wpsecscan 2.7.1__tar.gz → 2.7.3__tar.gz

{wpsecscan-2.7.1/wpsecscan.egg-info → wpsecscan-2.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wpsecscan
-Version: 2.7.1
+Version: 2.7.3
 Summary: Defensive WordPress security scanner. 200+ checks, 8-source nightly CVE aggregator, AI-assisted remediation (BYO key), 15 compliance frameworks (OWASP/PCI/NIST/ISO/HIPAA/SOC2/HITRUST/CMMC), Sigstore-signed releases with SLSA L3 provenance, 10 threat-intel feeds (KEV/EPSS/Exploit-DB/ATT&CK/STIX/MISP/OTX/GreyNoise), continuous monitors, consent-gated exploit verification, multi-tenant RBAC/SSO/audit-log enterprise mode, 12 report formats. Authorized testing only.
 Author-email: Bryan <bryaninbangkok@gmail.com>
 License:                     GNU AFFERO GENERAL PUBLIC LICENSE
@@ -693,31 +693,31 @@ Requires-Dist: httpx[http2]<0.29,>=0.27
 Requires-Dist: jinja2<4,>=3.1
 Requires-Dist: rich<14,>=13.7
 Requires-Dist: openpyxl<4,>=3.1
-Requires-Dist: keyring>=24
+Requires-Dist: keyring<26,>=24
 Provides-Extra: pdf
-Requires-Dist: reportlab>=4.0; extra == "pdf"
+Requires-Dist: reportlab<5,>=4.0; extra == "pdf"
 Provides-Extra: browser
-Requires-Dist: playwright>=1.40; extra == "browser"
+Requires-Dist: playwright<2,>=1.40; extra == "browser"
 Provides-Extra: yaml
-Requires-Dist: pyyaml>=6.0; extra == "yaml"
+Requires-Dist: pyyaml<7,>=6.0; extra == "yaml"
 Provides-Extra: ops
-Requires-Dist: redis>=5.0; extra == "ops"
-Requires-Dist: bcrypt>=4.0; extra == "ops"
+Requires-Dist: redis<7,>=5.0; extra == "ops"
+Requires-Dist: bcrypt<5,>=4.0; extra == "ops"
 Provides-Extra: ui
-Requires-Dist: Pillow>=10; extra == "ui"
-Requires-Dist: pystray>=0.19; extra == "ui"
+Requires-Dist: Pillow<12,>=10; extra == "ui"
+Requires-Dist: pystray<0.20,>=0.19; extra == "ui"
 Provides-Extra: security
-Requires-Dist: defusedxml>=0.7; extra == "security"
+Requires-Dist: defusedxml<0.8,>=0.7; extra == "security"
 Provides-Extra: all
-Requires-Dist: reportlab>=4.0; extra == "all"
-Requires-Dist: playwright>=1.40; extra == "all"
-Requires-Dist: pyyaml>=6.0; extra == "all"
-Requires-Dist: redis>=5.0; extra == "all"
-Requires-Dist: bcrypt>=4.0; extra == "all"
-Requires-Dist: Pillow>=10; extra == "all"
-Requires-Dist: pystray>=0.19; extra == "all"
-Requires-Dist: keyring>=24; extra == "all"
-Requires-Dist: defusedxml>=0.7; extra == "all"
+Requires-Dist: reportlab<5,>=4.0; extra == "all"
+Requires-Dist: playwright<2,>=1.40; extra == "all"
+Requires-Dist: pyyaml<7,>=6.0; extra == "all"
+Requires-Dist: redis<7,>=5.0; extra == "all"
+Requires-Dist: bcrypt<5,>=4.0; extra == "all"
+Requires-Dist: Pillow<12,>=10; extra == "all"
+Requires-Dist: pystray<0.20,>=0.19; extra == "all"
+Requires-Dist: keyring<26,>=24; extra == "all"
+Requires-Dist: defusedxml<0.8,>=0.7; extra == "all"
 Provides-Extra: test
 Requires-Dist: pytest>=7.4; extra == "test"
 Dynamic: license-file

{wpsecscan-2.7.1 → wpsecscan-2.7.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "wpsecscan"
-version = "2.7.1"
+version = "2.7.3"
 description = "Defensive WordPress security scanner. 200+ checks, 8-source nightly CVE aggregator, AI-assisted remediation (BYO key), 15 compliance frameworks (OWASP/PCI/NIST/ISO/HIPAA/SOC2/HITRUST/CMMC), Sigstore-signed releases with SLSA L3 provenance, 10 threat-intel feeds (KEV/EPSS/Exploit-DB/ATT&CK/STIX/MISP/OTX/GreyNoise), continuous monitors, consent-gated exploit verification, multi-tenant RBAC/SSO/audit-log enterprise mode, 12 report formats. Authorized testing only."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -41,37 +41,45 @@ dependencies = [
