mirror of
https://github.com/trailofbits/skills.git
synced 2026-09-14 14:28:48 +08:00
Thomas Chauchefoin
82e8e0ad77
* insecure-defaults: convert the skill to a dynamic workflow Rewrites the plugin as a four-phase workflow: recon profiles the target, parallel sweeps collect candidates, a refuting pass adjudicates them, and a report assigns severity with coverage accounting. The skill is removed and `/insecure-defaults:audit [path]` is the only entry point, since the workflow needs the command to locate its detection corpora. It also adds offline tests: scenarios over the workflow's control flow, a mutation self-test that proves they bite, and a check that every documented example is matched by a seed pattern. This does not replace running the command end-to-end against a real codebase. Bumps to 2.0.0. * insecure-defaults: run the node suites in CI The harness and seed-coverage checks ran only when someone remembered to. CI's shell-suite discovery matches plugins/*/tests/run_*.sh, so wrap the three node invocations in run_seeds.sh and both the lint workflow and `make shell-suites` pick them up with no changes to either. Without this, adding a row to CATEGORIES without its references/<id>.json passes CI and then aborts every real run with corpus-unreadable. No setup-node step: ubuntu-latest ships Node, and the scripts are plain CommonJS with no dependencies. The command -v guard makes a missing interpreter a loud failure rather than a suite that quietly does not run. * insecure-defaults: abort when the verify phase adjudicates nothing If every verify batch died, confirmed was empty and the run returned no-findings-confirmed, which commands/audit.md considers a completed audit. Guard on unadjudicated.length === candidates.length and return verify-failed, carrying coverage so the caller sees what went unjudged. Adds a scenario for both failure shapes (all agents dead, all verdict lists empty) and two mutations covering the guard firing and over-firing. * insecure-defaults: report per-category scan counts The zero-scanned guard is on the sum, so five failed searches beside one that worked cleared it and categories_run listed all six. Add files_scanned_by_category and unsearched_categories to coverage, keyed off CATEGORIES so a dead sweep counts as 0, and have the report name them under a Not searched heading. Adds a scenario covering a searching sweep, a zero-file one and a dead one, plus three mutations. * insecure-defaults: count sweep failures against the category list The corpus-unreadable note and the seed-only log divided by the sweeps that returned, so with sweeps dead the ratio read 1/1 rather than 1/6. * insecure-defaults: drop the assertion-count floor from the harness * insecure-defaults: guard a dead report agent agent() returns null on terminal failure, so a report agent that died returned status "findings" with no report and the caller printed nothing while the findings sat in the structured return. Return report-failed with the findings and coverage, and have the command render them. * insecure-defaults: stop labelling a genuine clean run a failure Step 3 accepted findings/no-findings-confirmed and called every other status an incomplete audit, so no-candidates, the deliberate honest-negative status, told the user the run failed. It is now a per-status table. * insecure-defaults: anchor the noisiest seeds (DES|RC4|...) matched NODES and MODES, 0o?(666|777|...) matched any digits, and getMessage() matched all Java exception handling. On the Python stdlib the first two drop from 147 and 228 matching lines to 0 and 84. random. and getMessage() can't be fixed by anchoring, so they now require context: a security-material identifier near the RNG call, and concatenation into a string literal for getMessage(). seed-coverage.js confirms all 18 documented VULNERABLE examples still match. * insecure-defaults: indent the seed wrapper the way shfmt wants --------- Co-authored-by: kz-tob <kara.zaffarano@trailofbits.com>
2.3 KiB
2.3 KiB
Debug and Introspection Defaults
Report when: Internal detail reaches a response, a listening port, or a log a lower-privileged party can read, whether it is gated by a flag that defaults to on, or simply unconditional (a stack trace or driver message written straight into an error response, with no flag at all).
Skip when: Log-verbosity-only flags with no user-facing output. Debug servers bound to loopback and off by default.
The finding needs both halves: enabled-by-default and an exposure path. A verbose logger that writes to a root-only file is neither.
VULNERABLE - Report These
Stack traces in API responses
# File: app.py
@app.errorhandler(Exception)
def handle_error(error):
return jsonify({
'error': str(error),
'traceback': traceback.format_exc() # Leaks internal paths, library versions
}), 500
Why vulnerable: Exposes internal implementation details to attackers.
GraphQL introspection enabled
// File: server.js
const server = new ApolloServer({
typeDefs,
resolvers,
introspection: true, // Enabled in production
playground: true
});
Why vulnerable: Attackers can discover entire API schema, including admin-only fields.
Verbose error messages
// File: UserController.java
catch (SQLException e) {
return ResponseEntity.status(500).body(
"Database error: " + e.getMessage() // Leaks table names, constraints
);
}
Why vulnerable: SQL error messages reveal database structure.
SECURE - Skip These
Debug features in logging only
# File: app.py
@app.errorhandler(Exception)
def handle_error(error):
logger.exception('Request failed', exc_info=error) # Logs full trace
return jsonify({'error': 'Internal server error'}), 500 # Generic to user
Environment-aware debug settings
// File: server.js
const server = new ApolloServer({
typeDefs,
resolvers,
introspection: process.env.NODE_ENV !== 'production',
playground: process.env.NODE_ENV !== 'production'
});
Generic user-facing errors
// File: UserController.java
catch (SQLException e) {
logger.error("Database error", e); // Full details to logs
return ResponseEntity.status(500).body("Unable to process request"); // Generic
}