websec-validator 0.7.0__tar.gz → 0.8.0__tar.gz

{websec_validator-0.7.0/src/websec_validator.egg-info → websec_validator-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: websec-validator
-Version: 0.7.0
+Version: 0.8.0
 Summary: Defensive, local-first security recon that briefs your AI coding agent on your own codebase — read-only by default (code in, artifacts out): facts + tailored probe scripts, no LLM, no server, no running app.
 Author: Ricardo Accioly
 License: MIT
@@ -89,23 +89,24 @@ Then point your agent at the output: **"Read `websec-out/AGENT-BRIEFING.md` and
 
 > That's the whole user surface: **`run`** (plus the optional, advanced **`dynamic`** live-probing step below). `recon`/`proof`/`calibrate` exist for developing the tool itself and are hidden from `--help` — you never need them.
 
-## What it extracts (18 deterministic extractors, no LLM)
+## What it extracts (19 deterministic extractors, no LLM)
 
 | | Dimension | Notable output |
 |---|---|---|
 | stack | languages, frameworks, datastores | monorepo-aware (aggregates every manifest) |
 | routes | every endpoint via **OWASP Noir** | method · path · typed params · code path |
 | auth | scheme + login surface + **insecure-default signing secrets** | multi-scheme; flags a hard-coded `JWT_SECRET \|\| 'dev-secret'` fallback (forgeable JWT) |
-| **authz** | access-control map | guard coverage + **write endpoints with no visible guard** + roles |
+| **authz** | access-control map | guard coverage (incl. **router-mount auth**) + **write endpoints with no visible guard** + roles |
+| **authz_dataflow** | authz *correctness* (does the guard trust the right thing?) | **unsigned-cookie authorization** · **claim-keyed authz** (user-influenceable JWT claim) · **transaction-local RLS context** (resets before the query) |
 | tenant | multi-tenancy key candidates | the BOLA boundary, by frequency |
 | **password_policy** | cross-route consistency **+ reuse/history** | complexity drift across routes **+ a set-password path that hashes without a reuse check** |
-| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure **+ follows-redirects-without-per-hop-guard** |
+| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure + follows-redirects-without-per-hop-guard **+ reverse-proxy prefix-escape + host-header open-redirect + SSRF-redirect-hardening** |
 | **upload_security** | unrestricted upload + unsafe serve | deny-list-only, stored-name-from-filename, trust-client-MIME, accept-SVG, **serve without `nosniff`** |
 | schemas | data models + **privileged fields** | Pydantic/SQLAlchemy/Django/Prisma/Mongoose/TypeORM/Zod → `role`/`isAdmin`/`groupId` for mass-assignment targeting |
 | iac_ci | IaC + CI/CD | GHA injection (**run:-position-aware**), unpinned actions, tfstate, CDK AppSync `API_KEY` anonymous-default-auth, **docker-compose host-takeover (docker.sock / pid:host / privileged) + `.gitleaksignore` secret-suppression audit** |
 | client_exposure | browser leakage | public-var secrets by **name + value-shape (`da2-…`) + CDK build-injection**, server-secret-in-client, source maps |
 | **client_integrity** | tamperable display (client trust boundary) + **WS auth model** | any security-critical sink value (address/IBAN/2FA-seed/API-key/webhook) the user reads or copies, without strict CSP / out-of-band anchor **+ client-tamper-vector, grindable-fingerprint, over-claimed-control, the CSWSH determinant** |
-| **transport_security** | CSP + HSTS header baseline | missing/weak CSP, inline event handlers, **partial HSTS (set on /api but not the HTML page)** |
+| **transport_security** | CSP + HSTS + **CORS** + **SRI** baseline | missing/weak CSP, inline event handlers, partial HSTS, **CORS reflect-origin+credentials, external script without SRI, monorepo `next.config` header gap** |
 | **pii_exposure** | unmasked PII at the output boundary | `res.json(rawEntity)` with PII + **a masking control defined but with zero live call sites** (value-shape, not field-name) |
 | graphql | GraphQL surface | introspection (**AppSync `introspectionConfig: DISABLED`-aware**) / playground / depth-limit **+ AppSync subscription-authz (cross-group BOLA)** |
 | integrations | third-party + webhooks **+ outbound-action endpoints** | unsigned webhooks **+ email/SMS/push handlers with no auth or IP-only rate-limit + redundant secret-fetch** |
@@ -218,7 +219,9 @@ publisher** with project `websec-validator`, owner `raccioly`, repo `websec-vali
 
 ## Status / roadmap
 
-**Done:** 18-extractor recon (incl. schema/entity → mass-assignment targeting, the **AWS-CDK /
+**Done:** 19-extractor recon (incl. an **authz-correctness data-flow extractor** — unsigned-cookie /
+claim-keyed authz / transaction-local RLS — plus **CORS-misconfig**, **SRI**, **host-header
+open-redirect** and **SSRF-redirect-hardening** classes, schema/entity → mass-assignment targeting, the **AWS-CDK /
 managed-AppSync / VTL boundary**, **upload-security** + **PII-output-boundary** + **redirect-SSRF**
 + **password-reuse** classes, a **man-in-the-browser / tamperable-display** class, an **LLM / AI-agent
 extractor** (OWASP LLM Top 10 — prompt injection / insecure output / excessive agency / unbounded

{websec_validator-0.7.0 → websec_validator-0.8.0}/README.md

@@ -77,23 +77,24 @@ Then point your agent at the output: **"Read `websec-out/AGENT-BRIEFING.md` and
 
 > That's the whole user surface: **`run`** (plus the optional, advanced **`dynamic`** live-probing step below). `recon`/`proof`/`calibrate` exist for developing the tool itself and are hidden from `--help` — you never need them.
 
-## What it extracts (18 deterministic extractors, no LLM)
+## What it extracts (19 deterministic extractors, no LLM)
 