     # fell back to plain JSON. creds_vault still gracefully handles the
     # missing-keyring case so headless installs without a backend keep
     # working (the FailBackend check in creds_vault._have_keyring).
-    "keyring>=24",
+    # C26 (v2.7.2) — upper bound on keyring; v25+ tends to break the
+    # backend-detection API. Without an upper bound `pip install` will
+    # pull majors that change behaviour silently.
+    "keyring>=24,<26",
 ]
 
 [project.optional-dependencies]
+# C26 (v2.7.2) — every optional dep now has an upper-bound. Without one
+# `pip install 'wpsecscan[ui]'` would silently pull the next major of
+# Pillow / reportlab / etc., any of which can introduce a breaking
+# change OR (in Pillow's case) a fresh CVE. Bumps are still possible
+# but become a deliberate code review.
 # Real PDF executive / attestation reports
-pdf = ["reportlab>=4.0"]
+pdf = ["reportlab>=4.0,<5"]
 # Headless DOM-XSS check + per-finding screenshots
-browser = ["playwright>=1.40"]
+browser = ["playwright>=1.40,<2"]
 # Daemon mode YAML config
-yaml = ["pyyaml>=6.0"]
+yaml = ["pyyaml>=6.0,<7"]
 # Distributed CVE-DB cache + RBAC bcrypt hashing
-ops = ["redis>=5.0", "bcrypt>=4.0"]
+ops = ["redis>=5.0,<7", "bcrypt>=4.0,<5"]
 # Optional Pillow for GUI image rendering + pystray for minimize-to-tray (#56).
 # (keyring moved to default `dependencies` in v2.5.1 because the `wpsecscan
 # creds` CLI surface is no longer GUI-only.)
-ui = ["Pillow>=10", "pystray>=0.19"]
+ui = ["Pillow>=10,<12", "pystray>=0.19,<0.20"]
 # S5 — defusedxml protects the burp/zap importer against billion-laughs
 # entity-expansion DoS on hostile XML reports. Stdlib ElementTree falls
 # back with a stderr warning when this isn't installed.
-security = ["defusedxml>=0.7"]
+security = ["defusedxml>=0.7,<0.8"]
 # Everything optional in one install
 all = [
-    "reportlab>=4.0",
-    "playwright>=1.40",
-    "pyyaml>=6.0",
-    "redis>=5.0",
-    "bcrypt>=4.0",
-    "Pillow>=10",
-    "pystray>=0.19",
-    "keyring>=24",
-    "defusedxml>=0.7",
+    "reportlab>=4.0,<5",
+    "playwright>=1.40,<2",
+    "pyyaml>=6.0,<7",
+    "redis>=5.0,<7",
+    "bcrypt>=4.0,<5",
+    "Pillow>=10,<12",
+    "pystray>=0.19,<0.20",
+    "keyring>=24,<26",
+    "defusedxml>=0.7,<0.8",
 ]
 # Test deps (also installed by CI)
 test = ["pytest>=7.4"]

wpsecscan-2.7.3/tests/test_v272_audit_log_constant_time.py

@@ -0,0 +1,49 @@
+"""Regression test for v2.7.2 C2 — audit log HMAC compare must be
+constant-time.
+
+verify_chain() walked each entry and compared `expected != stored_hmac`
+with Python's `!=` operator, which short-circuits on the first differing
+byte. An attacker who can append entries to the log and call verify_chain
+(directly or via a CLI subcommand) can extract one byte at a time of a
+valid HMAC for a tampered prior entry.
+
+The fix is `not hmac.compare_digest(expected, stored_hmac)`.
+"""
+import inspect
+
+from wpsecscan.auth import audit_log
+
+
+def test_verify_chain_uses_compare_digest():
+    """The verifier must invoke `hmac.compare_digest`, not raw `!=`,
+    when comparing the stored HMAC against the recomputed one."""
