts + tailored probe scripts, code-in / artifacts-out. No LLM, no server, no running app."
 readme = "README.md"
 requires-python = ">=3.11"

{websec_validator-0.6.0 → websec_validator-0.6.2}/src/websec_validator/briefing.py

@@ -83,6 +83,15 @@ def render(facts: dict, scanners: dict, scan_results: list, probe_manifest: list
     pii_section = ("\n".join(f"- **{f.get('severity')}** {f.get('kind')} — `{f.get('file')}`" for f in pii_findings[:20])
                    if pii_findings else "_no obvious raw-PII responses / dead masking controls_")
     ws_line = (facts.get("client_integrity", {}) or {}).get("websocket_auth", "no websocket detected")
+    _cs = (facts.get("transport_security", {}) or {}).get("cookie_security")
+    if _cs:
+        if _cs.get("httponly") and _cs.get("secure") and _cs.get("samesite"):
+            cookie_line = "✓ HttpOnly + Secure + SameSite present (checked — verify against the live Set-Cookie)"
+        else:
+            _miss = [n for n, k in (("HttpOnly", "httponly"), ("Secure", "secure"), ("SameSite", "samesite")) if not _cs.get(k)]
+            cookie_line = f"⚠ cookie set WITHOUT {', '.join(_miss)} — an auth/session cookie should be HttpOnly + Secure + SameSite"
+    else:
+        cookie_line = "_no Set-Cookie detected_"
 
     gql = facts.get("graphql", {})
     if gql.get("present"):
@@ -205,6 +214,8 @@ Production source maps exposed: {client.get("production_source_maps", False)}
 
 **WebSocket auth model (CSWSH determinant — is it an ambient cookie?):** {ws_line}
 
+**Cookie hardening (report-the-pass / gap):** {cookie_line}
+
 **File-upload security (#2b — sniff bytes, derive stored name, nosniff on serve):**
 {up_section}
 

{websec_validator-0.6.0 → websec_validator-0.6.2}/src/websec_validator/extractors/base.py

@@ -17,6 +17,7 @@ SKIP_DIRS = {".git", "node_modules", "dist", "build", ".next", ".nuxt", "venv",
              ".turbo", "out", "target", ".gradle", "vendor", "site-packages",
              ".terraform", "security", ".websec-out", "websec-out", ".cache",
              ".svelte-kit", "storybook-static", ".serverless", ".aws-sam", "cdk.out", ".sst", ".amplify",
+             ".wrangler", ".vercel",   # Cloudflare / Vercel dev-build caches (bundled output → phantom routes)
              # agent tooling + editor dirs + worktree copies — not the target app
              ".wolf", ".claude", ".worktrees", ".idea", ".vscode", ".agent", ".agents"}
 CODE_EXT = {".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py", ".go", ".rb",

{websec_validator-0.6.0 → websec_validator-0.6.2}/src/websec_validator/extractors/surface.py