 | | Dimension | Notable output |
 |---|---|---|
 | stack | languages, frameworks, datastores | monorepo-aware (aggregates every manifest) |
 | routes | every endpoint via **OWASP Noir** | method · path · typed params · code path |
 | auth | scheme + login surface + **insecure-default signing secrets** | multi-scheme; flags a hard-coded `JWT_SECRET \|\| 'dev-secret'` fallback (forgeable JWT) |
-| **authz** | access-control map | guard coverage + **write endpoints with no visible guard** + roles |
+| **authz** | access-control map | guard coverage (incl. **router-mount auth**) + **write endpoints with no visible guard** + roles |
+| **authz_dataflow** | authz *correctness* (does the guard trust the right thing?) | **unsigned-cookie authorization** · **claim-keyed authz** (user-influenceable JWT claim) · **transaction-local RLS context** (resets before the query) |
 | tenant | multi-tenancy key candidates | the BOLA boundary, by frequency |
 | **password_policy** | cross-route consistency **+ reuse/history** | complexity drift across routes **+ a set-password path that hashes without a reuse check** |
-| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure **+ follows-redirects-without-per-hop-guard** |
+| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure + follows-redirects-without-per-hop-guard **+ reverse-proxy prefix-escape + host-header open-redirect + SSRF-redirect-hardening** |
 | **upload_security** | unrestricted upload + unsafe serve | deny-list-only, stored-name-from-filename, trust-client-MIME, accept-SVG, **serve without `nosniff`** |
 | schemas | data models + **privileged fields** | Pydantic/SQLAlchemy/Django/Prisma/Mongoose/TypeORM/Zod → `role`/`isAdmin`/`groupId` for mass-assignment targeting |
 | iac_ci | IaC + CI/CD | GHA injection (**run:-position-aware**), unpinned actions, tfstate, CDK AppSync `API_KEY` anonymous-default-auth, **docker-compose host-takeover (docker.sock / pid:host / privileged) + `.gitleaksignore` secret-suppression audit** |
 | client_exposure | browser leakage | public-var secrets by **name + value-shape (`da2-…`) + CDK build-injection**, server-secret-in-client, source maps |
 | **client_integrity** | tamperable display (client trust boundary) + **WS auth model** | any security-critical sink value (address/IBAN/2FA-seed/API-key/webhook) the user reads or copies, without strict CSP / out-of-band anchor **+ client-tamper-vector, grindable-fingerprint, over-claimed-control, the CSWSH determinant** |
-| **transport_security** | CSP + HSTS header baseline | missing/weak CSP, inline event handlers, **partial HSTS (set on /api but not the HTML page)** |
+| **transport_security** | CSP + HSTS + **CORS** + **SRI** baseline | missing/weak CSP, inline event handlers, partial HSTS, **CORS reflect-origin+credentials, external script without SRI, monorepo `next.config` header gap** |
 | **pii_exposure** | unmasked PII at the output boundary | `res.json(rawEntity)` with PII + **a masking control defined but with zero live call sites** (value-shape, not field-name) |
 | graphql | GraphQL surface | introspection (**AppSync `introspectionConfig: DISABLED`-aware**) / playground / depth-limit **+ AppSync subscription-authz (cross-group BOLA)** |
 | integrations | third-party + webhooks **+ outbound-action endpoints** | unsigned webhooks **+ email/SMS/push handlers with no auth or IP-only rate-limit + redundant secret-fetch** |
@@ -206,7 +207,9 @@ publisher** with project `websec-validator`, owner `raccioly`, repo `websec-vali
 
 ## Status / roadmap
 
-**Done:** 18-extractor recon (incl. schema/entity → mass-assignment targeting, the **AWS-CDK /
+**Done:** 19-extractor recon (incl. an **authz-correctness data-flow extractor** — unsigned-cookie /
+claim-keyed authz / transaction-local RLS — plus **CORS-misconfig**, **SRI**, **host-header
+open-redirect** and **SSRF-redirect-hardening** classes, schema/entity → mass-assignment targeting, the **AWS-CDK /
 managed-AppSync / VTL boundary**, **upload-security** + **PII-output-boundary** + **redirect-SSRF**
 + **password-reuse** classes, a **man-in-the-browser / tamperable-display** class, an **LLM / AI-agent
 extractor** (OWASP LLM Top 10 — prompt injection / insecure output / excessive agency / unbounded

{websec_validator-0.7.0 → websec_validator-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "websec-validator"
-version = "0.7.0"
+version = "0.8.0"
 description = "Defensive, local-first security recon that briefs your AI coding agent on your own codebase — read-only by default (code in, artifacts out): facts + tailored probe scripts, no LLM, no server, no running app."
 readme = "README.md"
 requires-python = ">=3.11"

{websec_validator-0.7.0 → websec_validator-0.8.0}/src/websec_validator/extractors/__init__.py

@@ -11,6 +11,7 @@ from pathlib import Path
 
 from .auth import AuthExtractor
 from .authz import AuthzExtractor
+from .authz_dataflow import AuthzDataflowExtractor
 from .base import MAX_FILES, Extractor, RepoContext
 from .client_exposure import ClientExposureExtractor
 from .client_integrity import ClientIntegrityExtractor
@@ -50,6 +51,7 @@ REGISTRY: list[Extractor] = [
     IntegrationsExtractor(),
     LlmSecurityExtractor(),
     CryptoUsageExtractor(),
+    AuthzDataflowExtractor(),
 ]
 
 

