websec-validator 0.7.0__tar.gz → 0.8.1__tar.gz

{websec_validator-0.7.0/src/websec_validator.egg-info → websec_validator-0.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: websec-validator
-Version: 0.7.0
+Version: 0.8.1
 Summary: Defensive, local-first security recon that briefs your AI coding agent on your own codebase — read-only by default (code in, artifacts out): facts + tailored probe scripts, no LLM, no server, no running app.
 Author: Ricardo Accioly
 License: MIT
@@ -25,7 +25,7 @@ turns a repo into a precise, fact-grounded security brief an AI agent (with a hu
 can act on — an auto-filled, repo-aware version of a senior pentester's "here's what to test and
 how" handoff. How it works + the reasoning behind every check: [`docs/METHODOLOGY.md`](docs/METHODOLOGY.md).
 
-## Quickstart — just point it at your repo
+## Getting Started — just point it at your repo
 
 **Simplest: tell your AI agent.** In Claude Code (or any coding agent), open your project and say:
 
@@ -89,23 +89,24 @@ Then point your agent at the output: **"Read `websec-out/AGENT-BRIEFING.md` and
 
 > That's the whole user surface: **`run`** (plus the optional, advanced **`dynamic`** live-probing step below). `recon`/`proof`/`calibrate` exist for developing the tool itself and are hidden from `--help` — you never need them.
 
-## What it extracts (18 deterministic extractors, no LLM)
+## What it extracts (19 deterministic extractors, no LLM)
 
 | | Dimension | Notable output |
 |---|---|---|
 | stack | languages, frameworks, datastores | monorepo-aware (aggregates every manifest) |
 | routes | every endpoint via **OWASP Noir** | method · path · typed params · code path |
 | auth | scheme + login surface + **insecure-default signing secrets** | multi-scheme; flags a hard-coded `JWT_SECRET \|\| 'dev-secret'` fallback (forgeable JWT) |
-| **authz** | access-control map | guard coverage + **write endpoints with no visible guard** + roles |
+| **authz** | access-control map | guard coverage (incl. **router-mount auth**) + **write endpoints with no visible guard** + roles |
+| **authz_dataflow** | authz *correctness* (does the guard trust the right thing?) | **unsigned-cookie authorization** · **claim-keyed authz** (user-influenceable JWT claim) · **transaction-local RLS context** (resets before the query) |
 | tenant | multi-tenancy key candidates | the BOLA boundary, by frequency |
 | **password_policy** | cross-route consistency **+ reuse/history** | complexity drift across routes **+ a set-password path that hashes without a reuse check** |
-| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure **+ follows-redirects-without-per-hop-guard** |
+| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure + follows-redirects-without-per-hop-guard **+ reverse-proxy prefix-escape + host-header open-redirect + SSRF-redirect-hardening** |
 | **upload_security** | unrestricted upload + unsafe serve | deny-list-only, stored-name-from-filename, trust-client-MIME, accept-SVG, **serve without `nosniff`** |
 | schemas | data models + **privileged fields** | Pydantic/SQLAlchemy/Django/Prisma/Mongoose/TypeORM/Zod → `role`/`isAdmin`/`groupId` for mass-assignment targeting |
 | iac_ci | IaC + CI/CD | GHA injection (**run:-position-aware**), unpinned actions, tfstate, CDK AppSync `API_KEY` anonymous-default-auth, **docker-compose host-takeover (docker.sock / pid:host / privileged) + `.gitleaksignore` secret-suppression audit** |
 | client_exposure | browser leakage | public-var secrets by **name + value-shape (`da2-…`) + CDK build-injection**, server-secret-in-client, source maps |
 | **client_integrity** | tamperable display (client trust boundary) + **WS auth model** | any security-critical sink value (address/IBAN/2FA-seed/API-key/webhook) the user reads or copies, without strict CSP / out-of-band anchor **+ client-tamper-vector, grindable-fingerprint, over-claimed-control, the CSWSH determinant** |
-| **transport_security** | CSP + HSTS header baseline | missing/weak CSP, inline event handlers, **partial HSTS (set on /api but not the HTML page)** |
+| **transport_security** | CSP + HSTS + **CORS** + **SRI** baseline | missing/weak CSP, inline event handlers, partial HSTS, **CORS reflect-origin+credentials, external script without SRI, monorepo `next.config` header gap** |
 | **pii_exposure** | unmasked PII at the output boundary | `res.json(rawEntity)` with PII + **a masking control defined but with zero live call sites** (value-shape, not field-name) |
 | graphql | GraphQL surface | introspection (**AppSync `introspectionConfig: DISABLED`-aware**) / playground / depth-limit **+ AppSync subscription-authz (cross-group BOLA)** |
 | integrations | third-party + webhooks **+ outbound-action endpoints** | unsigned webhooks **+ email/SMS/push handlers with no auth or IP-only rate-limit + redundant secret-fetch** |
@@ -192,7 +193,7 @@ upload, cross-tenant BOLA, role/authz gaps).
 ## Tests
 
 ```bash
-python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 139 tests
+python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 203 tests
 ```
 
 ## Releasing (maintainer)
@@ -218,7 +219,9 @@ publisher** with project `websec-validator`, owner `raccioly`, repo `websec-vali
 