@@ -44,13 +44,16 @@ SINKS = {
         r"libxmljs\.parseXml\s*\(|lxml\.etree\.(?:parse|fromstring|XML)\s*\(|xml\.etree\.ElementTree\.(?:parse|fromstring)\s*\(|new\s+DOMParser")),
     "prototype-pollution": ("mass-assignment", None, re.compile(
         r"(?:_\.merge|_\.mergeWith|_\.defaultsDeep|Object\.assign)\s*\([^)]*(?:req\.|request\.)|\.update\s*\([^)]*request\.(?:json|get_json|form)")),
-    # Mass-assignment via object SPREAD — `{...record, ...req.body}` lets the client overwrite ANY
-    # field of the persisted record (role/tier/isAdmin → privilege escalation; the tier-downgrade
-    # class). User-input marker is inline → no gate. Precise double-spread/Object.assign forms only.
+    # Mass-assignment via object SPREAD — `{...record, ...req.body}` (client overwrites ANY field) or
+    # the shorthand `{...record, tier}` (a PRIVILEGED field pulled from a same-named var — the
+    # tier-downgrade / role-escalation class). User-input marker is inline; the privileged-field list
+    # gates the shorthand form so a benign `{...state, theme}` doesn't fire.
     "mass-assignment": ("mass-assignment", None, re.compile(
         r"\{\s*\.\.\.[\w.$]+\s*,\s*\.\.\.(?:(?:req\w*|request|ctx|c)\.(?:body|json|payload|data|params|query)"
         r"|body|reqBody|requestBody|userInput|updates|patch)\b"
-        r"|Object\.assign\s*\(\s*[\w.$]+\s*,\s*(?:req|request|ctx|c)\.(?:body|json|payload|data)\b")),
+        r"|Object\.assign\s*\(\s*[\w.$]+\s*,\s*(?:req|request|ctx|c)\.(?:body|json|payload|data)\b"
+        r"|\{\s*\.\.\.[\w.$]+[^{}]{0,80}?,\s*(?:role|roles|tier|plan|isAdmin|is_admin|admin|permissions?"
+        r"|scopes?|balance|credits|owner|ownerId|isOwner|isSuperuser|superuser)\s*[,}]")),
     "redos": ("ssrf-probes", None, re.compile(
         r"new\s+RegExp\s*\([^)]*(?:req\.|request\.|\+)|re\.(?:compile|match|search|fullmatch)\s*\([^,)]*(?:request\.|f['\"])")),
     "eval-injection": ("bola-write-verbs", None, re.compile(

{websec_validator-0.6.0 → websec_validator-0.6.2}/src/websec_validator/extractors/transport_security.py

@@ -41,6 +41,12 @@ HTML_SURFACE = re.compile(r"\.(?:html|tsx|jsx|vue|svelte|astro)$|_document|app/l
 # applies even with no frontend framework. This is the gap that missed a Cloudflare Worker's CSP.
 HTML_CONTENT = re.compile(r"<!DOCTYPE\s+html|<html[\s>]|text/html|res\.send\(\s*[`'\"]\s*<|c\.html\(", re.I)
 FRONTEND_FW = {"react", "next", "nextjs", "vue", "nuxt", "svelte", "sveltekit", "angular", "astro", "remix", "solid"}
+# Cookie hardening — "report the PASS" (HttpOnly+Secure+SameSite ✓ builds trust + is a regression
+# assertion) and flag the gap. Flags are matched per cookie-setting file (lenient — a positive lead).
+SET_COOKIE = re.compile(r"set-?cookie|res\.cookie\(|cookies\.set\(|\.setCookie\(|c\.cookie\(", re.I)
+CK_HTTPONLY = re.compile(r"httponly", re.I)
+CK_SECURE = re.compile(r";\s*secure\b|\bsecure\s*[:=]\s*true|\bsecure\s*:\s*!", re.I)
+CK_SAMESITE = re.compile(r"samesite", re.I)
 
 
 class TransportSecurityExtractor(Extractor):
@@ -55,6 +61,7 @@ class TransportSecurityExtractor(Extractor):
         hsts_present = hsts_sub = hsts_preload = False
         html_surface = bool(frameworks & FRONTEND_FW)
         inline_handlers = []
+        sets_cookie = ck_httponly = ck_secure = ck_samesite = False
         hsts_files, hsts_api_only, hsts_html = [], True, False
 
         # config manifests carry headers too (next.config, vercel.json, netlify.toml, _headers)
@@ -87,6 +94,11 @@ class TransportSecurityExtractor(Extractor):
                     hsts_html = True
                 elif not API_SCOPED.search(rel):
                     hsts_api_only = False   # a non-API, non-HTML place (e.g. global edge middleware)
+            if SET_COOKIE.search(blob):
+                sets_cookie = True
+                ck_httponly = ck_httponly or bool(CK_HTTPONLY.search(blob))
+                ck_secure = ck_secure or bool(CK_SECURE.search(blob))
+                ck_samesite = ck_samesite or bool(CK_SAMESITE.search(blob))
 
         if CSP_ANY.search(manifests):
             csp_present = True
@@ -155,12 +167,28 @@ class TransportSecurityExtractor(Extractor):
                                      "detail": f"HSTS is present but missing {', '.join(gaps)} — add where the domain "
                                                "model allows (don't preload a domain whose subdomains aren't all HTTPS)."})
 