+    src = inspect.getsource(audit_log.verify_chain)
+    assert "compare_digest" in src, (
+        "verify_chain must compare HMACs via hmac.compare_digest to avoid "
+        "a timing side-channel; bare !=/== leaks one byte per comparison."
+    )
+    # Ensure the old bug-pattern is gone.
+    assert "expected != stored_hmac" not in src
+    assert "stored_hmac != expected" not in src
+
+
+def test_verify_chain_still_catches_tampering(tmp_path, monkeypatch):
+    """Functional check — after the fix, tampering still surfaces as
+    `is_valid == False`."""
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+    audit_log.append("alice", "scan_started", "https://example.com")
+    audit_log.append("alice", "scan_finished", "https://example.com")
+    ok, n, err = audit_log.verify_chain()
+    assert ok is True
+    assert n == 2
+    assert err == ""
+
+    # Tamper with the first entry's action field.
+    log = audit_log._log_path()
+    raw = log.read_text(encoding="utf-8")
+    tampered = raw.replace('"scan_started"', '"scan_HACKED__"', 1)
+    log.write_text(tampered, encoding="utf-8")
+
+    ok, n, err = audit_log.verify_chain()
+    assert ok is False
+    assert "HMAC mismatch" in err or "mismatch" in err

wpsecscan-2.7.3/tests/test_v272_marketplace_sigstore_identity.py

@@ -0,0 +1,134 @@
+"""Regression tests for v2.7.2 C1 — marketplace sigstore identity binding.
+
+v2.7.1 S1 closed the source_url scheme+host bypass, but left two holes:
+
+  1. The sigstore_sig_url and sigstore_pem_url were fetched from any host
+     and any scheme. A malicious or MITM'd index could point them at an
+     attacker-controlled cert+sig pair.
+
+  2. cosign was invoked with `--certificate-identity-regexp '.+'` and
+     `--certificate-oidc-issuer-regexp '.+'`, so ANY Sigstore-signed
+     blob passed verification regardless of who signed it.
+
+Combined: attacker controls the index, supplies their own check + their
+own sig + their own cert ⇒ install succeeds and the malicious code runs
+on the next scan.
+"""
+import pytest
+
+from wpsecscan import marketplace_v27
+
+
+def test_safe_aux_url_rejects_file_scheme():
+    ok, reason = marketplace_v27._safe_aux_url("file:///etc/passwd")
+    assert ok is False
+    assert "https" in reason.lower()
+
+
+def test_safe_aux_url_rejects_foreign_host():
+    ok, reason = marketplace_v27._safe_aux_url("https://evil.example/sig.txt")
+    assert ok is False
+    assert "host" in reason.lower()
+
+
+def test_safe_aux_url_accepts_marketplace_origin(monkeypatch):
+    monkeypatch.setattr(
+        marketplace_v27, "_INDEX_URL",
+        "https://bryanflowers.github.io/wpsecscan/marketplace.json",
+    )
+    ok, reason = marketplace_v27._safe_aux_url(
+        "https://bryanflowers.github.io/wpsecscan/sigs/foo.sig"
+    )
+    assert ok is True
+    assert reason == ""
+
+
+def test_cosign_identity_regexp_is_pinned_to_author(monkeypatch, tmp_path):
+    """The cosign verify-blob command must derive its identity-regexp
+    from the index's author_handle, NOT use a wildcard `.+`."""