websec_validator-0.8.0/src/websec_validator/extractors/authz_dataflow.py

@@ -0,0 +1,110 @@
+"""Authorization data-flow extractor — authz CORRECTNESS, not just presence.
+
+`authz.py` answers "is there a guard on this route?". This answers the next question — "does the guard
+trust the right thing?" — for three real broken-access-control patterns the route-level model can't see:
+
+  - **Unsigned-cookie authorization (CWE-565/602)** — an access decision keyed on a client-settable,
+    unsigned cookie (`twin-access-level`, `*role*`, `*allowed*`). httpOnly stops JS reads but the user
+    still controls their own cookie jar (devtools/curl), so the gate is forgeable.
+  - **Claim → authz decision (CWE-639/807)** — an authorization check that compares a profile-ish JWT
+    BODY claim (office/role/group/tenant) the user may influence, instead of a server-resolved record.
+  - **Transaction-local RLS context (CWE-1188)** — `set_config('app.*', x, true)` (is_local=true)
+    emitted at autocommit (no surrounding transaction): the RLS principal resets before the handler's
+    query runs, so row-level security evaluates with an EMPTY context — defense-in-depth theater.
+
+All are file-level co-occurrence heuristics, server-side + test-excluded, framed as leads to verify —
+a static scan can't prove the cookie is the one that gates, only point the agent at the file.
+"""
+
+from __future__ import annotations
+
+import re
+
+from .base import Extractor, RepoContext, is_client_file, is_test_file
+
+# --- unsigned-cookie authorization ---
+COOKIE_AUTHZ_READ = re.compile(
+    r"(?:cookies?\.get|req\.cookies|getCookie|cookieStore\.get)\s*\(?\s*['\"]"
+    r"([\w-]*(?:access|role|admin|allow|auth|tier|perm|priv|level|scope|tenant|clerk-user)[\w-]*)['\"]", re.I)
+AUTHZ_GATE = re.compile(
+    r"\b403\b|status\s*\(\s*40[13]|\.redirect\s*\([^)]*(?:login|signin|default|unauthorized|forbidden)"
+    r"|[!=]==\s*['\"](?:full|admin|allowed|true|owner)|normalizeAccess|accessLevel|hasAccess|requireFull|denyAccess", re.I)
+COOKIE_VERIFY = re.compile(
+    r"jwtVerify|jwt\.verify|verifyToken|verifyCookie|\bhmac\b|timingSafeEqual|unseal|\bdecrypt\b"
+    r"|signed\s*:\s*true|cookie-signature|verifySignature|getServerSession", re.I)
+
+# --- claim → authz decision ---
+AUTHZ_FN = re.compile(
+    r"function\s+(?:can|authorize|check|assert)\w*|(?:const|let)\s+(?:can|authorize|check)\w*\s*=\s*"
+    r"|\bcan[A-Z]\w*\s*\(|\bauthoriz\w*\s*\(|visibilit|buildVisibility|accessControl|ACL\b", re.I)
+# a profile-ish claim taken from the JWT BODY / request identity (vs a server-resolved record)
+CLAIM_SRC = re.compile(
+    r"jwtPayload\s*\[\s*['\"](?:office|role|roles|group|org|department|tenant|plan|tier|scope)"
+    r"|payload\.(?:office|role|group|org|department|tenant)\b"
+    r"|claims?\s*[\[.]\s*['\"]?(?:office|role|group|org|department|tenant)"
+    r"|\.tenant(?:Office|Role|Group|Plan)\b|req\.(?:user|auth)\.(?:office|role|group|org|department)\b", re.I)
+CLAIM_COMPARE = re.compile(r"[!=]==|\.(?:includes|has|some)\s*\(|\bin\s+\[", re.I)
+
+# --- transaction-local RLS context ---
+SET_CONFIG_LOCAL = re.compile(r"set_config\s*\(\s*['\"]app\.[\w.]+['\"]\s*,[^,()]+,\s*true\s*\)", re.I)
+IN_TRANSACTION = re.compile(
+    r"\bBEGIN\b|\bSTART\s+TRANSACTION\b|\.transaction\s*\(|withTransaction|db\.transaction|\btx\b\.|\btrx\b\.|\bBEGIN;|"
+    r"transaction\s*\(\s*async", re.I)
+
+
+class AuthzDataflowExtractor(Extractor):
+    name = "authz_dataflow"
+    category = "authz"
+
+    def extract(self, ctx: RepoContext, facts: dict) -> dict:
+        findings: list = []
+        seen: set = set()
+
+        def add(sev, kind, attack, rel, detail):
+            if (kind, rel) in seen:
+                return
+            seen.add((kind, rel))
+            findings.append({"severity": sev, "kind": kind, "attack_class": attack,
+                             "file": rel, "detail": detail})
+
+        for _p, rel, text in ctx.iter_code():
+            if is_test_file(rel) or is_client_file(rel, text):
+                continue
+
+            # 1. authorization decision keyed on an unsigned cookie
+            m = COOKIE_AUTHZ_READ.search(text)
+            if m and AUTHZ_GATE.search(text) and not COOKIE_VERIFY.search(text):
+                add("MEDIUM", "unsigned-cookie-authz", "cookie-authz", rel,
+                    f"An access decision appears to be keyed on a client-settable cookie "
+                    f"(`{m.group(1)}`) with no signature/JWT/HMAC verification in this file. httpOnly only "
+                    "blocks JS reads — the user still controls their own cookie jar, so they can forge the "
+                    "value and pass the gate (CWE-565/602). Bind access to a signed value (read it from the "
+                    "verified session JWT, or HMAC the cookie) and re-derive server-side.")
+
+            # 2. authz decision comparing a user-influenceable JWT claim
+            if AUTHZ_FN.search(text) and CLAIM_SRC.search(text) and CLAIM_COMPARE.search(text):
+                add("LOW", "claim-based-authz", "claim-authz", rel,
+                    "An authorization check appears to compare a profile-ish JWT BODY claim "
+                    "(office/role/group/tenant) that the user may be able to influence, rather than a "
+                    "value resolved from the authenticated record (CWE-639/807). VERIFY the claim is "
+                    "server-resolved and non-user-editable; otherwise resolve it from the tenant/user row "
+                    "inside the request, and never write a client-asserted claim back as the record of truth.")
+
+            # 3. transaction-local RLS context set outside a transaction (resets before the query)
+            if SET_CONFIG_LOCAL.search(text) and not IN_TRANSACTION.search(text):
+                add("MEDIUM", "rls-context-no-transaction", "rls-context", rel,
+                    "`set_config('app.*', …, true)` sets the RLS principal TRANSACTION-LOCALLY "
+                    "(is_local=true) but there's no surrounding transaction in this file — at autocommit "
+                    "the setting resets the instant that one statement commits, before any handler query "
+                    "runs, so RLS evaluates with an EMPTY context (CWE-1188, defense-in-depth theater). "
+                    "Set it INSIDE the transaction that runs the tenant-scoped query, on the SAME "
+                    "connection the handler uses (or use is_local=false on a dedicated per-request connection).")
+
+        by_sev: dict = {}
+        for f in findings:
+            by_sev[f["severity"]] = by_sev.get(f["severity"], 0) + 1
+        return {"findings": findings, "by_severity": by_sev,
+                "note": (f"{len(findings)} authz-correctness lead(s) — these check whether a guard trusts the "
+                         "RIGHT thing (signed cookie / server-resolved claim / live RLS context), not just whether "
+                         "a guard exists. Verify each against the data flow.") if findings
+                        else "No unsigned-cookie / claim-keyed-authz / transaction-local-RLS tells found."}

{websec_validator-0.7.0 → websec_validator-0.8.0}/src/websec_validator/extractors/surface.py

@@ -108,6 +108,24 @@ DOTSEG_GUARD = re.compile(
     r"includes\s*\(\s*['\"]\.\.|===\s*['\"]\.\.['\"]|['\"]\.\.['\"]\s*\)|%2e|%2f|decodeURIComponent"
     r"|\bnormalize\b|startsWith\s*\(\s*['\"]/[\w]|sanitiz|assertPath|safeJoin|\bresolve\b[^;]{0,40}startsWith", re.I)
 
