feat(scan): misconfiguration, weak-crypto & injection rules — coverage 71.3% → 79.8% (v0.10.0) - #103
Merged
Merged
Conversation
Raises detection coverage against the testbed from 71.3% to 79.8% (92 to 103
of 129), false-positive rate still 0%, and — the number that matters for a
tool people choose to install — zero new findings on capacitor (10), the
self-scan (67), ShortsStudio (0) or koajs/router (0).
Each rule targets a defect the line itself shows, so the corrected shape in
the corpus differs on something visible here rather than three functions away:
py-framework-debug-enabled debug mode left on (CWE-489)
js-cors-wildcard-credentials `*` origin with credentials (CWE-942)
js-cookie-insecure-flag cookie with secure:false (CWE-614)
js-hardcoded-crypto-key key literal in crypto code (CWE-321)
py-hardcoded-secret-key signing secret literal (CWE-798)
py-ldap-injection unescaped LDAP filter (CWE-90)
py-xpath-injection interpolated XPath (CWE-643)
py-fast-password-hash SHA-2 on a password, no KDF (CWE-759)
py-plaintext-password-retained raw password stored (CWE-256)
js-timing-unsafe-mac-compare === on a signature (CWE-208)
js-predictable-cipher-iv static IV (CWE-329)
js-mass-assignment Object.assign(x, req.body) (CWE-915)
js-header-injection request input into a response header (CWE-113)
Two decisions in service of "safe to install":
- The timing-unsafe compare first flagged the corpus's own safe line — a
`.length ===` length check whose `timingSafeEqual` sits forward of the
backward guard window. A length comparison is not the value compare, so
the rule now excludes `.length`.
- A `Math.random().toString(36)` token rule was written and then dropped: the
exact shape generates security tokens AND benign callback ids (Capacitor's
native bridge does the latter), with no line-visible signal between them.
Three false positives on a real repo is precisely what gets a scanner
uninstalled, so the bare shape is left to the credential-scoped rule that
already covers the `token = …Math.random…` case.
Deliberately still absent: CSRF, IDOR, TOCTOU, missing authorization, session
fixation, and the sanitize-upstream classes (CSV/log injection) whose
vulnerable and safe lines are identical — they need whole-function reasoning
this engine does not fake. See KNOWN_GAPS.
Gate floor moves 68 to 76. 154 tests, up from 141.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ThreatCrush Security Scan67 finding(s) HIGH/CRITICAL: 11 | MEDIUM: 55 | LOW: 1
…and 17 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 0.10.0. Detection coverage against the testbed 71.3% → 79.8% (92 → 103 of 129), false-positive rate still 0% — and, the number that actually decides whether a dev keeps the tool installed, zero new findings on capacitor (10), the self-scan (67), ShortsStudio (0) or koajs/router (0).
13 new rules
Each targets a defect the line itself shows, so the corpus's corrected shape differs on something visible here, not three functions away:
py-framework-debug-enabledDEBUG = True,run(debug=True)js-cors-wildcard-credentialsorigin: '*'+credentials: truejs-cookie-insecure-flagcookie(…secure: false)js-hardcoded-crypto-keypy-hardcoded-secret-keySECRET_KEY = "literal"py-ldap-injectionpy-xpath-injectionpy-fast-password-hashpy-plaintext-password-retainedjs-timing-unsafe-mac-compare===on a signaturejs-predictable-cipher-ivjs-mass-assignmentObject.assign(x, req.body)js-header-injectionTwo calls in service of "safe to install"
Because the steer was desirability — and the fastest way to get a scanner uninstalled is noise:
a.length === b.lengthcheck whosetimingSafeEqualsits forward of the backward guard window. A length comparison isn't the value compare, so the rule now excludes.length. FPR back to 0.Math.random().toString(36)token rule was written and dropped. The exact shape generates security tokens and benign callback ids — Capacitor's native bridge uses it for the latter, and it produced 3 false positives there. No line-visible signal separates the two, so the bare shape is left to the credential-scoped rule that already coverstoken = …Math.random…. One ambiguous rule wasn't worth one testbed line.Deliberately still absent
CSRF, IDOR, TOCTOU, missing authorization, session fixation, and the sanitize-upstream classes (CSV/log injection, whose vulnerable and safe lines are identical). They need whole-function reasoning this engine doesn't fake — forcing them would trade the 0% FPR that makes the tool worth installing. See
KNOWN_GAPS.Verification
tsc --noEmitclean.