+    captured: dict[str, list[str]] = {}
+
+    class _FakeResult:
+        returncode = 0
+        stderr = ""
+
+    def _fake_run(argv, **kw):
+        captured["argv"] = argv
+        return _FakeResult()
+
+    monkeypatch.setattr("subprocess.run", _fake_run)
+    monkeypatch.setattr("shutil.which", lambda x: "/usr/bin/cosign")
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+
+    # Stub the cache so we don't network-fetch the index
+    fake_index = {
+        "_version": 1,
+        "checks": [{
+            "slug": "demo-check",
+            "title": "demo",
+            "description": "x",
+            "author_handle": "alice",
+            "source_url": "https://bryanflowers.github.io/wpsecscan/x.py",
+            "sigstore_sig_url": "https://bryanflowers.github.io/wpsecscan/x.sig",
+            "sigstore_pem_url": "https://bryanflowers.github.io/wpsecscan/x.pem",
+        }],
+    }
+    monkeypatch.setattr(marketplace_v27, "_fetch_index", lambda: fake_index)
+
+    # Pre-create a fake installed local check so the verify path doesn't bail
+    local = tmp_path / "marketplace" / "checks" / "demo-check.py"
+    local.parent.mkdir(parents=True, exist_ok=True)
+    local.write_bytes(b"# stub")
+
+    # Stub urlopen for sig+pem downloads
+    class _FakeResp:
+        def __init__(self, data=b""):
+            self._d = data
+
+        def read(self):
+            return self._d
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *a):
+            return False
+
+    monkeypatch.setattr("urllib.request.urlopen", lambda *a, **k: _FakeResp(b""))
+
+    marketplace_v27.cmd_marketplace(["verify", "demo-check"])
+
+    argv = captured["argv"]
+    assert argv[0] == "cosign"
+    # The identity regexp must include the author handle, not be `.+`
+    identity_idx = argv.index("--certificate-identity-regexp")
+    assert "alice" in argv[identity_idx + 1]
+    assert argv[identity_idx + 1] != ".+"
+    # OIDC issuer must be pinned, not a wildcard regexp
+    assert "--certificate-oidc-issuer-regexp" not in argv
+    issuer_idx = argv.index("--certificate-oidc-issuer")
+    assert argv[issuer_idx + 1] == "https://token.actions.githubusercontent.com"
+
+
+def test_install_rejects_sig_url_from_foreign_host(monkeypatch, tmp_path, capsys):
+    """During install, a malicious index pointing sigstore_sig_url at
+    `evil.example` must be refused before any download happens."""
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+    fake_index = {
+        "_version": 1,
+        "checks": [{
+            "slug": "demo-check",
+            "title": "demo",
+            "description": "x",
+            "author_handle": "alice",
+            "source_url": "https://bryanflowers.github.io/wpsecscan/x.py",
+            "sigstore_sig_url": "https://evil.example/x.sig",
+            "sigstore_pem_url": "https://bryanflowers.github.io/wpsecscan/x.pem",
+        }],
+    }
+    monkeypatch.setattr(marketplace_v27, "_fetch_index", lambda: fake_index)
+    with pytest.raises(SystemExit) as exc:
+        marketplace_v27.cmd_marketplace(["install", "demo-check"])
+    captured = capsys.readouterr()
+    assert exc.value.code != 0
+    assert "sigstore" in captured.err.lower() or "host" in captured.err.lower()

wpsecscan-2.7.3/tests/test_v272_wave2_regressions.py

@@ -0,0 +1,199 @@
+"""Regression tests for v2.7.2 Wave 2 — High-severity fixes.
+
+Covers C3 (audit-log key file atomic 0o600 create), C4 (share-link
+TTL), C7 (argparse off-by-one bounds in 3 subcommands), C9 (verify=
+False removed from login-redirect check), C10 (tarfile extraction
+filter), C11 (api_server token-echo redaction), and C5/C6 (PowerShell
+EncodedCommand path).
+
+C8 (companion plugin email-hash) lives in the PHP layer and is
+smoke-tested via grep below — pytest can't exercise PHP directly.
+"""
+import inspect
+import os
+import sys
+
+import pytest
+
+
+# ---------------------------------------------------------------------------
+# C3 — audit-log HMAC key is created atomically with 0o600
+# ---------------------------------------------------------------------------
+
+def test_audit_log_key_created_atomically_at_0o600(tmp_path, monkeypatch):
+    """The HMAC key file must be created via O_EXCL|0o600 so there is
+    no window between create and chmod where another local user can
+    read the freshly-written key."""
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+    from wpsecscan.auth import audit_log
+    _ = audit_log._hmac_key()
+    key_path = tmp_path / ".audit-hmac-key"
+    assert key_path.exists()
+    # On POSIX, st_mode & 0o777 should be 0o600 immediately.
+    if os.name == "posix":
+        mode = key_path.stat().st_mode & 0o777
+        assert mode == 0o600, f"key file mode {oct(mode)} != 0o600"
+    # Regardless of OS, the source must use the atomic pattern.