 ## Status / roadmap
 
-**Done:** 18-extractor recon (incl. schema/entity → mass-assignment targeting, the **AWS-CDK /
+**Done:** 19-extractor recon (incl. an **authz-correctness data-flow extractor** — unsigned-cookie /
+claim-keyed authz / transaction-local RLS — plus **CORS-misconfig**, **SRI**, **host-header
+open-redirect** and **SSRF-redirect-hardening** classes, schema/entity → mass-assignment targeting, the **AWS-CDK /
 managed-AppSync / VTL boundary**, **upload-security** + **PII-output-boundary** + **redirect-SSRF**
 + **password-reuse** classes, a **man-in-the-browser / tamperable-display** class, an **LLM / AI-agent
 extractor** (OWASP LLM Top 10 — prompt injection / insecure output / excessive agency / unbounded

{websec_validator-0.7.0 → websec_validator-0.8.1}/README.md

@@ -13,7 +13,7 @@ turns a repo into a precise, fact-grounded security brief an AI agent (with a hu
 can act on — an auto-filled, repo-aware version of a senior pentester's "here's what to test and
 how" handoff. How it works + the reasoning behind every check: [`docs/METHODOLOGY.md`](docs/METHODOLOGY.md).
 
-## Quickstart — just point it at your repo
+## Getting Started — just point it at your repo
 
 **Simplest: tell your AI agent.** In Claude Code (or any coding agent), open your project and say:
 
@@ -77,23 +77,24 @@ Then point your agent at the output: **"Read `websec-out/AGENT-BRIEFING.md` and
 
 > That's the whole user surface: **`run`** (plus the optional, advanced **`dynamic`** live-probing step below). `recon`/`proof`/`calibrate` exist for developing the tool itself and are hidden from `--help` — you never need them.
 
-## What it extracts (18 deterministic extractors, no LLM)
+## What it extracts (19 deterministic extractors, no LLM)
 
 | | Dimension | Notable output |
 |---|---|---|
 | stack | languages, frameworks, datastores | monorepo-aware (aggregates every manifest) |
 | routes | every endpoint via **OWASP Noir** | method · path · typed params · code path |
 | auth | scheme + login surface + **insecure-default signing secrets** | multi-scheme; flags a hard-coded `JWT_SECRET \|\| 'dev-secret'` fallback (forgeable JWT) |
-| **authz** | access-control map | guard coverage + **write endpoints with no visible guard** + roles |
+| **authz** | access-control map | guard coverage (incl. **router-mount auth**) + **write endpoints with no visible guard** + roles |
+| **authz_dataflow** | authz *correctness* (does the guard trust the right thing?) | **unsigned-cookie authorization** · **claim-keyed authz** (user-influenceable JWT claim) · **transaction-local RLS context** (resets before the query) |
 | tenant | multi-tenancy key candidates | the BOLA boundary, by frequency |
 | **password_policy** | cross-route consistency **+ reuse/history** | complexity drift across routes **+ a set-password path that hashes without a reuse check** |
-| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure **+ follows-redirects-without-per-hop-guard** |
+| surface | 15 sink classes **+ redirect-SSRF** | user-input-gated sinks (incl. **mass-assignment via object spread**) + var-arg SSRF + error-disclosure + follows-redirects-without-per-hop-guard **+ reverse-proxy prefix-escape + host-header open-redirect + SSRF-redirect-hardening** |
 | **upload_security** | unrestricted upload + unsafe serve | deny-list-only, stored-name-from-filename, trust-client-MIME, accept-SVG, **serve without `nosniff`** |
 | schemas | data models + **privileged fields** | Pydantic/SQLAlchemy/Django/Prisma/Mongoose/TypeORM/Zod → `role`/`isAdmin`/`groupId` for mass-assignment targeting |
 | iac_ci | IaC + CI/CD | GHA injection (**run:-position-aware**), unpinned actions, tfstate, CDK AppSync `API_KEY` anonymous-default-auth, **docker-compose host-takeover (docker.sock / pid:host / privileged) + `.gitleaksignore` secret-suppression audit** |
 | client_exposure | browser leakage | public-var secrets by **name + value-shape (`da2-…`) + CDK build-injection**, server-secret-in-client, source maps |
 | **client_integrity** | tamperable display (client trust boundary) + **WS auth model** | any security-critical sink value (address/IBAN/2FA-seed/API-key/webhook) the user reads or copies, without strict CSP / out-of-band anchor **+ client-tamper-vector, grindable-fingerprint, over-claimed-control, the CSWSH determinant** |
-| **transport_security** | CSP + HSTS header baseline | missing/weak CSP, inline event handlers, **partial HSTS (set on /api but not the HTML page)** |
+| **transport_security** | CSP + HSTS + **CORS** + **SRI** baseline | missing/weak CSP, inline event handlers, partial HSTS, **CORS reflect-origin+credentials, external script without SRI, monorepo `next.config` header gap** |
 | **pii_exposure** | unmasked PII at the output boundary | `res.json(rawEntity)` with PII + **a masking control defined but with zero live call sites** (value-shape, not field-name) |
 | graphql | GraphQL surface | introspection (**AppSync `introspectionConfig: DISABLED`-aware**) / playground / depth-limit **+ AppSync subscription-authz (cross-group BOLA)** |
 | integrations | third-party + webhooks **+ outbound-action endpoints** | unsigned webhooks **+ email/SMS/push handlers with no auth or IP-only rate-limit + redundant secret-fetch** |
@@ -180,7 +181,7 @@ upload, cross-tenant BOLA, role/authz gaps).
 ## Tests
 
 ```bash
-python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 139 tests
+python3 -m unittest discover -s tests    # stdlib only, no Noir/network — 203 tests
 ```
 