+# Host-header → redirect (open redirect / cache poisoning, CWE-601): a redirect Location/origin built
+# from the attacker-controllable Host / X-Forwarded-Host header with no host allow-list comparison.
+HOST_HEADER_READ = re.compile(
+    r"(?:req|request|ctx)\.(?:headers?\s*[\[.]|get\s*\(\s*)['\"]?(?:x-forwarded-host|forwarded|host)\b"
+    r"|headers\.get\s*\(\s*['\"](?:x-forwarded-host|host|forwarded)", re.I)
+REDIRECT_SINK = re.compile(
+    r"\.redirect\s*\(|NextResponse\.redirect|res\.setHeader\s*\(\s*['\"]Location|['\"]Location['\"]\s*[:,]|sendRedirect", re.I)
+HOST_ALLOWLIST = re.compile(
+    r"allowedHosts?|allow[_-]?list|publicOrigin|publicWebOrigin|trustedHosts?|isAllowedHost|whitelist|brandfolderHostnames", re.I)
+# SSRF-hardening: an outbound client DELIBERATELY following redirects with no host allow-list /
+# private-range deny — a 30x to an internal/metadata host is then fetched server-side (CWE-918),
+# independent of whether the INITIAL url is user-tainted. Reaches worker/job scripts the route scan misses.
+FOLLOW_REDIR = re.compile(r"follow_redirects\s*=\s*True|allow_redirects\s*=\s*True|maxRedirects\s*:\s*[1-9]", re.I)
+OUTBOUND_CLIENT = re.compile(r"\b(?:requests\.\w+|httpx\.\w+|\bfetch\s*\(|axios|got\s*\(|node-fetch|urllib\.request)", re.I)
+SSRF_PRIVATE_GUARD = re.compile(
+    r"allow_redirects\s*=\s*False|follow_redirects\s*=\s*False|maxRedirects\s*:\s*0|169\.254|RFC1918|is_private|"
+    r"ip_address|private_?range|block.?(?:internal|private)|allowedHosts?|allow[_-]?list", re.I)
+
 
 class SurfaceExtractor(Extractor):
     name = "surface"
@@ -122,6 +140,8 @@ class SurfaceExtractor(Extractor):
         counts: dict = {k: 0 for k in SINKS}
         ssrf_redirect: list = []    # SSRF sink in a file with NO per-hop redirect guard (#1)
         proxy_escape: list = []     # reverse-proxy prefix-escape (confined-deputy)
+        host_redirect: list = []    # redirect built from the Host/X-Forwarded-Host header (open redirect)
+        follows_redirect: list = []  # outbound client follows redirects with no allow-list (SSRF-hardening)
         for _p, rel, text in ctx.iter_code():
             # Test fixtures are never a runtime sink; SSRF + outbound-HTTP are SERVER-ONLY classes,
             # so client (.tsx/'use client') and build/CLI scripts can't host them (validated: these
@@ -153,6 +173,17 @@ class SurfaceExtractor(Extractor):
             if (len(proxy_escape) < 30 and not nonserver and PROXY_JOIN.search(text)
                     and PROXY_FETCH.search(text) and not DOTSEG_GUARD.search(text)):
                 proxy_escape.append(rel)
+            # host-header → redirect (open redirect via Host/X-Forwarded-Host). Server-only; needs a
+            # redirect sink + a host-header read + no host allow-list in the file.
+            if (len(host_redirect) < 30 and not nonserver and HOST_HEADER_READ.search(text)
+                    and REDIRECT_SINK.search(text) and not HOST_ALLOWLIST.search(text)):
+                host_redirect.append(rel)
+            # SSRF-hardening: follows redirects with no allow-list / private-range deny. Worker/job
+            # SCRIPTS are in scope here (they fetch server-side), so only client + tests are excluded.
+            if (len(follows_redirect) < 30 and not is_client_file(rel, text)
+                    and FOLLOW_REDIR.search(text) and OUTBOUND_CLIENT.search(text)
+                    and not SSRF_PRIVATE_GUARD.search(text)):
+                follows_redirect.append(rel)
 
         sinks = {k: {"probe": SINKS[k][0], "count": counts[k], "files": found[k]}
                  for k in SINKS if counts[k]}
@@ -161,6 +192,8 @@ class SurfaceExtractor(Extractor):
             "sink_counts": {k: counts[k] for k in SINKS if counts[k]},
             "ssrf_redirect_unguarded": ssrf_redirect,   # validate EVERY hop, not just the input URL (#1)
             "proxy_prefix_escape": proxy_escape,        # confined-deputy via `..` in catch-all path
+            "host_header_redirect": host_redirect,      # open redirect via Host/X-Forwarded-Host
+            "follows_redirect_no_allowlist": follows_redirect,  # SSRF-hardening (redirect-to-internal)
             "datastore_class": ("sql" if has_sql else ("nosql" if has_nosql else "unknown")),
             "note": "Each sink hit is user-input-gated (req./request./concat/interp), so these are "
                     "higher-confidence leads. Cross-reference the files with routes.targeting to pick "

{websec_validator-0.7.0 → websec_validator-0.8.0}/src/websec_validator/extractors/transport_security.py

@@ -19,7 +19,7 @@ from __future__ import annotations
 
 import re
 
-from .base import Extractor, RepoContext
+from .base import Extractor, RepoContext, is_script_file, is_test_file
 
 CSP_ANY = re.compile(r"Content-Security-Policy|contentSecurityPolicy|helmet[\s\S]{0,40}?\bcsp\b"
                      r"|useCspNonce|cspDirectives", re.I)
@@ -54,6 +54,22 @@ CK_SECURE = re.compile(
     r"[A-Za-z_$][\w$.]*\s*[=!]==|[A-Za-z_$][\w$.]*\s*\?|[A-Za-z_$][\w$.]*\([^)]*\))", re.I)
 CK_SAMESITE = re.compile(r"samesite", re.I)
 
+# CORS misconfiguration — the high-impact form is an Allow-Origin that REFLECTS the request Origin (or
+# `*`) TOGETHER with Allow-Credentials:true, which lets any site read authenticated responses.
+CORS_REFLECT = re.compile(
+    r"Access-Control-Allow-Origin['\"]?\s*[,:][^,\n)]{0,60}(?:req\.|request\.|headers?\.origin|get\s*\(\s*['\"]origin|\borigin\b)"
+    r"|cors\s*\(\s*\{[^}]*origin\s*:\s*true|origin\s*:\s*(?:true|function|\(origin)|reflectOrigin|originReflect", re.I)
+CORS_WILDCARD = re.compile(r"Access-Control-Allow-Origin['\"]?\s*[,:]\s*['\"]\*['\"]|\borigin\s*:\s*['\"]\*['\"]", re.I)
+CORS_CREDS = re.compile(r"Access-Control-Allow-Credentials['\"]?\s*[,:]\s*['\"]?true|credentials\s*:\s*true", re.I)
+# an external <script src="https://…"> with no Subresource-Integrity (supply-chain: a CDN compromise
+# runs arbitrary JS in your origin). Only meaningful in code that emits HTML.
+EXT_SCRIPT = re.compile(r"<script\b[^>]*\ssrc\s*=\s*['\"]https?://[^'\"]+['\"][^>]*>", re.I)
+SRI_OK = re.compile(r"\bintegrity\s*=", re.I)
+# a Next.js config that defines security headers via headers()
+NEXT_HEADERS_FN = re.compile(r"async\s+headers\s*\(|\bheaders\s*\(\s*\)\s*\{|key\s*:\s*['\"](?:Content-Security-Policy|X-Frame-Options|Strict-Transport-Security|X-Content-Type-Options)['\"]", re.I)
+NEXT_CSP = re.compile(r"Content-Security-Policy", re.I)
+NEXT_XFO = re.compile(r"X-Frame-Options|frame-ancestors", re.I)
+
 
 class TransportSecurityExtractor(Extractor):
     name = "transport_security"
@@ -69,6 +85,7 @@ class TransportSecurityExtractor(Extractor):
         inline_handlers = []
         sets_cookie = ck_httponly = ck_secure = ck_samesite = False
         hsts_files, hsts_api_only, hsts_html = [], True, False
+        extra_findings: list = []     # CORS / SRI / next-config — emitted alongside the CSP/HSTS set
 