+    src = inspect.getsource(audit_log._hmac_key)
+    assert "O_EXCL" in src
+    assert "0o600" in src
+
+
+# ---------------------------------------------------------------------------
+# C4 — share-link payload carries issued_at/expires_at; verify rejects expired
+# ---------------------------------------------------------------------------
+
+def _build_test_payload(monkeypatch, tmp_path, ttl=3600):
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+    from wpsecscan.models import Finding, CheckResult, ScanReport
+    from wpsecscan.reporters import share_link
+    f = Finding(severity="high", title="x", evidence="y")
+    cr = CheckResult(check_id="demo", check_name="d", findings=[f])
+    rep = ScanReport(target="https://t", scanned_at="2026-05-28T00:00:00Z",
+                      duration_ms=0, results=[cr])
+    return share_link.build_share_payload(rep, "demo", 0, ttl_seconds=ttl)
+
+
+def test_share_link_payload_includes_ttl_fields(monkeypatch, tmp_path):
+    p = _build_test_payload(monkeypatch, tmp_path)
+    assert "issued_at" in p
+    assert "expires_at" in p
+    assert p["expires_at"] > p["issued_at"]
+
+
+def test_share_link_verify_accepts_fresh(monkeypatch, tmp_path):
+    from wpsecscan.reporters import share_link
+    p = _build_test_payload(monkeypatch, tmp_path, ttl=3600)
+    assert share_link.verify(p) is True
+
+
+def test_share_link_verify_rejects_expired(monkeypatch, tmp_path):
+    """A payload whose expires_at is in the past must verify False
+    even though the HMAC is still cryptographically valid."""
+    from wpsecscan.reporters import share_link
+    p = _build_test_payload(monkeypatch, tmp_path, ttl=3600)
+    # Re-sign with a back-dated expires_at to simulate an expired link.
+    import hmac as _hmac
+    import hashlib
+    import json as _json
+    body = {k: v for k, v in p.items() if k not in ("signature", "share_id")}
+    body["issued_at"] = body["issued_at"] - 4000
+    body["expires_at"] = body["expires_at"] - 4000  # now in the past
+    raw = _json.dumps(body, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    body["signature"] = _hmac.new(share_link._share_secret(), raw,
+                                    hashlib.sha256).hexdigest()
+    assert share_link.verify(body) is False
+
+
+def test_share_link_verify_rejects_pre_v272_payload(monkeypatch, tmp_path):
+    """A pre-v2.7.2 payload (no expires_at) must NOT verify under the
+    new rules — otherwise leaked legacy links survive the fix."""
+    from wpsecscan.reporters import share_link
+    p = _build_test_payload(monkeypatch, tmp_path, ttl=3600)
+    # Strip the TTL fields and re-sign as if produced by v2.7.1.
+    import hmac as _hmac
+    import hashlib
+    import json as _json
+    body = {k: v for k, v in p.items()
+              if k not in ("signature", "share_id", "issued_at", "expires_at")}
+    raw = _json.dumps(body, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    body["signature"] = _hmac.new(share_link._share_secret(), raw,
+                                    hashlib.sha256).hexdigest()
+    assert share_link.verify(body) is False
+
+
+# ---------------------------------------------------------------------------
+# C7 — argparse bounds off-by-one (3 sites in __main__.py)
+# ---------------------------------------------------------------------------
+
+def test_main_no_longer_has_off_by_one_bounds_guards():
+    """The three sites flagged by C7 used `i + N < len(args) + M` forms
+    that simplify to `i + (N-M) < len(args)`, causing args[i+N] to
+    IndexError when the flag is the last token. The fix removes the
+    `+ M` and uses `i + N < len(args)`. Pin both: the bad form must
+    be gone and the new form must be present."""
+    import wpsecscan.__main__ as m
+    src = _strip_py_comments(inspect.getsource(m))
+    # All `< len(args) + N` (N >= 1) forms were the bug pattern.
+    import re as _re
+    bad_hits = _re.findall(r"<\s*len\(args\)\s*\+\s*\d", src)
+    assert bad_hits == [], (
+        f"v2.7.2 C7 — `< len(args) + N` off-by-one form must be gone, "
+        f"still found: {bad_hits!r}"
+    )
+
+
+# ---------------------------------------------------------------------------
+# C9 / C10 / C11 / C5 / C6 — source-inspection regressions
+# ---------------------------------------------------------------------------
+
+def _strip_py_comments(src: str) -> str:
+    """Strip `# ...` line-comments AND docstrings so source-pattern
+    asserts don't trip on the explanatory text that references the
+    old buggy pattern."""
+    import re as _re
+    out_lines = []
+    in_doc = False
+    doc_marker = None
+    for line in src.splitlines():
+        s = line.lstrip()
+        if not in_doc and (s.startswith('"""') or s.startswith("'''")):
+            doc_marker = s[:3]
+            # single-line docstring?