 ## Releasing (maintainer)
@@ -206,7 +207,9 @@ publisher** with project `websec-validator`, owner `raccioly`, repo `websec-vali
 
 ## Status / roadmap
 
-**Done:** 18-extractor recon (incl. schema/entity → mass-assignment targeting, the **AWS-CDK /
+**Done:** 19-extractor recon (incl. an **authz-correctness data-flow extractor** — unsigned-cookie /
+claim-keyed authz / transaction-local RLS — plus **CORS-misconfig**, **SRI**, **host-header
+open-redirect** and **SSRF-redirect-hardening** classes, schema/entity → mass-assignment targeting, the **AWS-CDK /
 managed-AppSync / VTL boundary**, **upload-security** + **PII-output-boundary** + **redirect-SSRF**
 + **password-reuse** classes, a **man-in-the-browser / tamperable-display** class, an **LLM / AI-agent
 extractor** (OWASP LLM Top 10 — prompt injection / insecure output / excessive agency / unbounded

{websec_validator-0.7.0 → websec_validator-0.8.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "websec-validator"
-version = "0.7.0"
+version = "0.8.1"
 description = "Defensive, local-first security recon that briefs your AI coding agent on your own codebase — read-only by default (code in, artifacts out): facts + tailored probe scripts, no LLM, no server, no running app."
 readme = "README.md"
 requires-python = ">=3.11"

{websec_validator-0.7.0 → websec_validator-0.8.1}/src/websec_validator/dynamic.py

@@ -73,11 +73,48 @@ def mint(cfg: dict, role: str) -> dict:
         return {"error": f"{type(e).__name__}: {e}"}
     token = _dig(d, cfg.get("token_json_path", "tokens.accessToken"))
     user = _dig(d, cfg.get("user_json_path", "user")) or {}
-    tenants = user.get(cfg.get("tenant_field", "groupIds")) or []
-    return {"token": token, "tenant": tenants[0] if tenants else None,
+    return {"token": token, "tenant": _first_tenant(user.get(cfg.get("tenant_field", "groupIds"))),
             "email": user.get("email"), "role": user.get("role")}
 
 
+def _first_tenant(raw):
+    """The first tenant id from a field that may be a list (`groupIds: [5]`) OR a singular scalar
+    (`groupId: 5` / "acme"). Coerce to a list before indexing — else a scalar int crashes (`5[0]`
+    TypeError, uncaught) and a scalar string silently yields a single-CHARACTER tenant."""
+    tenants = raw if isinstance(raw, list) else ([raw] if raw is not None else [])
+    return tenants[0] if tenants else None
+
+
+def _no_records(body: str) -> bool:
+    """True if a 200/206 response carries NO records (so a cross-tenant read is NOT a leak).
+
+    Parses JSON and tests emptiness STRUCTURALLY instead of string-matching a tiny allowlist
+    (`[]`/`{}`/`{"data":[]}`) — that allowlist misclassified common empty wrappers (`{"items":[]}`,
+    whitespace-formatted `{ "data": [] }`, paginated `{"data":[],"total":0}`) as LEAKs. Conservative:
+    anything that isn't provably empty is treated as DATA, so a real leak is never masked."""
+    if not body or not body.strip():
+        return True
+
+    def empty(x) -> bool:
+        if x is None or x == "" or x == []:
+            return True
+        if isinstance(x, list):
+            return len(x) == 0
+        if isinstance(x, dict):
+            if not x:
+                return True
+            cols = [v for v in x.values() if isinstance(v, (list, dict))]
+            # empty only when there's at least one data container and ALL of them are empty
+            # (scalar siblings like total/page/count are treated as pagination meta).
+            return bool(cols) and all(empty(c) for c in cols)
+        return False   # a bare scalar payload → treat as data, not empty
+
+    try:
+        return empty(json.loads(body))
+    except Exception:
+        return False   # opaque / non-JSON 200 content → can't prove empty; surface it as a lead
+
+
 def _tenant_only_get_endpoints(facts: dict, param: str) -> list:
     """GET endpoints whose ONLY path param is the tenant param — clean cross-tenant
     list targets that need no other fixture id."""
@@ -112,10 +149,8 @@ def cross_tenant_bola(cfg: dict, facts: dict) -> dict:
             code, body = _request("GET", url, atk["token"])
             if code in (401, 403, 404):
                 verdict = "blocked"
-            elif code in (200, 206) and body and body.strip() not in ("[]", "{}", '{"data":[]}'):
-                verdict = "LEAK"
             elif code in (200, 206):
-                verdict = "blocked-empty"   # 200 but no cross-tenant data returned
+                verdict = "blocked-empty" if _no_records(body) else "LEAK"  # structural, not string-match
             else:
                 verdict = "investigate"
             results.append({"path": path, "direction": direction, "status": code, "verdict": verdict})