         # config manifests carry headers too (next.config, vercel.json, netlify.toml, _headers)
         manifests = "\n".join(ctx.manifest(n) for n in
@@ -76,9 +93,37 @@ class TransportSecurityExtractor(Extractor):
                                "netlify.toml", "public/_headers", "static/_headers", "nginx.conf"))
 
         for _p, rel, text in ctx.iter_code():
+            if is_test_file(rel) or is_script_file(rel):
+                continue
             if HTML_SURFACE.search(rel) or HTML_CONTENT.search(text):
                 html_surface = True
             blob = text
+            # CORS misconfig — reflected/wildcard Allow-Origin together with credentials = any site
+            # reads authed responses (CWE-942). Server-side only.
+            if CORS_CREDS.search(blob) and (CORS_REFLECT.search(blob) or CORS_WILDCARD.search(blob)):
+                extra_findings.append({"severity": "HIGH", "kind": "cors-credentials-any-origin",
+                                       "attack_class": "cors-misconfig", "file": rel,
+                                       "detail": "CORS reflects the request Origin (or uses `*`) AND sets "
+                                       "Allow-Credentials:true — any website can make credentialed cross-origin "
+                                       "requests and READ the authenticated responses (CWE-942). Allow-list exact "
+                                       "trusted origins; never reflect Origin or use `*` when credentials are on."})
+            elif CORS_REFLECT.search(blob):
+                extra_findings.append({"severity": "MEDIUM", "kind": "cors-reflects-origin",
+                                       "attack_class": "cors-misconfig", "file": rel,
+                                       "detail": "CORS appears to reflect the request Origin (echo-back / `origin:true`) "
+                                       "rather than allow-listing exact origins. Safe only without credentials and with a "
+                                       "strict allow-list — verify it can't be turned into a credentialed cross-origin read."})
+            # external script with no SRI, in code that emits HTML
+            if (HTML_CONTENT.search(blob) or HTML_SURFACE.search(rel)):
+                for m in EXT_SCRIPT.finditer(blob):
+                    if not SRI_OK.search(m.group(0)):
+                        extra_findings.append({"severity": "MEDIUM", "kind": "external-script-no-sri",
+                                               "attack_class": "subresource-integrity", "file": rel,
+                                               "detail": "An external <script src=\"https://…\"> is loaded with no "
+                                               "Subresource-Integrity (`integrity=`) hash / version pin — a CDN or "
+                                               "package compromise runs arbitrary JS in this origin (CWE-829). Pin the "
+                                               "version + add an SRI hash + `crossorigin`, or self-host the bundle."})
+                        break
             if CSP_ANY.search(blob):
                 csp_present = True
                 if CSP_SCRIPT_SELF.search(blob):
@@ -121,9 +166,30 @@ class TransportSecurityExtractor(Extractor):
             if HSTS_PRELOAD.search(manifests):
                 hsts_preload = True
 
+        # Monorepo-aware Next.js config header gap — `transport_security` previously only read the
+        # ROOT next.config via manifests, so a `packages/web/next.config.ts` was invisible. Glob every
+        # next.config.* and flag one with no security-header block (CSP + X-Frame-Options).
+        for nc in (ctx.glob("**/next.config.js") + ctx.glob("**/next.config.mjs")
+                   + ctx.glob("**/next.config.ts")):
+            rel, txt = ctx.rel(nc), ctx.text(nc)
+            if not NEXT_HEADERS_FN.search(txt):
+                extra_findings.append({"severity": "MEDIUM", "kind": "nextjs-no-security-headers",
+                                       "attack_class": "missing-csp", "file": rel,
+                                       "detail": "This Next.js config defines no security-header block (`headers()`) — "
+                                       "so no app-wide Content-Security-Policy, X-Frame-Options/frame-ancestors, HSTS, "
+                                       "X-Content-Type-Options, or Referrer-Policy unless an upstream edge sets them. Add "
+                                       "a `headers()` matcher (start CSP report-only) or document that nginx/CDN owns them."})
+            elif not (NEXT_CSP.search(txt) and NEXT_XFO.search(txt)):
+                miss = ", ".join(n for n, ok in (("CSP", NEXT_CSP.search(txt)),
+                                                 ("X-Frame-Options/frame-ancestors", NEXT_XFO.search(txt))) if not ok)
+                extra_findings.append({"severity": "LOW", "kind": "nextjs-partial-security-headers",
+                                       "attack_class": "missing-csp", "file": rel,
+                                       "detail": f"Next.js config has a headers() block but is missing {miss}. Add the "
+                                       "clickjacking/XSS-defense headers (verify against the live response if the edge sets some)."})
+
         strict_csp = bool(csp_present and csp_self and csp_nonce and not csp_unsafe)
         web_surface = html_surface or has_routes
-        findings = []
+        findings = list(extra_findings)
 
         if html_surface:
             if not csp_present:

{websec_validator-0.7.0 → websec_validator-0.8.0}/src/websec_validator/findings.py

