diff --git a/.agents/skills/coding-rules/SKILL.md b/.agents/skills/coding-rules/SKILL.md index 516f88a..0afd658 100644 --- a/.agents/skills/coding-rules/SKILL.md +++ b/.agents/skills/coding-rules/SKILL.md @@ -29,7 +29,8 @@ Private local implementation details and test fixtures are not new design surfac ## Contract and Boundary Safety - Preserve contracts required by remaining consumers and explicit user constraints; authorized removal includes the retired entry point and its unused implementation. Absence of repository call sites does not establish absence of external consumers. Resolve uncertainty only when it changes the removal or compatibility decision. -- Validate untrusted input at the boundary and encode output for its destination. +- Validate untrusted input at the boundary and encode output for its destination. Untrusted input includes request data, external service responses, model or tool output, and stored data whose writer is untrusted or whose consumer needs a guarantee the store does not make. +- When a change alters a boundary where external content or model output selects a tool's action, target, or destination, verify that those values cannot exceed the operation scope and access rights already granted to the caller. - Propagate or handle errors with useful context and keep failures observable. - Keep secrets and sensitive values out of source, client bundles, errors, and logs. - Use parameterized data access and verify authorization at resource access points when applicable. diff --git a/.agents/skills/coding-rules/references/security-checks.md b/.agents/skills/coding-rules/references/security-checks.md index 8f8c08c..e870c04 100644 --- a/.agents/skills/coding-rules/references/security-checks.md +++ b/.agents/skills/coding-rules/references/security-checks.md @@ -1,61 +1,62 @@ # Security Check Patterns +Last reviewed: 2026-09-22 + ## Stable Patterns -These patterns have low false-positive rates and are detectable through grep or static analysis. +These patterns are reachable through direct source search and their shape does not change with the ecosystem. ### Hardcoded Secrets - Credentials, API keys, or tokens assigned as string literals in source code - Connection strings containing embedded passwords - Private keys or certificates stored in source files -- Detection approach: search for high-entropy strings near assignment operators, common key names (`password`, `secret`, `api_key`, `token`, `private_key`), and platform-specific token formats +- Provider-specific token formats, which are recognizable by prefix rather than by variable name ### SQL String Concatenation -- SQL statements constructed through string concatenation or interpolation with variables -- Detection approach: search for SQL keywords (`SELECT`, `INSERT`, `UPDATE`, `DELETE`) combined with string concatenation operators or string interpolation containing variable references +- SQL statements constructed through string concatenation or interpolation with variables, instead of parameterized data access ### Dynamic Code Execution -- Use of dynamic code execution functions (e.g., `eval`, `exec`) with non-static input +- Dynamic code execution functions (e.g., `eval`, `exec`) reached by non-static input +- Untrusted values flowing into a shell command string or its arguments - Dynamic module loading with variable paths -- Detection approach: search for dynamic code execution or module loading calls where the argument is not a static literal ### Insecure Deserialization - Deserialization of untrusted input using unsafe loaders or formats that allow arbitrary object construction (e.g., native serialization, YAML without safe loader) - Parsed data passed directly into dynamic code execution -- Detection approach: search for deserialization calls that accept external input without safe loader or type-restricted configuration -### Path Traversal -- File system paths constructed from user-supplied input without sanitization -- Patterns where request parameters flow into file read/write operations -- Detection approach: search for file operations where path arguments include request parameters, query strings, or user input variables +### Untrusted Resource Targets +- File system paths constructed from user-supplied input without sanitization, including archive entry names and symlink targets +- Outbound requests whose destination host, port, or scheme is derived from user-supplied input, including values reached after a redirect (server-side request forgery) +- Both directions of this pattern let a caller select a resource the caller cannot reach directly -### CORS Wildcard -- `Access-Control-Allow-Origin` set to `*` in production configuration -- CORS middleware configured with wildcard origin -- Detection approach: search for CORS configuration with wildcard values +### Plaintext or Unverified Transport +- Credentials, tokens, or personal data sent over a non-TLS destination constructed or configured in source +- TLS certificate or hostname verification disabled in a client, agent, or transport configuration -### Non-TLS URLs -- HTTP (non-TLS) URLs embedded in source code for production endpoints (outside configuration files, tests, and documentation) -- Detection approach: search for `http://` patterns in source files, excluding localhost, configuration files, tests, and documentation +### Credentialed Cross-Origin Exposure +- An attacker-controllable origin allowed to read an authenticated response, typically by reflecting the request origin without checking it against an allowlist while `Access-Control-Allow-Credentials` is enabled +- A wildcard origin is not this pattern: browsers reject `*` when credentials are included, and a reflected origin validated against an allowlist is the correct implementation -## Additional Patterns +## Trend-Sensitive Patterns -Sources: OWASP Top 10:2025, DryRun Agentic Coding Security Report (2026-03) +Sources: OWASP Top 10:2025 (final, 2026-01); DryRun Agentic Coding Security Report (2026-03); CSA slopsquatting research note (2026-04); Shai-Hulud npm worm campaigns (2025-09 onward) -### Access Control Gaps in AI-Generated Code -- Endpoints or route handlers defined without authentication middleware -- Resource