{websec_validator-0.7.0 → websec_validator-0.8.1}/src/websec_validator/extractors/__init__.py

@@ -11,6 +11,7 @@ from pathlib import Path
 
 from .auth import AuthExtractor
 from .authz import AuthzExtractor
+from .authz_dataflow import AuthzDataflowExtractor
 from .base import MAX_FILES, Extractor, RepoContext
 from .client_exposure import ClientExposureExtractor
 from .client_integrity import ClientIntegrityExtractor
@@ -50,6 +51,7 @@ REGISTRY: list[Extractor] = [
     IntegrationsExtractor(),
     LlmSecurityExtractor(),
     CryptoUsageExtractor(),
+    AuthzDataflowExtractor(),
 ]
 
 

websec_validator-0.8.1/src/websec_validator/extractors/authz_dataflow.py

@@ -0,0 +1,110 @@
+"""Authorization data-flow extractor — authz CORRECTNESS, not just presence.
+
+`authz.py` answers "is there a guard on this route?". This answers the next question — "does the guard
+trust the right thing?" — for three real broken-access-control patterns the route-level model can't see:
+
+  - **Unsigned-cookie authorization (CWE-565/602)** — an access decision keyed on a client-settable,
+    unsigned cookie (`twin-access-level`, `*role*`, `*allowed*`). httpOnly stops JS reads but the user
+    still controls their own cookie jar (devtools/curl), so the gate is forgeable.
+  - **Claim → authz decision (CWE-639/807)** — an authorization check that compares a profile-ish JWT
+    BODY claim (office/role/group/tenant) the user may influence, instead of a server-resolved record.
+  - **Transaction-local RLS context (CWE-1188)** — `set_config('app.*', x, true)` (is_local=true)
+    emitted at autocommit (no surrounding transaction): the RLS principal resets before the handler's
+    query runs, so row-level security evaluates with an EMPTY context — defense-in-depth theater.
+
+All are file-level co-occurrence heuristics, server-side + test-excluded, framed as leads to verify —
+a static scan can't prove the cookie is the one that gates, only point the agent at the file.
+"""
+
+from __future__ import annotations
+
+import re
+
+from .base import Extractor, RepoContext, is_client_file, is_test_file
+
+# --- unsigned-cookie authorization ---
+COOKIE_AUTHZ_READ = re.compile(
+    r"(?:cookies?\.get|req\.cookies|getCookie|cookieStore\.get)\s*\(?\s*['\"]"
+    r"([\w-]*(?:access|role|admin|allow|auth|tier|perm|priv|level|scope|tenant|clerk-user)[\w-]*)['\"]", re.I)
+AUTHZ_GATE = re.compile(
+    r"\b403\b|status\s*\(\s*40[13]|\.redirect\s*\([^)]*(?:login|signin|default|unauthorized|forbidden)"
+    r"|[!=]==\s*['\"](?:full|admin|allowed|true|owner)|normalizeAccess|accessLevel|hasAccess|requireFull|denyAccess", re.I)
+COOKIE_VERIFY = re.compile(
+    r"jwtVerify|jwt\.verify|verifyToken|verifyCookie|\bhmac\b|timingSafeEqual|unseal|\bdecrypt\b"
+    r"|signed\s*:\s*true|cookie-signature|verifySignature|getServerSession", re.I)
+
+# --- claim → authz decision ---
+AUTHZ_FN = re.compile(
+    r"function\s+(?:can|authorize|check|assert)\w*|(?:const|let)\s+(?:can|authorize|check)\w*\s*=\s*"
+    r"|\bcan[A-Z]\w*\s*\(|\bauthoriz\w*\s*\(|visibilit|buildVisibility|accessControl|ACL\b", re.I)
+# a profile-ish claim taken from the JWT BODY / request identity (vs a server-resolved record)
+CLAIM_SRC = re.compile(
+    r"jwtPayload\s*\[\s*['\"](?:office|role|roles|group|org|department|tenant|plan|tier|scope)"
+    r"|payload\.(?:office|role|group|org|department|tenant)\b"
+    r"|claims?\s*[\[.]\s*['\"]?(?:office|role|group|org|department|tenant)"
+    r"|\.tenant(?:Office|Role|Group|Plan)\b|req\.(?:user|auth)\.(?:office|role|group|org|department)\b", re.I)
+CLAIM_COMPARE = re.compile(r"[!=]==|\.(?:includes|has|some)\s*\(|\bin\s+\[", re.I)
+
+# --- transaction-local RLS context ---
+SET_CONFIG_LOCAL = re.compile(r"set_config\s*\(\s*['\"]app\.[\w.]+['\"]\s*,[^,()]+,\s*true\s*\)", re.I)
+IN_TRANSACTION = re.compile(
+    r"\bBEGIN\b|\bSTART\s+TRANSACTION\b|\.transaction\s*\(|withTransaction|db\.transaction|\btx\b\.|\btrx\b\.|\bBEGIN;|"
+    r"transaction\s*\(\s*async", re.I)
+
+
+class AuthzDataflowExtractor(Extractor):
+    name = "authz_dataflow"
+    category = "authz"
+
+    def extract(self, ctx: RepoContext, facts: dict) -> dict:
+        findings: list = []
+        seen: set = set()
+
+        def add(sev, kind, attack, rel, detail):
+            if (kind, rel) in seen:
+                return
+            seen.add((kind, rel))
+            findings.append({"severity": sev, "kind": kind, "attack_class": attack,
+                             "file": rel, "detail": detail})
+
+        for _p, rel, text in ctx.iter_code():
+            if is_test_file(rel) or is_client_file(rel, text):
+                continue
+
+            # 1. authorization decision keyed on an unsigned cookie
+            m = COOKIE_AUTHZ_READ.search(text)
+            if m and AUTHZ_GATE.search(text) and not COOKIE_VERIFY.search(text):
+                add("MEDIUM", "unsigned-cookie-authz", "cookie-authz", rel,
+                    f"An access decision appears to be keyed on a client-settable cookie "
+                    f"(`{m.group(1)}`) with no signature/JWT/HMAC verification in this file. httpOnly only "
+                    "blocks JS reads — the user still controls their own cookie jar, so they can forge the "
+                    "value and pass the gate (CWE-565/602). Bind access to a signed value (read it from the "
+                    "verified session JWT, or HMAC the cookie) and re-derive server-side.")
+
+            # 2. authz decision comparing a user-influenceable JWT claim
+            if AUTHZ_FN.search(text) and CLAIM_SRC.search(text) and CLAIM_COMPARE.search(text):
+                add("LOW", "claim-based-authz", "claim-authz", rel,
+                    "An authorization check appears to compare a profile-ish JWT BODY claim "
+                    "(office/role/group/tenant) that the user may be able to influence, rather than a "
+                    "value resolved from the authenticated record (CWE-639/807). VERIFY the claim is "
+                    "server-resolved and non-user-editable; otherwise resolve it from the tenant/user row "
+                    "inside the request, and never write a client-asserted claim back as the record of truth.")
+
+            # 3. transaction-local RLS context set outside a transaction (resets before the query)
+            if SET_CONFIG_LOCAL.search(text) and not IN_TRANSACTION.search(text):
+                add("MEDIUM", "rls-context-no-transaction", "rls-context", rel,
+                    "`set_config('app.*', …, true)` sets the RLS principal TRANSACTION-LOCALLY "
+                    "(is_local=true) but there's no surrounding transaction in this file — at autocommit "
+                    "the setting resets the instant that one statement commits, before any handler query "
+                    "runs, so RLS evaluates with an EMPTY context (CWE-1188, defense-in-depth theater). "
+                    "Set it INSIDE the transaction that runs the tenant-scoped query, on the SAME "
+                    "connection the handler uses (or use is_local=false on a dedicated per-request connection).")
+
+        by_sev: dict = {}
+        for f in findings:
+            by_sev[f["severity"]] = by_sev.get(f["severity"], 0) + 1
+        return {"findings": findings, "by_severity": by_sev,
+                "note": (f"{len(findings)} authz-correctness lead(s) — these check whether a guard trusts the "
+                         "RIGHT thing (signed cookie / server-resolved claim / live RLS context), not just whether "
+                         "a guard exists. Verify each against the data flow.") if findings
+                        else "No unsigned-cookie / claim-keyed-authz / transaction-local-RLS tells found."}