@@ -111,6 +111,16 @@ STANDARDS = {
     "predictable-principal": (["CWE-330 Use of Insufficiently Random Values", "CWE-340 Predictable from Observable State"],
                               "ASVS V6.3.1", ["API1:2023 BOLA"]),
     "timing-unsafe-compare": (["CWE-208 Observable Timing Discrepancy"], "ASVS V6.2.3", ["API2:2023 Broken Authentication"]),
+    # --- transport / access-control-dataflow classes (0.8.0) ---
+    "cors-misconfig": (["CWE-942 Permissive Cross-domain Policy with Untrusted Domains"], "ASVS V14.5.3",
+                       ["API8:2023 Misconfiguration"]),
+    "subresource-integrity": (["CWE-829 Inclusion of Functionality from Untrusted Control Sphere"], "ASVS V14.2.3",
+                              ["API8:2023 Misconfiguration"]),
+    "cookie-authz": (["CWE-565 Reliance on Cookies Without Validation", "CWE-602 Client-Side Enforcement of Server-Side Security"],
+                     "ASVS V3.4", ["API1:2023 BOLA", "API5:2023 BFLA"]),
+    "claim-authz": (["CWE-639 Authorization Bypass Through User-Controlled Key", "CWE-807 Reliance on Untrusted Inputs in a Security Decision"],
+                    "ASVS V4.2.1", ["API1:2023 BOLA"]),
+    "rls-context": (["CWE-1188 Insecure Default Initialization of Resource"], "ASVS V4.1.3", ["API1:2023 BOLA"]),
 }
 REMEDIATION = {
     "missing-auth": "Add an auth guard to the handler (e.g. requireAuth()/getServerSession()), or a "
@@ -208,6 +218,21 @@ REMEDIATION = {
     "timing-unsafe-compare": "Compare request-supplied secrets/tokens/signatures with `crypto.timingSafeEqual` "
                              "(equal-length buffers) or `compare_digest`, never `===`/`!==`, to remove the timing "
                              "side-channel.",
+    "cors-misconfig": "Allow-list exact trusted origins; never reflect the request Origin or use `*` when "
+                      "`Allow-Credentials: true`. If credentials aren't needed, drop them so a strict allow-list "
+                      "isn't load-bearing.",
+    "subresource-integrity": "Pin the external resource to an exact version and add a Subresource-Integrity "
+                             "`integrity=` hash + `crossorigin`, or self-host it, and constrain it with a CSP so a "
+                             "CDN/package compromise can't run arbitrary JS in your origin.",
+    "cookie-authz": "Never make an authorization decision on an unsigned/unverified cookie — bind access to a "
+                    "signed value (read it from the verified session JWT, or HMAC the cookie) and re-derive on the "
+                    "server; treat client cookies as untrusted hints only.",
+    "claim-authz": "Resolve the fields used for authorization (office/role/tenant) from the authenticated record "
+                   "server-side, not from the JWT body claim; never write a client-asserted claim back as the record "
+                   "of truth. Verify the resolved row owns the resource.",
+    "rls-context": "Set the RLS context (`set_config('app.*', x, true)`) INSIDE the transaction that runs the "
+                   "tenant-scoped query, on the SAME connection the handler uses — a transaction-local setting "
+                   "emitted at autocommit resets before the query, so RLS evaluates with an empty context.",
 }
 _DEFAULT_REM = "Review and remediate per the cited standard."
 
@@ -429,6 +454,25 @@ def build_ledger(facts: dict, unified: dict | None, dynamic: dict | None = None,
                         "caller reaches any upstream route with valid creds (confused deputy). Reject `.`/`..`/`%2e` "
                         "segments or assert the normalized pathname still starts with the prefix."}]))
 
+    # ---- 3d. Host-header → redirect (open redirect / cache poisoning) ----
+    for rel in (facts.get("surface", {}).get("host_header_redirect", []) or []):
+        out.append(_f(f"Host-header open-redirect: {rel}", "attack-surface", "open-redirect",
+                      "MEDIUM", "LOW", rel,
+                      [{"layer": "recon", "detail": "a redirect Location/origin is built from the attacker-controllable "
+                        "Host / X-Forwarded-Host header with no host allow-list — an on-path or cache-poisoning attacker "
+                        "can send the user to an arbitrary host (CWE-601). Pin the redirect base to a server-configured "
+                        "origin allow-list, never request headers."}]))
+
+    # ---- 3e. SSRF-hardening: outbound client follows redirects with no allow-list ----
+    for rel in (facts.get("surface", {}).get("follows_redirect_no_allowlist", []) or []):
+        out.append(_f(f"Follows redirects with no allow-list: {rel}", "attack-surface", "ssrf",
+                      "MEDIUM", "LOW", rel,
+                      [{"layer": "recon", "detail": "an outbound HTTP client deliberately follows redirects "
+                        "(follow_redirects/allow_redirects=True, maxRedirects>0) with no host allow-list or private-range "
+                        "deny — a 30x to 169.254.169.254 / an RFC1918 host is fetched server-side regardless of whether "
+                        "the initial URL is user-tainted (CWE-918). Re-validate every hop against an allow-list; deny "
+                        "loopback/link-local/private ranges."}]))
+
     # ---- 4. Client-side secret exposure (HIGH — ships to browser) ----
     # Name-based + value-shape (rename-proof) + CDK build-injection (#3) all land here.
     _cx = facts.get("client_exposure", {})
@@ -495,9 +539,14 @@ def build_ledger(facts: dict, unified: dict | None, dynamic: dict | None = None,
 
     # ---- 8b. Transport / browser-hardening header baseline (CSP #3, HSTS #4) ----
     for fnd in (facts.get("transport_security", {}) or {}).get("findings", []):
-        out.append(_f(f"{fnd.get('kind')}: browser/transport hardening header", "transport",
-                      fnd.get("attack_class", "missing-csp"), fnd.get("severity", "LOW"), "LOW",
-                      "(response headers)", [{"layer": "recon", "detail": fnd.get("detail", "")}]))
+        # header-baseline findings have no file (they're about response headers); CORS/SRI/next-config
+        # findings carry a real file — use it so the location is actionable.
+        loc = fnd.get("file") or "(response headers)"
+        title = f"{fnd.get('kind')}: {fnd.get('file')}" if fnd.get("file") else \
+            f"{fnd.get('kind')}: browser/transport hardening header"
+        out.append(_f(title, "transport", fnd.get("attack_class", "missing-csp"),
+                      fnd.get("severity", "LOW"), "LOW", loc,
+                      [{"layer": "recon", "detail": fnd.get("detail", "")}]))
 
     # ---- 9. Inbound webhooks with no signature verification (forgery / replay) ----
     # Recon found webhook handlers with no HMAC/signature check. This was surfaced in the briefing
@@ -548,6 +597,14 @@ def build_ledger(facts: dict, unified: dict | None, dynamic: dict | None = None,
                       fnd.get("severity", "MEDIUM"), "MEDIUM", fnd.get("file", ""),
                       [{"layer": "recon", "detail": fnd.get("detail", "")}]))
 
+    # ---- 14. Authz data-flow — does the guard trust the right thing? (unsigned-cookie authz,
+    # claim-keyed authz, transaction-local RLS context). ----
+    for fnd in (facts.get("authz_dataflow", {}) or {}).get("findings", []):
+        out.append(_f(f"{fnd.get('kind')}: {fnd.get('file')}", "access-control",
+                      fnd.get("attack_class", "cookie-authz"),
+                      fnd.get("severity", "MEDIUM"), "LOW", fnd.get("file", ""),
+                      [{"layer": "recon", "detail": fnd.get("detail", "")}]))
+
     # ---- suppress + rank ----
     kept = [f for f in out if not _suppressed(f, suppressions)]
     suppressed_n = len(out) - len(kept)

{websec_validator-0.7.0 → websec_validator-0.8.0/src/websec_validator.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: websec-validator
-Version: 0.7.0
+Version: 0.8.0
 Summary: Defensive, local-first security recon that briefs your AI coding agent on your own codebase — read-only by default (code in, artifacts out): facts + tailored probe scripts, no LLM, no server, no running app.
 Author: Ricardo Accioly
 License: MIT
@@ -89,23 +89,24 @@ Then point your agent at the output: **"Read `websec-out/AGENT-BRIEFING.md` and
 
 > That's the whole user surface: **`run`** (plus the optional, advanced **`dynamic`** live-probing step below). `recon`/`proof`/`calibrate` exist for developing the tool itself and are hidden from `--help` — you never need them.
 