+            if s.count(doc_marker) >= 2 and len(s) > 3:
+                continue
+            in_doc = True
+            continue
+        if in_doc:
+            if doc_marker in line:
+                in_doc = False
+            continue
+        # strip trailing # comment
+        line = _re.sub(r"\s+#.*$", "", line)
+        # skip whole-line comments
+        if line.lstrip().startswith("#"):
+            continue
+        out_lines.append(line)
+    return "\n".join(out_lines)
+
+
+def test_login_redirect_no_unconditional_verify_false():
+    from wpsecscan.checks import login_redirect_http_hop
+    src = _strip_py_comments(inspect.getsource(login_redirect_http_hop))
+    assert "verify=False" not in src, (
+        "login_redirect_http_hop must not pass verify=False unconditionally"
+    )
+    assert "WPSECSCAN_INSECURE_TLS" in src or "verify=not" in src
+
+
+def test_trust_v27_tarfile_uses_filter():
+    from wpsecscan import trust_v27
+    src = inspect.getsource(trust_v27.reproducible_build_verify)
+    assert 'filter="data"' in src or "filter='data'" in src
+
+
+def test_api_server_does_not_echo_token_prefix():
+    from wpsecscan import api_server
+    src = _strip_py_comments(inspect.getsource(api_server))
+    # The pre-fix `{token[:6]}***` leaked 6 chars of a token to stdout.
+    assert "token[:6]" not in src
+    assert "token[:4]" not in src
+
+
+def test_gui_toast_uses_encodedcommand_not_fstring():
+    """GUI toast notifier must not pass an f-string built from finding
+    titles as a single PowerShell argv string (C5)."""
+    import wpsecscan.gui as g
+    src = inspect.getsource(g)
+    # The fix uses EncodedCommand with base64-encoded UTF-16LE.
+    assert "EncodedCommand" in src
+    # And the prior bad pattern — Popen with a single ps string — is gone.
+    assert "subprocess.Popen(ps, shell=False" not in src
+
+
+def test_gui_v27_extras_shortcut_uses_encodedcommand():
+    from wpsecscan import gui_v27_extras
+    src = inspect.getsource(gui_v27_extras)
+    assert "EncodedCommand" in src
+    # The prior `-Command` + raw f-string form is gone.
+    assert '"-Command", ps_cmd' not in src

wpsecscan-2.7.3/tests/test_v272_wave3_regressions.py

@@ -0,0 +1,143 @@
+"""Regression tests for v2.7.2 Wave 3 — Medium-severity fixes.
+
+C12 perf_v27.etag_set — atomic temp+replace
+C13 continuous_monitor — atomic temp+replace state file
+C14 hardware_keys — absolute primary.ctx path (source check)
+C15 history — timestamped snapshot written before "latest" promotion
+C16 integrations_v27.find_snyk_dups — handles non-dict f.extra
+C17 creds_vault index — 0o600 atomic write
+"""
+import inspect
+import json
+import os
+
+import pytest
+
+
+# ---------------------------------------------------------------------------
+# C12 — perf_v27.etag_set atomic write
+# ---------------------------------------------------------------------------
+
+def test_etag_set_writes_atomically(monkeypatch, tmp_path):
+    """Source check: etag_set must use os.replace, not bare write_text."""
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+    from wpsecscan import perf_v27
+    src = inspect.getsource(perf_v27.etag_set)
+    assert "os.replace" in src
+    # Functional check: still works.
+    perf_v27.etag_set("https://example.com", "tag-1", "Wed, 1 Jan 2026 00:00 GMT")
+    assert perf_v27.etag_get("https://example.com") == ("tag-1", "Wed, 1 Jan 2026 00:00 GMT")
+
+
+# ---------------------------------------------------------------------------
+# C13 — continuous_monitor atomic state-file write
+# ---------------------------------------------------------------------------
+
+def test_continuous_monitor_state_write_is_atomic():
+    from wpsecscan import continuous_monitor
+    src = inspect.getsource(continuous_monitor)
+    # The pre-fix bare `state_file.write_text(json.dumps(new)...)` is gone.
+    assert "state_file.write_text(json.dumps(new)" not in src
+    # The new pattern is temp + os.replace.
+    assert "os.replace" in src and "_tmp" in src
+
+
+# ---------------------------------------------------------------------------
+# C14 — hardware_keys uses absolute primary.ctx path
+# ---------------------------------------------------------------------------
+
+def test_hardware_keys_no_bare_primary_ctx_string():
+    """The pre-fix code passed the bare literal `"primary.ctx"` AS THE
+    subprocess argv slot — relative path, resolved against caller cwd.