{websec_validator-0.7.0 → websec_validator-0.8.1}/src/websec_validator/extractors/iac_ci.py

@@ -102,7 +102,7 @@ class IacCiExtractor(Extractor):
                          "free-text injectable); verify, low exploitability" if sha_only else "")
                 findings.append({"severity": sev, "kind": "gha-script-injection", "file": rel,
                                  "detail": "untrusted context interpolated into a run: step — "
-                                           + ", ".join("github." + c for c in contexts[:4]) + extra})
+                                           + ", ".join(contexts[:4]) + extra})
             unpinned = sorted({f"{a}@{r}" for a, r in USES.findall(text)
                                if not SHA40.match(r) and not a.startswith("./")})
             if unpinned:

{websec_validator-0.7.0 → websec_validator-0.8.1}/src/websec_validator/extractors/policy_consistency.py

@@ -33,8 +33,12 @@ VALIDATION_SIGNAL = re.compile(
 _LA = r"\(\?=[^)]{0,40}"
 _RE_MIN = re.compile(r"\.min\(\s*(\d{1,3})|minLength\s*[:=]\s*(\d{1,3})|@MinLength\(\s*(\d{1,3})"
                      r"|\.length\s*>=?\s*(\d{1,3})|\{\s*(\d{1,3})\s*,")
-_RE_UPPER = re.compile(_LA + r"\[[^\]]*A-Z|minUppercase\s*:\s*[1-9]|requireUppercase\s*[:=]\s*true", re.I)
-_RE_LOWER = re.compile(_LA + r"\[[^\]]*a-z|minLowercase\s*:\s*[1-9]|requireLowercase\s*[:=]\s*true", re.I)
+# The char-class branch must be case-SENSITIVE: under re.I a literal `A-Z` also matches `a-z`, so a
+# lowercase-only rule `(?=.*[a-z])` was mis-counted as ALSO requiring uppercase — inflating the class
+# set and masking real drift (a lower-only sibling looked equal to an upper+lower policy). `(?-i:...)`
+# locally disables re.I for just the range token; the keyword branches keep re.I for casing tolerance.
+_RE_UPPER = re.compile(_LA + r"\[[^\]]*(?-i:A-Z)|minUppercase\s*:\s*[1-9]|requireUppercase\s*[:=]\s*true", re.I)
+_RE_LOWER = re.compile(_LA + r"\[[^\]]*(?-i:a-z)|minLowercase\s*:\s*[1-9]|requireLowercase\s*[:=]\s*true", re.I)
 _RE_DIGIT = re.compile(_LA + r"(?:\\d|\[[^\]]*0-9)|minNumbers\s*:\s*[1-9]|requireDigit\s*[:=]\s*true", re.I)
 _RE_SPECIAL = re.compile(_LA + r"(?:\\W|\[\^[A-Za-z0-9\\w]|\[[^\]]*[!@#$%^&*])|minSymbols\s*:\s*[1-9]"
                          r"|require[_]?Symbol", re.I)