+        # 0.6.2: report the cookie-hardening PASS (✓ builds trust + is a regression assertion), or flag the gap.
+        passes, cookie_security = [], None
+        if sets_cookie:
+            cookie_security = {"httponly": ck_httponly, "secure": ck_secure, "samesite": ck_samesite}
+            if ck_httponly and ck_secure and ck_samesite:
+                passes.append("cookies set HttpOnly + Secure + SameSite (checked ✓)")
+            else:
+                miss = [n for n, ok in (("HttpOnly", ck_httponly), ("Secure", ck_secure),
+                                        ("SameSite", ck_samesite)) if not ok]
+                findings.append({"severity": "LOW", "kind": "cookie-flags", "attack_class": "insecure-cookie",
+                                 "detail": f"A cookie is set without {', '.join(miss)} — an auth/session cookie should be "
+                                           "HttpOnly (no JS read), Secure (HTTPS-only), and SameSite=Lax/Strict (CSRF). "
+                                           "Verify against the live Set-Cookie."})
+
         return {
             "web_surface": web_surface, "html_surface": html_surface,
             "csp_present": csp_present, "strict_csp": strict_csp, "csp_has_unsafe": csp_unsafe,
             "hsts_present": hsts_present, "hsts_includes_subdomains": hsts_sub, "hsts_preload": hsts_preload,
             "hsts_files": sorted(set(hsts_files))[:20],
             "inline_event_handlers": sorted(set(inline_handlers)),
+            "cookie_security": cookie_security,
+            "passes": passes,
             "findings": findings,
             "note": ("CSP/HSTS baseline audit — these are the enabling controls for the client trust boundary. "
                      "LOW/architectural: verify against the LIVE response headers (a static scan can't see the edge/CDN "

{websec_validator-0.6.0 → websec_validator-0.6.2}/src/websec_validator/findings.py

@@ -88,6 +88,8 @@ STANDARDS = {
                                  "ASVS V11.1.4", ["API4:2023 Unrestricted Resource Consumption",
                                                   "API6:2023 Unrestricted Access to Sensitive Business Flows"]),
     "redundant-secret-fetch": (["CWE-200 Information Exposure"], "ASVS V2.10", ["API8:2023 Misconfiguration"]),
+    "insecure-cookie": (["CWE-1004 Sensitive Cookie Without HttpOnly", "CWE-614 Sensitive Cookie Without Secure"],
+                        "ASVS V3.4.1", ["API8:2023 Misconfiguration"]),
 }
 REMEDIATION = {
     "missing-auth": "Add an auth guard to the handler (e.g. requireAuth()/getServerSession()), or a "
@@ -152,6 +154,8 @@ REMEDIATION = {
     "redundant-secret-fetch": "Fetch each secret-manager key ONCE per request and reuse it; use the project's existing "
                               "secret-provider abstraction instead of a bespoke loader (smaller exposure window + "
                               "consistency).",
+    "insecure-cookie": "Set auth/session cookies `HttpOnly` (blocks JS/XSS theft) + `Secure` (HTTPS-only) + "
+                       "`SameSite=Lax`/`Strict` (CSRF). Verify against the live Set-Cookie header.",
 }
 _DEFAULT_REM = "Review and remediate per the cited standard."
 

