feat(probes): add isUnsafeSpawn #327
Conversation
Signed-off-by: Tony Gorez <[email protected]>
|
I don't worry much about false positive (we could still see in the real world if there is a lot or not). And CLI settings still propose to disable them (I think I will push to make experimental warning disable by default). |
|
Opened an issue in CLI: NodeSecure/cli#493 |
Signed-off-by: Tony Gorez <[email protected]>
Signed-off-by: Tony Gorez <[email protected]>
Signed-off-by: Tony Gorez <[email protected]>
Signed-off-by: Tony Gorez <[email protected]>
|
Signed-off-by: Tony Gorez <[email protected]>
Signed-off-by: Tony Gorez <[email protected]>
|
Now let's update doc and readme |
Signed-off-by: Tony Gorez <[email protected]>
Signed-off-by: Tony Gorez <[email protected]>
| @@ -133,6 +134,7 @@ This section describe all the possible warnings returned by JSXRay. Click on the | |||
| | [unsafe-import](./docs/unsafe-import.md) | ❌ | Unable to follow an import (require, require.resolve) statement/expr. | | |||
| | [unsafe-regex](./docs/unsafe-regex.md) | ❌ | A RegEx as been detected as unsafe and may be used for a ReDoS Attack. | | |||
| | [unsafe-stmt](./docs//unsafe-stmt.md) | ❌ | Usage of dangerous statement like `eval()` or `Function("")`. | | |||
| | [unsafe-sapwn](./docs//unsafe-spawn.md) | ❌ | Usage of suspicious commands in `child_process.spawn()`.| | |||
There was a problem hiding this comment.
| | [unsafe-sapwn](./docs//unsafe-spawn.md) | ❌ | Usage of suspicious commands in `child_process.spawn()`.| | |
| | [unsafe-spawn](./docs//unsafe-spawn.md) | ❌ | Usage of suspicious commands in `child_process.spawn()`.| |
There was a problem hiding this comment.
Also, the double slash is wrong (can you fix it for unsafe-stmt ?)
[unsafe-spawn](./docs//unsafe-spawn.md) -> [unsafe-spawn](./docs/unsafe-spawn.md)
|
|
||
| | Code | Severity | i18n | Experimental | | ||
| | --- | --- | --- | :-: | | ||
| | unsafe-spwan | `Warning` | `sast_warnings.unsafe_spawn` | ✅ | |
There was a problem hiding this comment.
| | unsafe-spwan | `Warning` | `sast_warnings.unsafe_spawn` | ✅ | | |
| | unsafe-spawn | `Warning` | `sast_warnings.unsafe_spawn` | ✅ | |
| @@ -51,6 +51,11 @@ export const warnings = Object.freeze({ | |||
| i18n: "sast_warnings.shady_link", | |||
| severity: "Warning", | |||
| experimental: false | |||
| }, | |||
| "unsafe-spawn": { | |||
| i18n: "sast_warnings.unsafe-spawn", | |||
There was a problem hiding this comment.
| i18n: "sast_warnings.unsafe-spawn", | |
| i18n: "sast_warnings.unsafe_spawn", |
| const kUnsafeCommands = ["csrutil"]; | ||
|
|
||
| function isUnsafeCommand(command) { | ||
| return Boolean(kUnsafeCommands.find((unsafeCommand) => command.includes(unsafeCommand))); |
There was a problem hiding this comment.
| return Boolean(kUnsafeCommands.find((unsafeCommand) => command.includes(unsafeCommand))); | |
| return kUnsafeCommands.some((unsafeCommand) => command.includes(unsafeCommand)); |
| // Import Internal Dependencies | ||
| import { ProbeSignals } from "../ProbeRunner.js"; | ||
|
|
||
| const kUnsafeCommands = ["csrutil"]; |
There was a problem hiding this comment.
| const kUnsafeCommands = ["csrutil"]; | |
| // CONSTANTS | |
| const kUnsafeCommands = ["csrutil"]; |
| @@ -0,0 +1,68 @@ | |||
| // Import Node.js Dependencies | |||
| import { test } from "node:test"; | |||
| import assert from "node:assert"; | |||
There was a problem hiding this comment.
| import assert from "node:assert"; | |
| import assert from "node:assert/strict"; |
We try to either use assert.strictEqual or node:assert/strict (which make assert.equal to be assert.strictEqual)
|
@fraxken I propose a |
Good for me |
I would like to introduce
isUnsafeSpwanprobe.I had the idea earlier in the day reading a book on macOS malware where authors try to detect if SIP is enabled (
csrutil).I noticed a bunch of commands that could be suspicious if passed in spawn/exec.
I imaged something where we could have a bunch of specific commands we could mark as suspicious.
My concerns is "What about false positives?" Maybe we would like to have a probe that could take a list of commands and add warnings only for these cases.