{websec_validator-0.7.0 → websec_validator-0.8.1}/src/websec_validator/extractors/routes.py

@@ -211,7 +211,11 @@ def _fallback_next_app_router(ctx: RepoContext) -> list:
 
 def _fallback_regex(ctx: RepoContext) -> list:
     rows = []
-    flask = re.compile(r"@\w+\.route\s*\(\s*['\"]([^'\"]+)['\"](?:.*methods\s*=\s*\[([^\]]*)\])?", re.S)
+    # `[^)]*?` (not `.*` with re.S) keeps the optional methods= group INSIDE this one route() call:
+    # a greedy DOTALL `.*` reaches across the file to the LAST methods=[...], mis-assigning it to the
+    # first route and silently swallowing every route in between (only routes after the final
+    # methods=[...] survived). Staying within the call parens fixes both the mislabel and the drop.
+    flask = re.compile(r"@\w+\.route\s*\(\s*['\"]([^'\"]+)['\"](?:[^)]*?methods\s*=\s*\[([^\]]*)\])?")
     fastapi = re.compile(r"@\w+\.(get|post|put|patch|delete)\s*\(\s*['\"]([^'\"]+)")
     for _p, rel, text in ctx.iter_code():
         for verb, path in fastapi.findall(text):

{websec_validator-0.7.0 → websec_validator-0.8.1}/src/websec_validator/extractors/surface.py

@@ -108,6 +108,24 @@ DOTSEG_GUARD = re.compile(
     r"includes\s*\(\s*['\"]\.\.|===\s*['\"]\.\.['\"]|['\"]\.\.['\"]\s*\)|%2e|%2f|decodeURIComponent"
     r"|\bnormalize\b|startsWith\s*\(\s*['\"]/[\w]|sanitiz|assertPath|safeJoin|\bresolve\b[^;]{0,40}startsWith", re.I)
 
+# Host-header → redirect (open redirect / cache poisoning, CWE-601): a redirect Location/origin built
+# from the attacker-controllable Host / X-Forwarded-Host header with no host allow-list comparison.
+HOST_HEADER_READ = re.compile(
+    r"(?:req|request|ctx)\.(?:headers?\s*[\[.]|get\s*\(\s*)['\"]?(?:x-forwarded-host|forwarded|host)\b"
+    r"|headers\.get\s*\(\s*['\"](?:x-forwarded-host|host|forwarded)", re.I)
+REDIRECT_SINK = re.compile(
+    r"\.redirect\s*\(|NextResponse\.redirect|res\.setHeader\s*\(\s*['\"]Location|['\"]Location['\"]\s*[:,]|sendRedirect", re.I)
+HOST_ALLOWLIST = re.compile(
+    r"allowedHosts?|allow[_-]?list|publicOrigin|publicWebOrigin|trustedHosts?|isAllowedHost|whitelist|brandfolderHostnames", re.I)
+# SSRF-hardening: an outbound client DELIBERATELY following redirects with no host allow-list /
+# private-range deny — a 30x to an internal/metadata host is then fetched server-side (CWE-918),
+# independent of whether the INITIAL url is user-tainted. Reaches worker/job scripts the route scan misses.
+FOLLOW_REDIR = re.compile(r"follow_redirects\s*=\s*True|allow_redirects\s*=\s*True|maxRedirects\s*:\s*[1-9]", re.I)
+OUTBOUND_CLIENT = re.compile(r"\b(?:requests\.\w+|httpx\.\w+|\bfetch\s*\(|axios|got\s*\(|node-fetch|urllib\.request)", re.I)
+SSRF_PRIVATE_GUARD = re.compile(
+    r"allow_redirects\s*=\s*False|follow_redirects\s*=\s*False|maxRedirects\s*:\s*0|169\.254|RFC1918|is_private|"
+    r"ip_address|private_?range|block.?(?:internal|private)|allowedHosts?|allow[_-]?list", re.I)
+
 
