From aa50cd4166846f58e3267eb32e11df9ac2864a53 Mon Sep 17 00:00:00 2001 From: luciferlive112116 <291889058+luciferlive112116@users.noreply.github.com> Date: Sun, 5 Jul 2026 13:53:59 +0800 Subject: [PATCH] feat(enrichment): flag insecure HTTP security-header settings in iac-misconfig Extend the iac-misconfig analyzer with three HTTP security-header rules that fire on the config files it already scans (nginx/Apache/Caddy conf, Helm ingress annotations, netlify.toml, JSON headers): - hsts-disabled: Strict-Transport-Security with max-age=0 (browsers stop enforcing HTTPS for the host) - referrer-policy-leak: Referrer-Policy: unsafe-url (leaks the full URL, path and query, cross-origin) - cookie-not-httponly: httpOnly: false on a cookie (readable by JavaScript, so an XSS can steal it) Each rule requires its own header token on the same line as the weakening value, so an unrelated line that merely carries the value (a normal Cache-Control: max-age=0 caching directive) is never flagged; a table test asserts one finding per insecure setting and a negative test asserts the secure counterpart of each produces none. No existing rule, threshold, or analyzer descriptor changes, so analyzer-metadata.json is unaffected. --- .../src/analyzers/iac-misconfig.ts | 26 +++++++++++++ review-enrichment/src/render.ts | 6 +++ review-enrichment/src/types.ts | 5 ++- review-enrichment/test/iac-misconfig.test.ts | 37 +++++++++++++++++++ 4 files changed, 73 insertions(+), 1 deletion(-) diff --git a/review-enrichment/src/analyzers/iac-misconfig.ts b/review-enrichment/src/analyzers/iac-misconfig.ts index 3175aa503c..841d51a78d 100644 --- a/review-enrichment/src/analyzers/iac-misconfig.ts +++ b/review-enrichment/src/analyzers/iac-misconfig.ts @@ -105,6 +105,14 @@ const NO_NEW_PRIVILEGES_OFF_RE = /\bno-new-privileges[=:]\s*["']?false\b/i; const DOCKER_SOCKET_MOUNT_RE = /\/var\/run\/docker\.sock:|\bsource\s*:\s*["']?\/var\/run\/docker\.sock\b/; +// HTTP security-header misconfigurations (nginx/Apache/Caddy conf, Helm ingress annotations, netlify.toml +// headers, …). Each rule requires ITS OWN header token to be present on the same line as the weakening value, +// so an unrelated line that merely contains the value (a `Cache-Control: max-age=0` caching directive) is NOT +// flagged — only a line that is actually setting that header. +const HSTS_DISABLED_RE = /\bStrict-Transport-Security\b[^\n]*\bmax-age\s*=\s*0\b/i; +const REFERRER_UNSAFE_URL_RE = /\bReferrer-Policy\b[^\n]*\bunsafe-url\b/i; +const COOKIE_NOT_HTTPONLY_RE = /\bhttp[_-]?only\b[\s"'=:,-]*false\b/i; + function* patchLines(patch: string): Generator { let start = 0; for (let i = 0; i <= patch.length; i++) { @@ -515,6 +523,24 @@ export function scanPatchForIacMisconfig( ) { return findings; } + if ( + HSTS_DISABLED_RE.test(body) && + pushFinding(findings, seen, path, newLine, "hsts-disabled", maxFindings) + ) { + return findings; + } + if ( + REFERRER_UNSAFE_URL_RE.test(body) && + pushFinding(findings, seen, path, newLine, "referrer-policy-leak", maxFindings) + ) { + return findings; + } + if ( + COOKIE_NOT_HTTPONLY_RE.test(body) && + pushFinding(findings, seen, path, newLine, "cookie-not-httponly", maxFindings) + ) { + return findings; + } newLine++; } diff --git a/review-enrichment/src/render.ts b/review-enrichment/src/render.ts index a2f61e54df..5d418ae81c 100644 --- a/review-enrichment/src/render.ts +++ b/review-enrichment/src/render.ts @@ -353,6 +353,12 @@ export function renderBrief( return "disables the `no-new-privileges` protection, allowing setuid binaries to escalate privileges"; case "docker-socket-mount": return "mounts the host Docker socket (`/var/run/docker.sock`) into the container — this grants host-level control"; + case "hsts-disabled": + return "disables HSTS with `Strict-Transport-Security` `max-age=0`, so browsers stop enforcing HTTPS for the host"; + case "referrer-policy-leak": + return "sets `Referrer-Policy: unsafe-url`, leaking the full URL (path and query) to cross-origin destinations"; + case "cookie-not-httponly": + return "sets `httpOnly: false` on a cookie, exposing it to JavaScript so an XSS can read it"; } }; diff --git a/review-enrichment/src/types.ts b/review-enrichment/src/types.ts index a811fb6756..7bfef1b21f 100644 --- a/review-enrichment/src/types.ts +++ b/review-enrichment/src/types.ts @@ -257,7 +257,10 @@ export interface IacMisconfigFinding { | "ipc-host" | "cap-add-all" | "no-new-privileges-off" - | "docker-socket-mount"; + | "docker-socket-mount" + | "hsts-disabled" + | "referrer-policy-leak" + | "cookie-not-httponly"; } /** A newly-added dependency whose install compiles native code (npm node-gyp addon) or has no prebuilt wheel diff --git a/review-enrichment/test/iac-misconfig.test.ts b/review-enrichment/test/iac-misconfig.test.ts index 00654bbb95..c5e0a7eac6 100644 --- a/review-enrichment/test/iac-misconfig.test.ts +++ b/review-enrichment/test/iac-misconfig.test.ts @@ -444,3 +444,40 @@ test("scanPatchForIacMisconfig does not flag the secure counterpart of each cont ); } }); + +test("scanPatchForIacMisconfig flags insecure HTTP security-header settings", () => { + // Each matched value is the weakening itself, so there is no safe-value form of the same line. + const cases = [ + ["+ add_header Strict-Transport-Security \"max-age=0\";", "hsts-disabled"], + ["+ add_header Referrer-Policy \"unsafe-url\";", "referrer-policy-leak"], + ["+ httpOnly: false", "cookie-not-httponly"], + ]; + for (const [added, kind] of cases) { + const findings = scanPatchForIacMisconfig( + "nginx.conf", + ["@@ -1,0 +1,1 @@", added].join("\n"), + ); + assert.deepEqual( + findings, + [{ file: "nginx.conf", line: 1, kind }], + `${kind}: expected exactly one finding of that kind, got ${JSON.stringify(findings)}`, + ); + } +}); + +test("scanPatchForIacMisconfig does not flag secure HTTP header values (incl. Cache-Control max-age=0)", () => { + const safe = [ + "+ add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\";", + // Cache-Control max-age=0 is a NORMAL caching directive and must NOT fire the HSTS rule. + "+ add_header Cache-Control \"max-age=0\";", + "+ add_header Referrer-Policy \"strict-origin-when-cross-origin\";", + "+ httpOnly: true", + ]; + for (const added of safe) { + assert.deepEqual( + scanPatchForIacMisconfig("nginx.conf", ["@@ -1,0 +1,1 @@", added].join("\n")), + [], + `should not flag: ${added.trim()}`, + ); + } +});