ci: harden PR security pipeline (#10)
Add comprehensive security scanning to CI/CD pipeline including CodeQL, Gitleaks, Semgrep custom rules, dependency review, and lifecycle script checks
This commit is contained in:
Patrick Wozniak
@@ -0,0 +1,273 @@
|
||||
rules:
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
# Exfiltration: sending secrets to remote servers
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
|
||||
- id: pi-extension-data-exfiltration-fetch
|
||||
patterns:
|
||||
- pattern: fetch($URL, ...)
|
||||
message: >
|
||||
Data exfiltration risk: sending data to $URL via fetch.
|
||||
Verify the destination is not an attacker-controlled server.
|
||||
severity: ERROR
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
- "**/index.ts"
|
||||
focus-metavariable: $URL
|
||||
|
||||
- id: pi-extension-data-exfiltration-xmlhttprequest
|
||||
pattern: new XMLHttpRequest()
|
||||
message: >
|
||||
Suspicious XMLHttpRequest usage in provider code.
|
||||
Could exfiltrate data to external servers.
|
||||
severity: WARNING
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
# Secret leakage: logging / sending API keys
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
|
||||
- id: pi-extension-logging-secrets
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: console.log(...)
|
||||
- pattern: console.error(...)
|
||||
- pattern: console.warn(...)
|
||||
- pattern-regex: "api[kK]ey|API_KEY|COMMANDCODE|Bearer|authPath"
|
||||
message: >
|
||||
Potential secret logging: log statement includes an API key, auth token,
|
||||
or auth file path pattern. Do not log secrets.
|
||||
severity: ERROR
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
- "**/index.ts"
|
||||
|
||||
- id: pi-extension-secret-in-error-message
|
||||
patterns:
|
||||
- pattern: Error($MSG)
|
||||
- pattern-regex: "api[kK]ey|API_KEY|COMMANDCODE|Bearer"
|
||||
message: >
|
||||
Possible secret leak in error message: $MSG.
|
||||
Error messages surfaced to pi may leak credentials.
|
||||
Use generic messages instead.
|
||||
severity: WARNING
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
- "**/index.ts"
|
||||
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
# URL hijacking: changing API base endpoints
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
|
||||
- id: pi-extension-api-base-override
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: $VAR = "..."
|
||||
- pattern: $VAR = process.env.$ENV_VAR ?? "..."
|
||||
- metavariable-regex:
|
||||
metavariable: $VAR
|
||||
regex: "(?i).*(api_?base|api_base_url|base_url|host|endpoint|models_url).*"
|
||||
- metavariable-regex:
|
||||
metavariable: $ENV_VAR
|
||||
regex: "(?i).*API.*BASE.*"
|
||||
message: >
|
||||
API base URL override: $ENV_VAR can redirect all requests including auth
|
||||
headers to any server. Review any change to how this variable is set.
|
||||
severity: ERROR
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
- "**/index.ts"
|
||||
|
||||
|
||||
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
# Supply chain: dependency injection
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
|
||||
- id: pi-extension-untrusted-dynamic-require
|
||||
patterns:
|
||||
- pattern: require($MODULE)
|
||||
- metavariable-regex:
|
||||
metavariable: $MODULE
|
||||
regex: "^(?)['\"]"
|
||||
message: >
|
||||
Dynamic require() of non-local, non-standard-library module: $MODULE.
|
||||
External contributors could introduce malicious packages this way.
|
||||
severity: ERROR
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
- "**/index.ts"
|
||||
|
||||
- id: pi-extension-postinstall-script
|
||||
patterns:
|
||||
- pattern: '"postinstall": "$SCRIPT"'
|
||||
message: >
|
||||
postinstall script detected: $SCRIPT. Install-time scripts can execute
|
||||
arbitrary code on user machines. Must be reviewed with extreme care.
|
||||
severity: ERROR
|
||||
languages: [json]
|
||||
paths:
|
||||
include:
|
||||
- "package.json"
|
||||
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
# File system: reading auth files / ~/.pi
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
|
||||
- id: pi-extension-auth-path-traversal
|
||||
patterns:
|
||||
- pattern: join($HOME, $PATH)
|
||||
- metavariable-regex:
|
||||
metavariable: $HOME
|
||||
regex: "homedir|homeDir|HOME|process\\.env\\.HOME"
|
||||
- metavariable-regex:
|
||||
metavariable: $PATH
|
||||
regex: "['\"].*\\.\\./.*['\"]"
|
||||
message: >
|
||||
Auth path traversal: $HOME / $PATH could read outside the intended auth
|
||||
directory. Path must stay within ~/.commandcode, ~/.pi/agent, ~/.omp/agent.