 class SurfaceExtractor(Extractor):
     name = "surface"
@@ -122,6 +140,8 @@ class SurfaceExtractor(Extractor):
         counts: dict = {k: 0 for k in SINKS}
         ssrf_redirect: list = []    # SSRF sink in a file with NO per-hop redirect guard (#1)
         proxy_escape: list = []     # reverse-proxy prefix-escape (confined-deputy)
+        host_redirect: list = []    # redirect built from the Host/X-Forwarded-Host header (open redirect)
+        follows_redirect: list = []  # outbound client follows redirects with no allow-list (SSRF-hardening)
         for _p, rel, text in ctx.iter_code():
             # Test fixtures are never a runtime sink; SSRF + outbound-HTTP are SERVER-ONLY classes,
             # so client (.tsx/'use client') and build/CLI scripts can't host them (validated: these
@@ -153,6 +173,17 @@ class SurfaceExtractor(Extractor):
             if (len(proxy_escape) < 30 and not nonserver and PROXY_JOIN.search(text)
                     and PROXY_FETCH.search(text) and not DOTSEG_GUARD.search(text)):
                 proxy_escape.append(rel)
+            # host-header → redirect (open redirect via Host/X-Forwarded-Host). Server-only; needs a
+            # redirect sink + a host-header read + no host allow-list in the file.
+            if (len(host_redirect) < 30 and not nonserver and HOST_HEADER_READ.search(text)
+                    and REDIRECT_SINK.search(text) and not HOST_ALLOWLIST.search(text)):
+                host_redirect.append(rel)
+            # SSRF-hardening: follows redirects with no allow-list / private-range deny. Worker/job
+            # SCRIPTS are in scope here (they fetch server-side), so only client + tests are excluded.
+            if (len(follows_redirect) < 30 and not is_client_file(rel, text)
+                    and FOLLOW_REDIR.search(text) and OUTBOUND_CLIENT.search(text)
+                    and not SSRF_PRIVATE_GUARD.search(text)):
+                follows_redirect.append(rel)
 
         sinks = {k: {"probe": SINKS[k][0], "count": counts[k], "files": found[k]}
                  for k in SINKS if counts[k]}
@@ -161,6 +192,8 @@ class SurfaceExtractor(Extractor):
             "sink_counts": {k: counts[k] for k in SINKS if counts[k]},
             "ssrf_redirect_unguarded": ssrf_redirect,   # validate EVERY hop, not just the input URL (#1)
             "proxy_prefix_escape": proxy_escape,        # confined-deputy via `..` in catch-all path
+            "host_header_redirect": host_redirect,      # open redirect via Host/X-Forwarded-Host
+            "follows_redirect_no_allowlist": follows_redirect,  # SSRF-hardening (redirect-to-internal)
             "datastore_class": ("sql" if has_sql else ("nosql" if has_nosql else "unknown")),
             "note": "Each sink hit is user-input-gated (req./request./concat/interp), so these are "
                     "higher-confidence leads. Cross-reference the files with routes.targeting to pick "

{websec_validator-0.7.0 → websec_validator-0.8.1}/src/websec_validator/extractors/transport_security.py

@@ -19,7 +19,7 @@ from __future__ import annotations
 
 import re
 
-from .base import Extractor, RepoContext
+from .base import Extractor, RepoContext, is_script_file, is_test_file
 
 CSP_ANY = re.compile(r"Content-Security-Policy|contentSecurityPolicy|helmet[\s\S]{0,40}?\bcsp\b"
                      r"|useCspNonce|cspDirectives", re.I)
@@ -54,6 +54,22 @@ CK_SECURE = re.compile(
     r"[A-Za-z_$][\w$.]*\s*[=!]==|[A-Za-z_$][\w$.]*\s*\?|[A-Za-z_$][\w$.]*\([^)]*\))", re.I)
 CK_SAMESITE = re.compile(r"samesite", re.I)
 
+# CORS misconfiguration — the high-impact form is an Allow-Origin that REFLECTS the request Origin (or
+# `*`) TOGETHER with Allow-Credentials:true, which lets any site read authenticated responses.
+CORS_REFLECT = re.compile(
+    r"Access-Control-Allow-Origin['\"]?\s*[,:][^,\n)]{0,60}(?:req\.|request\.|headers?\.origin|get\s*\(\s*['\"]origin|\borigin\b)"
+    r"|cors\s*\(\s*\{[^}]*origin\s*:\s*true|origin\s*:\s*(?:true|function|\(origin)|reflectOrigin|originReflect", re.I)
+CORS_WILDCARD = re.compile(r"Access-Control-Allow-Origin['\"]?\s*[,:]\s*['\"]\*['\"]|\borigin\s*:\s*['\"]\*['\"]", re.I)
+CORS_CREDS = re.compile(r"Access-Control-Allow-Credentials['\"]?\s*[,:]\s*['\"]?true|credentials\s*:\s*true", re.I)
+# an external <script src="https://…"> with no Subresource-Integrity (supply-chain: a CDN compromise
+# runs arbitrary JS in your origin). Only meaningful in code that emits HTML.
+EXT_SCRIPT = re.compile(r"<script\b[^>]*\ssrc\s*=\s*['\"]https?://[^'\"]+['\"][^>]*>", re.I)
+SRI_OK = re.compile(r"\bintegrity\s*=", re.I)
+# a Next.js config that defines security headers via headers()
+NEXT_HEADERS_FN = re.compile(r"async\s+headers\s*\(|\bheaders\s*\(\s*\)\s*\{|key\s*:\s*['\"](?:Content-Security-Policy|X-Frame-Options|Strict-Transport-Security|X-Content-Type-Options)['\"]", re.I)
+NEXT_CSP = re.compile(r"Content-Security-Policy", re.I)
+NEXT_XFO = re.compile(r"X-Frame-Options|frame-ancestors", re.I)
+
 
 class TransportSecurityExtractor(Extractor):
     name = "transport_security"
@@ -69,6 +85,7 @@ class TransportSecurityExtractor(Extractor):
         inline_handlers = []
         sets_cookie = ck_httponly = ck_secure = ck_samesite = False
         hsts_files, hsts_api_only, hsts_html = [], True, False
+        extra_findings: list = []     # CORS / SRI / next-config — emitted alongside the CSP/HSTS set
 