-## What it extracts (18 deterministic extractors, no LLM)
+## What it extracts (19 deterministic extractors, no LLM)
 
 | | Dimension | Notable output |
 |---|---|---|
 | stack | languages, frameworks, datastores | monorepo-aware (aggregates every manifest) |
 | routes | every endpoint via **OWASP Noir** | method · path · typed params · code path |
 | auth | scheme + login surface + **insecure-default signing secrets** | multi-scheme; flags a hard-coded `JWT_SECRET \|\| 'dev-secret'` fallback (forgeable JWT) |
-| **authz** | access-control map | guard coverage + **write endpoints with no visible guard** + roles |
+| **authz** | access-control map | guard coverage (incl. **router-mount auth**) + **write endpoints with no visible guard** + roles |
+| **authz_dataflow** | authz *correctness* (does the guard trust the right thing?) | **unsigned-cookie authorization** · **claim-keyed authz** (user-influenceable JWT claim) · **transaction-local RLS context** (resets before the query) |
 | tenant | multi-tenancy key candidates | the BOLA boundary, by frequency |
 | **password_policy** | cross-route consistency **+ reuse/history** | complexity drift across routes **+ a set-password path that hashes without a reuse check** |
-| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure **+ follows-redirects-without-per-hop-guard** |
+| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure + follows-redirects-without-per-hop-guard **+ reverse-proxy prefix-escape + host-header open-redirect + SSRF-redirect-hardening** |
 | **upload_security** | unrestricted upload + unsafe serve | deny-list-only, stored-name-from-filename, trust-client-MIME, accept-SVG, **serve without `nosniff`** |
 | schemas | data models + **privileged fields** | Pydantic/SQLAlchemy/Django/Prisma/Mongoose/TypeORM/Zod → `role`/`isAdmin`/`groupId` for mass-assignment targeting |
 | iac_ci | IaC + CI/CD | GHA injection (**run:-position-aware**), unpinned actions, tfstate, CDK AppSync `API_KEY` anonymous-default-auth, **docker-compose host-takeover (docker.sock / pid:host / privileged) + `.gitleaksignore` secret-suppression audit** |
 | client_exposure | browser leakage | public-var secrets by **name + value-shape (`da2-…`) + CDK build-injection**, server-secret-in-client, source maps |
 | **client_integrity** | tamperable display (client trust boundary) + **WS auth model** | any security-critical sink value (address/IBAN/2FA-seed/API-key/webhook) the user reads or copies, without strict CSP / out-of-band anchor **+ client-tamper-vector, grindable-fingerprint, over-claimed-control, the CSWSH determinant** |
-| **transport_security** | CSP + HSTS header baseline | missing/weak CSP, inline event handlers, **partial HSTS (set on /api but not the HTML page)** |
+| **transport_security** | CSP + HSTS + **CORS** + **SRI** baseline | missing/weak CSP, inline event handlers, partial HSTS, **CORS reflect-origin+credentials, external script without SRI, monorepo `next.config` header gap** |
 | **pii_exposure** | unmasked PII at the output boundary | `res.json(rawEntity)` with PII + **a masking control defined but with zero live call sites** (value-shape, not field-name) |
 | graphql | GraphQL surface | introspection (**AppSync `introspectionConfig: DISABLED`-aware**) / playground / depth-limit **+ AppSync subscription-authz (cross-group BOLA)** |
 | integrations | third-party + webhooks **+ outbound-action endpoints** | unsigned webhooks **+ email/SMS/push handlers with no auth or IP-only rate-limit + redundant secret-fetch** |
@@ -218,7 +219,9 @@ publisher** with project `websec-validator`, owner `raccioly`, repo `websec-vali
 
 ## Status / roadmap
 
-**Done:** 18-extractor recon (incl. schema/entity → mass-assignment targeting, the **AWS-CDK /
+**Done:** 19-extractor recon (incl. an **authz-correctness data-flow extractor** — unsigned-cookie /
+claim-keyed authz / transaction-local RLS — plus **CORS-misconfig**, **SRI**, **host-header
+open-redirect** and **SSRF-redirect-hardening** classes, schema/entity → mass-assignment targeting, the **AWS-CDK /
 managed-AppSync / VTL boundary**, **upload-security** + **PII-output-boundary** + **redirect-SSRF**
 + **password-reuse** classes, a **man-in-the-browser / tamperable-display** class, an **LLM / AI-agent
 extractor** (OWASP LLM Top 10 — prompt injection / insecure output / excessive agency / unbounded

{websec_validator-0.7.0 → websec_validator-0.8.0}/src/websec_validator.egg-info/SOURCES.txt

@@ -23,6 +23,7 @@ src/websec_validator.egg-info/top_level.txt
 src/websec_validator/extractors/__init__.py
 src/websec_validator/extractors/auth.py
 src/websec_validator/extractors/authz.py
+src/websec_validator/extractors/authz_dataflow.py
 src/websec_validator/extractors/base.py
 src/websec_validator/extractors/client_exposure.py
 src/websec_validator/extractors/client_integrity.py

{websec_validator-0.7.0 → websec_validator-0.8.0}/tests/test_recon.py

@@ -32,6 +32,7 @@ from websec_validator.extractors.iac_ci import IacCiExtractor          # noqa: E
 from websec_validator.extractors.transport_security import TransportSecurityExtractor  # noqa: E402
 from websec_validator.extractors.llm_security import LlmSecurityExtractor  # noqa: E402
 from websec_validator.extractors.crypto_usage import CryptoUsageExtractor  # noqa: E402
+from websec_validator.extractors.authz_dataflow import AuthzDataflowExtractor  # noqa: E402
 
 FIX = Path(__file__).resolve().parent / "fixtures"
 
@@ -848,5 +849,118 @@ class Wave2bDetectorTests(unittest.TestCase):
         self.assertNotIn("timing-unsafe-compare", self._kinds(out))
 