+    The fix routes it via an absolute Path. We confirm the bug pattern
+    (the bare literal occupying an argv slot inside subprocess.run) is
+    gone."""
+    from wpsecscan import hardware_keys
+    src = inspect.getsource(hardware_keys)
+    # The bug pattern: "-C", "primary.ctx" (comma between, exact argv).
+    assert '"-C", "primary.ctx"' not in src
+    assert '"-c", "primary.ctx"' not in src
+    # The new pattern uses str(primary_ctx) in those argv slots.
+    assert 'str(primary_ctx)' in src
+
+
+# ---------------------------------------------------------------------------
+# C15 — history.save_report writes snapshot before promoting latest
+# ---------------------------------------------------------------------------
+
+def test_history_save_report_atomically_promotes_latest():
+    from wpsecscan import history
+    src = inspect.getsource(history.save_report_snapshot)
+    # The new ordering: snap_path.write_text appears BEFORE the os.replace
+    # call that promotes "latest".
+    snap_pos = src.find("snap_path.write_text")
+    latest_pos = src.find("_os.replace(latest_tmp, latest)")
+    assert snap_pos >= 0, "snap_path.write_text not found"
+    assert latest_pos >= 0, "_os.replace(latest_tmp, latest) not found"
+    assert snap_pos < latest_pos, "snapshot must be written BEFORE latest is promoted"
+
+
+# ---------------------------------------------------------------------------
+# C16 — find_snyk_dups handles non-dict f.extra
+# ---------------------------------------------------------------------------
+
+def test_import_snyk_findings_handles_non_dict_extra(monkeypatch):
+    """A Finding whose `.extra` got overwritten with a non-dict value
+    (e.g. JSON null on deserialisation) must not crash the dedup pass
+    with TypeError when import_snyk_findings tries to write through
+    `f.extra["snyk_dup"] = True`."""
+    import httpx as _httpx
+    from wpsecscan import integrations_v27
+    from wpsecscan.models import Finding, CheckResult, ScanReport
+
+    f_bad = Finding(severity="high", title="t", evidence="e")
+    f_bad.extra = None  # type: ignore[assignment]
+
+    cr = CheckResult(check_id="x", check_name="x", findings=[f_bad])
+    rep = ScanReport(target="https://t", scanned_at="now", duration_ms=0, results=[cr])
+
+    # Stub httpx.Client so the snyk fetch returns no CVE matches —
+    # the contract check (non-dict f.extra rebind) runs regardless of
+    # whether any CVE matched.
+    class _StubResp:
+        status_code = 200
+        def json(self):
+            return {"data": []}
+
+    class _StubClient:
+        def __init__(self, *a, **kw): pass
+        def __enter__(self): return self
+        def __exit__(self, *a): return False
+        def get(self, *a, **kw): return _StubResp()
+
+    monkeypatch.setattr(_httpx, "Client", _StubClient)
+    monkeypatch.setenv("SNYK_TOKEN", "fake")
+    monkeypatch.setenv("SNYK_ORG", "fake-org")
+
+    # Must not raise TypeError. The contract fix rebinds f.extra to {}
+    # at the top of the per-finding loop so any subsequent write is safe.
+    try:
+        integrations_v27.import_snyk_findings(rep)
+    except TypeError as e:
+        pytest.fail(f"import_snyk_findings raised TypeError on non-dict f.extra: {e}")
+    assert isinstance(f_bad.extra, dict)
+
+
+# ---------------------------------------------------------------------------
+# C17 — creds_vault index file is 0o600 on POSIX
+# ---------------------------------------------------------------------------
+
+def test_creds_vault_index_is_0600_atomic(monkeypatch, tmp_path):
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+    from wpsecscan import creds_vault
+    src = inspect.getsource(creds_vault._save_index)
+    assert "0o600" in src
+    # Functional: index file mode is restricted on POSIX after a save.
+    creds_vault._save_index({"https://t": ["user"]})
+    p = creds_vault._index_path()
+    assert p.exists()
+    if os.name == "posix":
+        mode = p.stat().st_mode & 0o777
+        assert mode == 0o600
+    # Content roundtrip
+    assert json.loads(p.read_text(encoding="utf-8")) == {"https://t": ["user"]}