         # config manifests carry headers too (next.config, vercel.json, netlify.toml, _headers)
         manifests = "\n".join(ctx.manifest(n) for n in
@@ -76,9 +93,37 @@ class TransportSecurityExtractor(Extractor):
                                "netlify.toml", "public/_headers", "static/_headers", "nginx.conf"))
 
         for _p, rel, text in ctx.iter_code():
+            if is_test_file(rel) or is_script_file(rel):
+                continue
             if HTML_SURFACE.search(rel) or HTML_CONTENT.search(text):
                 html_surface = True
             blob = text
+            # CORS misconfig — reflected/wildcard Allow-Origin together with credentials = any site
+            # reads authed responses (CWE-942). Server-side only.
+            if CORS_CREDS.search(blob) and (CORS_REFLECT.search(blob) or CORS_WILDCARD.search(blob)):
+                extra_findings.append({"severity": "HIGH", "kind": "cors-credentials-any-origin",
+                                       "attack_class": "cors-misconfig", "file": rel,
+                                       "detail": "CORS reflects the request Origin (or uses `*`) AND sets "
+                                       "Allow-Credentials:true — any website can make credentialed cross-origin "
+                                       "requests and READ the authenticated responses (CWE-942). Allow-list exact "
+                                       "trusted origins; never reflect Origin or use `*` when credentials are on."})
+            elif CORS_REFLECT.search(blob):
+                extra_findings.append({"severity": "MEDIUM", "kind": "cors-reflects-origin",
+                                       "attack_class": "cors-misconfig", "file": rel,
+                                       "detail": "CORS appears to reflect the request Origin (echo-back / `origin:true`) "
+                                       "rather than allow-listing exact origins. Safe only without credentials and with a "
+                                       "strict allow-list — verify it can't be turned into a credentialed cross-origin read."})
+            # external script with no SRI, in code that emits HTML
+            if (HTML_CONTENT.search(blob) or HTML_SURFACE.search(rel)):
+                for m in EXT_SCRIPT.finditer(blob):
+                    if not SRI_OK.search(m.group(0)):
+                        extra_findings.append({"severity": "MEDIUM", "kind": "external-script-no-sri",
+                                               "attack_class": "subresource-integrity", "file": rel,
+                                               "detail": "An external <script src=\"https://…\"> is loaded with no "
+                                               "Subresource-Integrity (`integrity=`) hash / version pin — a CDN or "
+                                               "package compromise runs arbitrary JS in this origin (CWE-829). Pin the "
+                                               "version + add an SRI hash + `crossorigin`, or self-host the bundle."})
+                        break
             if CSP_ANY.search(blob):
                 csp_present = True
                 if CSP_SCRIPT_SELF.search(blob):
@@ -121,9 +166,30 @@ class TransportSecurityExtractor(Extractor):
             if HSTS_PRELOAD.search(manifests):
                 hsts_preload = True
 
+        # Monorepo-aware Next.js config header gap — `transport_security` previously only read the
+        # ROOT next.config via manifests, so a `packages/web/next.config.ts` was invisible. Glob every
+        # next.config.* and flag one with no security-header block (CSP + X-Frame-Options).
+        for nc in (ctx.glob("**/next.config.js") + ctx.glob("**/next.config.mjs")
+                   + ctx.glob("**/next.config.ts")):
+            rel, txt = ctx.rel(nc), ctx.text(nc)
+            if not NEXT_HEADERS_FN.search(txt):
+                extra_findings.append({"severity": "MEDIUM", "kind": "nextjs-no-security-headers",
+                                       "attack_class": "missing-csp", "file": rel,
+                                       "detail": "This Next.js config defines no security-header block (`headers()`) — "
+                                       "so no app-wide Content-Security-Policy, X-Frame-Options/frame-ancestors, HSTS, "
+                                       "X-Content-Type-Options, or Referrer-Policy unless an upstream edge sets them. Add "
+                                       "a `headers()` matcher (start CSP report-only) or document that nginx/CDN owns them."})
+            elif not (NEXT_CSP.search(txt) and NEXT_XFO.search(txt)):
+                miss = ", ".join(n for n, ok in (("CSP", NEXT_CSP.search(txt)),
+                                                 ("X-Frame-Options/frame-ancestors", NEXT_XFO.search(txt))) if not ok)
+                extra_findings.append({"severity": "LOW", "kind": "nextjs-partial-security-headers",
+                                       "attack_class": "missing-csp", "file": rel,
+                                       "detail": f"Next.js config has a headers() block but is missing {miss}. Add the "
+                                       "clickjacking/XSS-defense headers (verify against the live response if the edge sets some)."})
+
         strict_csp = bool(csp_present and csp_self and csp_nonce and not csp_unsafe)
         web_surface = html_surface or has_routes
-        findings = []
+        findings = list(extra_findings)
 
         if html_surface:
             if not csp_present: