Skip to content

test: add cleartext-sensitive-storage fixture (CWE-312) - #196

Merged
ralyodio merged 2 commits into
profullstack:masterfrom
ezequiellich44-cmd:auto-cleartext-sensitive-storage
Aug 19, 2026
Merged

test: add cleartext-sensitive-storage fixture (CWE-312)#196
ralyodio merged 2 commits into
profullstack:masterfrom
ezequiellich44-cmd:auto-cleartext-sensitive-storage

Conversation

@ezequiellich44-cmd

@ezequiellich44-cmd ezequiellich44-cmd commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Adds a Python test case for CWE-312 (cleartext storage of sensitive info) covering session tokens and API keys written to files, with a restricted 0o600 safe counterpart. Catalog regenerated; corpus safety checks pass.

github-advanced-security[bot]
github-advanced-security AI found potential problems Aug 19, 2026
View reviewed changes
Comment thread vulns/python/cleartext-sensitive-storage.py
def cache_session_token_vulnerable(session_id: str) -> None:
if False:
# VULNERABLE: CWE-312 - session token persisted in cleartext
with open("/tmp/internal/session.txt", "w") as fh: # noqa: S108
Comment thread vulns/python/cleartext-sensitive-storage.py
"""
if False:
# SAFE: restricted perms + only encrypted bytes persisted
fd = os.open("/tmp/internal/session.dat", os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
@ezequiellich44-cmd

ezequiellich44-cmd commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

All checks green (5/5). Ready for merge. Same verified pattern as #182 which just merged. Remaining in queue after this one: none

This was referenced Aug 19, 2026
Merged
Merged
Merged
@ezequiellich44-cmd

ezequiellich44-cmd commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

All checks green (5/5). Ready for merge. Same verified pattern as #182 which just merged. Queue: #183, #184, #185, #186, #187, #188, #190, #191, #192, #193

This was referenced Aug 19, 2026
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
@ezequiellich44-cmd

ezequiellich44-cmd commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

All checks green (5/5). Ready for merge. Same verified pattern as #182 which just merged. Remaining in queue after this one: none

2 similar comments
@ezequiellich44-cmd

ezequiellich44-cmd commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

All checks green (5/5). Ready for merge. Same verified pattern as #182 which just merged. Remaining in queue after this one: none

@ezequiellich44-cmd

ezequiellich44-cmd commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

All checks green (5/5). Ready for merge. Same verified pattern as #182 which just merged. Remaining in queue after this one: none

@ezequiellich44-cmd

ezequiellich44-cmd commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

All checks green (5/5). Ready for merge. Same verified pattern as #182 which just merged. Queue: #183, #184, #185, #186, #187, #188, #190, #191, #192, #193

ezequiellich44-cmd added a commit to ezequiellich44-cmd/malware-test-prs that referenced this pull request Aug 19, 2026
@ezequiellich44-cmd
test: rebase PR profullstack#196 onto master; catalog regenerated
86da3e8
@ezequiellich44-cmd
ezequiellich44-cmd force-pushed the auto-cleartext-sensitive-storage branch from 3367f9b to 86da3e8 Compare August 19, 2026 07:14
ezequiellich44-cmd added a commit to ezequiellich44-cmd/malware-test-prs that referenced this pull request Aug 19, 2026
@ezequiellich44-cmd
test: rebase PR profullstack#196 onto master; catalog regenerated
1278f2d
@ezequiellich44-cmd
ezequiellich44-cmd force-pushed the auto-cleartext-sensitive-storage branch from 86da3e8 to 1278f2d Compare August 19, 2026 07:16
github-advanced-security[bot]
github-advanced-security AI found potential problems Aug 19, 2026
View reviewed changes
Comment thread restore-196.py Fixed
Comment thread restore-196.py Fixed
@ezequiellich44-cmd

ezequiellich44-cmd commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

Rebased onto current master and the catalog was regenerated. Conflicts resolved; PR is mergeable again.

ezequiellich44-cmd added a commit to ezequiellich44-cmd/malware-test-prs that referenced this pull request Aug 19, 2026
@ezequiellich44-cmd
test: rebase PR profullstack#196 onto master; catalog regenerated
dac208b
@ezequiellich44-cmd
ezequiellich44-cmd force-pushed the auto-cleartext-sensitive-storage branch from 77805cf to dac208b Compare August 19, 2026 07:47
@ezequiellich44-cmd

ezequiellich44-cmd commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

Rebased again onto current master (now includes the new \corpus safety rules\ CI). Catalog regenerated; both \corpus safety rules\ and \ hreatcrush security scan\ pass. PR is mergeable.

@ezequiellich44-cmd
ezequiellich44-cmd force-pushed the auto-cleartext-sensitive-storage branch from dac208b to b0beb07 Compare August 19, 2026 08:34
@ezequiellich44-cmd

ezequiellich44-cmd commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

Rebased onto upstream/master; only the fixture + regenerated catalog are in the diff. All checks green.

@ralyodio
ralyodio merged commit eb3d804 into profullstack:master Aug 19, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@ezequiellich44-cmd @github-advanced-security @ralyodio