|
||||
severity: ERROR
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
|
||||
- id: pi-extension-readfile-sensitive-paths
|
||||
patterns:
|
||||
- pattern: readFileSync($PATH, ...)
|
||||
- pattern-not: readFileSync($PATH, "utf-8")
|
||||
- metavariable-regex:
|
||||
metavariable: $PATH
|
||||
regex: "(auth\\.json|credentials|\\.env|id_rsa|ssh|\\.netrc|netrc|\\.npmrc)"
|
||||
message: >
|
||||
Suspicious file read: $PATH. Auth files or credentials being read with
|
||||
potentially unsafe encoding. Review carefully.
|
||||
severity: WARNING
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
# Network: unexpected fetch calls
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
|
||||
- id: pi-extension-unexpected-fetch
|
||||
pattern: fetch(...)
|
||||
message: >
|
||||
Direct fetch() call detected. Provider code should use injected
|
||||
fetchImpl for testability and security. If this is intentional,
|
||||
add a // nosemgrep comment on the line above.
|
||||
severity: WARNING
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
- "**/index.ts"
|
||||
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
# Shell execution
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
|
||||
- id: pi-extension-shell-execution
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: child_process.exec(...)
|
||||
- pattern: child_process.execSync(...)
|
||||
- pattern: child_process.spawn(...)
|
||||
- pattern: child_process.spawnSync(...)
|
||||
- pattern: child_process.fork(...)
|
||||
- pattern: exec($SCRIPT)
|
||||
- pattern: execSync($SCRIPT)
|
||||
message: >
|
||||
Shell execution: $SCRIPT. External contributors should not add
|
||||
child_process calls to provider source code.
|
||||
severity: ERROR
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
- "**/index.ts"
|
||||
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
# Malicious import patterns
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
|
||||
- id: pi-extension-unusual-import
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: "import $X from \"...\""
|
||||
- pattern: "const $X = require(\"...\")"
|
||||
- metavariable-regex:
|
||||
metavariable: $X
|
||||
regex: "(compression|pako|zlib|tar|stream|archiver|request|axios|needle|got|superagent|node-fetch|undici)"
|
||||
message: >
|
||||
Suspicious import of $X in provider source. Network or compression
|
||||
libraries could be used for data exfiltration.
|
||||
severity: WARNING
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
- "**/index.ts"
|
||||
|
||||
- id: pi-extension-eval-like
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: eval(...)
|
||||
- pattern: new Function(...)
|
||||
- pattern: setTimeout($X, ...)
|
||||
- pattern: setInterval($X, ...)
|
||||
- pattern-not: setTimeout(() => ..., ...)
|
||||
- pattern-not: setTimeout(function(...) {...}, ...)
|
||||
- pattern-not: setTimeout(function $F(...) {...}, ...)
|
||||
- pattern-not: setInterval(() => ..., ...)
|
||||
- pattern-not: setInterval(function(...) {...}, ...)
|
||||
- pattern-not: setInterval(function $F(...) {...}, ...)
|
||||
message: >
|
||||
Code injection risk: eval, Function constructor, or eval-like setTimeout
|
||||
detected. These can execute arbitrary code.
|
||||
severity: ERROR
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
- "**/index.ts"
|
||||
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
# Process environment: reading secrets
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
|
||||
- id: pi-extension-env-leak
|
||||
patterns:
|
||||
- pattern: process.env.$VAR
|
||||
- metavariable-regex:
|
||||
metavariable: $VAR
|
||||
regex: "(?!COMMANDCODE_|NODE_|PATH|HOME|SHELL|USER|LANG|LC_|TERM|TMPDIR|NIX_).*"
|
||||
message: >
|
||||
Reading unexpected environment variable $VAR. Provider should only
|
||||
read COMMANDCODE_* variables.
|
||||
severity: WARNING
|
||||
languages: [javascript, typescript]
|
||||
paths:
|
||||
include:
|
||||
- "**/*.ts"
|
||||
- "**/index.ts"
|
||||
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
# OAuth flow manipulation
|
||||
# ────────────────────────────────────────────────────────────────────────
|
||||
|
||||
Reference in New Issue
Block a user