{websec_validator-0.6.0 → websec_validator-0.6.2/src/websec_validator.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: websec-validator
-Version: 0.6.0
+Version: 0.6.2
 Summary: Local-first security recon that briefs your AI coding agent: facts + tailored probe scripts, code-in / artifacts-out. No LLM, no server, no running app.
 Author: Ricardo Accioly
 License: MIT
@@ -185,7 +185,7 @@ upload, cross-tenant BOLA, role/authz gaps).
 ## Tests
 
 ```bash
-python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 135 tests
+python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 139 tests
 ```
 
 ## Releasing (maintainer)

{websec_validator-0.6.0 → websec_validator-0.6.2}/tests/test_pentest_regressions.py

@@ -591,9 +591,13 @@ class StaticCheckP3Tests(unittest.TestCase):
         out = SurfaceExtractor().extract(repo({"src/h.ts":
             "const saved = {...record, ...req.body};\nawait db.put(saved);\n"}), {})
         self.assertIn("mass-assignment", out["sinks"])
-        # benign spreads don't fire
-        clean = SurfaceExtractor().extract(repo({"src/h.ts": "const s = {...defaults, ...config};\n"}), {})
-        self.assertNotIn("mass-assignment", clean["sinks"])
+        # shorthand privileged-field form (the tier-downgrade case)
+        sh = SurfaceExtractor().extract(repo({"src/h.ts": "const o = {...record, tier};\n"}), {})
+        self.assertIn("mass-assignment", sh["sinks"])
+        # benign spreads / non-privileged shorthand / literal assignment don't fire
+        for benign in ("const s = {...defaults, ...config};\n", "const s = {...state, theme};\n",
+                       "const s = {...record, role: 'user'};\n"):
+            self.assertNotIn("mass-assignment", SurfaceExtractor().extract(repo({"src/h.ts": benign}), {})["sinks"])
 
 
 class ProviderSecretTierTests(unittest.TestCase):
@@ -614,5 +618,24 @@ class ProviderSecretTierTests(unittest.TestCase):
         self.assertIn("ROTATE", row["title"])
 
 
+class CookieReportPassTests(unittest.TestCase):
+    """0.6.2 report-the-passes: cookie HttpOnly+Secure+SameSite → a PASS; a missing flag → a finding."""
+
+    def test_all_flags_is_a_pass_no_finding(self):
+        out = TransportSecurityExtractor().extract(repo({"a.ts":
+            "res.headers.set('Set-Cookie', 'sid=x; HttpOnly; Secure; SameSite=Lax');\n"}), {})
+        self.assertTrue(any("HttpOnly" in p for p in out["passes"]))
+        self.assertFalse(any(f["kind"] == "cookie-flags" for f in out["findings"]))
+
+    def test_missing_flag_is_a_finding(self):
+        out = TransportSecurityExtractor().extract(repo({"a.ts": "res.cookie('sid', v, {httpOnly:true});\n"}), {})
+        self.assertTrue(any(f["attack_class"] == "insecure-cookie" for f in out["findings"]))
+
+    def test_no_cookie_no_noise(self):
+        out = TransportSecurityExtractor().extract(repo({"a.ts": "const x = 1;\n"}), {})
+        self.assertEqual(out["passes"], [])
+        self.assertIsNone(out["cookie_security"])
+
+
 if __name__ == "__main__":
     unittest.main()

{websec_validator-0.6.0 → websec_validator-0.6.2}/tests/test_recon.py

@@ -401,6 +401,17 @@ class RouteUnitTests(unittest.TestCase):
         self.assertIsNotNone(out["coverage_warning"])
         self.assertIn("INCOMPLETE", out["coverage_warning"])
 
+    def test_wrangler_build_dir_routes_excluded(self):
+        # 0.6.1: .wrangler / .vercel dev-build caches hold BUNDLED output → phantom duplicate routes.
+        d = Path(tempfile.mkdtemp())
+        (d / "src").mkdir()
+        (d / ".wrangler" / "tmp").mkdir(parents=True)
+        (d / "src" / "index.ts").write_text("router.get('/api/real', h);\n")
+        (d / ".wrangler" / "tmp" / "bundle.js").write_text("router.get('/api/phantom', h);\n")
+        paths = {e["path"] for e in routes.RoutesExtractor().extract(RepoContext(d), {})["endpoints"]}
+        self.assertIn("/api/real", paths)
+        self.assertNotIn("/api/phantom", paths)
+
 
 class DedupTests(unittest.TestCase):
     def test_within_tool_dedup_and_counts(self):