 
+class Wave3DeferredDetectorTests(unittest.TestCase):
+    """0.8.0 deferred-backlog detectors: CORS, Next-config headers, SRI, host-redirect,
+    follows-redirect, unsigned-cookie authz, claim-authz, transaction-local RLS."""
+
+    # --- transport: CORS / SRI / next-config ---
+    def _transport(self, files, frameworks=("next", "express")):
+        d = Path(tempfile.mkdtemp())
+        for name, body in files.items():
+            p = d / name
+            p.parent.mkdir(parents=True, exist_ok=True)
+            p.write_text(body)
+        return TransportSecurityExtractor().extract(
+            RepoContext(d), {"stack": {"frameworks": list(frameworks)}, "routes": {"endpoints": [{"method": "GET", "path": "/x"}]}})
+
+    def _tkinds(self, out):
+        return {f["kind"] for f in out["findings"]}
+
+    def test_cors_reflect_with_credentials_high(self):
+        out = self._transport({"srv.ts": "res.setHeader('Access-Control-Allow-Origin', req.headers.origin);\n"
+                                          "res.setHeader('Access-Control-Allow-Credentials', 'true');"})
+        hi = [f for f in out["findings"] if f["kind"] == "cors-credentials-any-origin"]
+        self.assertTrue(hi)
+        self.assertEqual(hi[0]["severity"], "HIGH")
+
+    def test_cors_allowlist_not_flagged(self):
+        out = self._transport({"srv.ts": "app.use(cors({ origin: ['https://app.example.com'], credentials: true }));"})
+        self.assertNotIn("cors-credentials-any-origin", self._tkinds(out))
+
+    def test_external_script_without_sri_flagged(self):
+        out = self._transport({"docs.ts": "res.send(`<html><script src=\"https://cdn.jsdelivr.net/npm/x/y.js\"></script></html>`);"})
+        self.assertIn("external-script-no-sri", self._tkinds(out))
+
+    def test_external_script_with_sri_not_flagged(self):
+        out = self._transport({"docs.ts": "res.send(`<html><script src=\"https://cdn/x.js\" integrity=\"sha384-abc\"></script></html>`);"})
+        self.assertNotIn("external-script-no-sri", self._tkinds(out))
+
+    def test_nextjs_config_no_headers_flagged(self):
+        out = self._transport({"packages/web/next.config.ts": "export default { reactStrictMode: true };"})
+        self.assertIn("nextjs-no-security-headers", self._tkinds(out))
+
+    def test_nextjs_config_with_headers_not_flagged(self):
+        out = self._transport({"packages/web/next.config.ts":
+                               "export default { async headers(){ return [{ source:'/(.*)', headers:["
+                               "{key:'Content-Security-Policy',value:\"default-src 'self'\"},"
+                               "{key:'X-Frame-Options',value:'DENY'}]}]; } };"})
+        ks = self._tkinds(out)
+        self.assertNotIn("nextjs-no-security-headers", ks)
+        self.assertNotIn("nextjs-partial-security-headers", ks)
+
+    # --- surface: host-redirect / follows-redirect ---
+    def _surface(self, files, ds=("postgres",)):
+        d = Path(tempfile.mkdtemp())
+        for name, body in files.items():
+            p = d / name
+            p.parent.mkdir(parents=True, exist_ok=True)
+            p.write_text(body)
+        return SurfaceExtractor().extract(RepoContext(d), {"stack": {"datastores": list(ds)}})
+
+    def test_host_header_redirect_flagged(self):
+        out = self._surface({"h.ts": "const host = req.headers['x-forwarded-host'];\n"
+                                     "return res.redirect(`https://${host}/next`);"})
+        self.assertEqual(len(out["host_header_redirect"]), 1)
+
+    def test_host_header_redirect_with_allowlist_not_flagged(self):
+        out = self._surface({"h.ts": "const host = req.headers['x-forwarded-host'];\n"
+                                     "const base = allowedHosts.includes(host) ? host : publicWebOrigin;\n"
+                                     "return res.redirect(`https://${base}/next`);"})
+        self.assertEqual(out["host_header_redirect"], [])
+
+    def test_follows_redirects_no_allowlist_flagged(self):
+        out = self._surface({"job.py": "r = httpx.get(url, follow_redirects=True)"})
+        self.assertEqual(len(out["follows_redirect_no_allowlist"]), 1)
+
+    def test_follows_redirects_disabled_not_flagged(self):
+        out = self._surface({"job.py": "r = httpx.get(url, follow_redirects=False)"})
+        self.assertEqual(out["follows_redirect_no_allowlist"], [])
+
+    # --- authz_dataflow: cookie-authz / claim-authz / rls-context ---
+    def _adf(self, files):
+        d = Path(tempfile.mkdtemp())
+        for name, body in files.items():
+            d.joinpath(name).write_text(body)
+        return AuthzDataflowExtractor().extract(RepoContext(d), {})
+
+    def _akinds(self, out):
+        return {f["kind"] for f in out["findings"]}
+
+    def test_unsigned_cookie_authz_flagged(self):
+        out = self._adf({"mw.ts": "const lvl = req.cookies.get('twin-access-level');\n"
+                                  "if (lvl !== 'full') return new Response('forbidden', { status: 403 });"})
+        self.assertIn("unsigned-cookie-authz", self._akinds(out))
+
+    def test_cookie_authz_with_jwt_verify_not_flagged(self):
+        out = self._adf({"mw.ts": "const lvl = req.cookies.get('twin-access-level');\n"
+                                  "const ok = await jwtVerify(req.cookies.get('twin-token'), key);\n"
+                                  "if (lvl !== 'full') return new Response('forbidden', { status: 403 });"})
+        self.assertNotIn("unsigned-cookie-authz", self._akinds(out))
+
+    def test_claim_based_authz_flagged(self):
+        out = self._adf({"acl.ts": "export function canAccessDocument(ctx, doc){ "
+                                   "return ctx.tenantOffice === doc.authorOffice; }"})
+        self.assertIn("claim-based-authz", self._akinds(out))
+
+    def test_rls_context_no_transaction_flagged(self):
+        out = self._adf({"rls.ts": "await db.execute(sql`SELECT set_config('app.user_id', ${userId}, true)`);"})
+        self.assertIn("rls-context-no-transaction", self._akinds(out))
+
+    def test_rls_context_in_transaction_not_flagged(self):
+        out = self._adf({"rls.ts": "await db.transaction(async (tx) => { "
+                                   "await tx.execute(sql`SELECT set_config('app.user_id', ${userId}, true)`); });"})
+        self.assertNotIn("rls-context-no-transaction", self._akinds(out))
+
+
 if __name__ == "__main__":
     unittest.main()