access operations (read, update, delete) without authorization verification -- Administrative or destructive operations accessible without elevated permissions -- For the changed attack surface, verify each reachable route and resource access operation whose authentication or authorization behavior can change the security result -- Detection approach: search for route or endpoint handlers without authentication middleware, and resource operations (read, update, delete) without authorization checks in the call chain +### Object-Level Authorization Gaps (OWASP A01:2025) +- Route handlers and resource operations reachable with no authentication or authorization check in the call chain +- Handlers that verify authentication but not the caller's right to the specific resource named in the request +- Identifiers taken from the request used to select a record without scoping the query to the caller's tenant or ownership +- Bulk, batch, export, and import operations whose authorization does not cover every target in the set +- Request-body fields that override the resource, owner, role, or scope the permission check assumed +- For the changed attack surface, verify each reachable resource access whose authorization behavior can change the security result ### Mishandling of Exceptional Conditions (OWASP A10:2025) - Error handlers that expose internal system details (stack traces, database errors, file paths) in responses - Error handlers that grant access, skip authentication, or bypass authorization when an exception occurs - Missing error handling on security-critical operations (authentication, authorization, cryptographic operations) -- Detection approach: search for catch or error-handler blocks that return stack traces, database errors, or file paths in responses, and for handlers that continue with success-path behavior without re-validating security state -### Software Supply Chain Patterns (OWASP A03:2025) -- Dependencies imported without version pinning -- Use of deprecated or unmaintained packages for security-critical functions -- Detection approach: check dependency manifests for unpinned versions and known deprecated packages +### Dependency and Pipeline Integrity (OWASP A03:2025) +- Newly added dependencies that run install-time scripts (`preinstall`, `postinstall`, or the ecosystem equivalent) +- Installation paths that resolve versions at install time instead of from the committed lockfile +- Third-party pipeline actions referenced by a mutable tag or branch rather than an immutable revision +- Pipeline triggers that expose repository secrets or a writable token to code from an untrusted fork +- Interpolation of event-supplied values (titles, branch names, comment bodies) directly into pipeline shell steps diff --git a/.codex/agents/security-reviewer.toml b/.codex/agents/security-reviewer.toml index d3fdc0b..dc9a8a8 100644 --- a/.codex/agents/security-reviewer.toml +++ b/.codex/agents/security-reviewer.toml @@ -26,7 +26,7 @@ Each finding contains exactly one must-fix problem and its smallest sufficient c 1. Verify implementation compliance with security requirements in the governing artifacts 2. Verify coding-rules contract and boundary safety for the changed attack surface 3. Execute the applicable security detection patterns exposed by `coding-rules` -4. Check current advisories only when the diff changes a dependency/runtime version or a governing artifact explicitly requires it +4. Check dependency provenance and advisories only when the diff changes dependencies or pipeline actions, or a governing artifact explicitly requires it 5. Provide structured quality reports with findings and fix suggestions ## Input Parameters @@ -77,8 +77,12 @@ Execute the applicable security detection patterns from `coding-rules`: - Search for each Trend-Sensitive Pattern - Record matches with file path and line number -### 6. Conditional Advisory Check -When the diff changes a dependency/runtime version or a governing artifact requests current advisory validation, check authoritative current advisories for that exact component and version. Otherwise mark this step `not_applicable`. +### 6. Conditional Dependency Check +When the diff changes the version or revision of a dependency, runtime, or pipeline action, or a governing artifact requests current advisory validation, check authoritative current advisories for that exact component and version. + +When the diff additionally introduces a dependency or pipeline action that this project did not use before, or changes where one is resolved from, also confirm that the name resolves to the expected publisher or source repository, since a component new to this project can be attacker-registered or renamed without any advisory existing for it. + +Otherwise mark this step `not_applicable`. ### 7. Findings Consolidation and Classification Consolidate all findings, remove duplicates, and classify each finding into one of the following categories: @@ -122,7 +126,7 @@ Otherwise return `needs_revision` when `findings` is non-empty and `pass` when ` - [ ] Governing artifact type and path validated; security requirements extracted and each item verified - [ ] Each Security section subsection checked against implementation - [ ] Applicable stable and trend-sensitive patterns exposed by coding-rules searched -- [ ] Conditional advisory check performed or marked not applicable with reason +- [ ] Conditional dependency check performed or marked not applicable with reason - [ ] Each finding classified into confirmed_risk / defense_gap - [ ] Every finding is one must-fix problem grounded in a governing requirement, repository rule, or concrete material failure in the actual reachable trust model, and its suggestion is the smallest sufficient correction; optional hardening and defense-in-depth are absent - [ ] Committed secrets checked (blocked status if found) diff --git a/package.json b/package.json index a4f2fa3..9ca84b8 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codex-workflows", - "version": "1.5.2", + "version": "1.5.3", "description": "Codex CLI workflows that keep larger software changes within the approved scope, from planning through review", "license": "MIT", "author": "Shinsuke Kagawa",