Skip to content

ShipProof v0.8.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Aug 11:24
· 42 commits to main since this release
v0.8.1
98fa3f6

ShipProof v0.8.1 — JavaScript Taint Engine, 605-Rule Catalog, and Code-Scanning-Ready SARIF

ShipProof v0.8.1 closes the biggest capability gap against heavyweight SAST tools: the opt-in --cross-file engine now understands JavaScript and TypeScript the way it understood Python, the catalog grows to 605 executable rules with 30 promotions from the research backlog, and SARIF output speaks GitHub code-scanning's native ranking, threat-model tagging, and suggested-fix formats. Every workflow stays offline, deterministic, and dependency-free.

Highlights

  • JavaScript/TypeScript interprocedural taint: inline (req, res) handlers and named handlers registered through Express-style routes become entrypoints; request-derived values flow through local aliases into SQL (query/execute/raw), command execution (exec/execSync), path traversal (fs.* with alias resolution back to the entering parameter), SSRF (bare fetch, receiver-aware axios.<method>), DOM XSS (innerHTML/outerHTML assignments, document.write), and reflected HTML responses. Sanitizer awareness covers Number/parseInt/path.basename, containment guards (startsWith prefix checks), and parameterized placeholder arrays.
  • Python engine parity: a query built from a tainted parameter now reaches execute() through its variable via alias tracking, while bound-parameter tuples (execute(sql, (a, b))) are excluded from injectable SQL text — a real-world false positive found on Flask's own tutorial.
  • 30 promoted rules (SP051–SP080): prototype pollution via request merges, hardcoded JWT signing secrets, DES/3DES/RC4 selection, shell interpolation on Python and Node, session cookies missing HttpOnly/SameSite, credentials embedded in URL query strings, Mongo operator injection, PHP dynamic includes / preg_replace /e / extract() / superglobal shell calls, Java EL evaluation, condition assignments, Runtime.exec concatenation, default-AES transforms, unconstrained Spring mappings, Go world-writable modes / clock-seeded math/rand / allow-all WebSocket origins, Ruby eval(params) and VERIFY_NONE, Flask/Express file responses from request data, stack traces returned to clients, bare exception handlers, and reflected HTML responses. Every rule carries explanation metadata, positive/negative tests, and a catalog row.
  • Express authorization coverage: SP108 now fires on JavaScript admin routes that lack route-level auth middleware, global auth registration, and any broad authorization signal — comment prose can no longer grant or revoke coverage.
  • Code-scanning-ready SARIF: rules carry a deterministic security-severity ranking property and STRIDE threat-model tags across every covered CWE root; runs bind to the scanned commit through read-only versionControlProvenance plus automationDetails; curated flag-flip findings surface review-required mechanical fix scaffolds as JSON fix_scaffold fields and SARIF fixes. Redacted secret rules never scaffold, so before/after text can never leak credential material.
  • Precision hardening from real-world triage (express, flask, requests, juice-shop, DVWA, NodeGoat): SSRF loopback URLs require request-call context, .open( method look-alikes stop matching path traversal, sync-I/O findings require loop context, code-shaped matches inside string literals are suppressed while OAuth URL content rules stay exempt, minified/hashed bundles downgrade confidence, Next.js-only rules downgrade outside Next manifests, and the Python engine stops flagging bind-parameter tuples.
  • Benchmark suite grows teeth: multi-file cross-file-taint corpora with secure counterparts, an adversarial precision-trap suite where comment/string-literal look-alikes must stay silent while two-hop aliasing, destructured params, cookie-to-DOM chains, and three-file taint chains must all fire, head-to-head runs over all fixtures with the full engine enabled, a promotion-shortlist pipeline ranking the 7,800-slot research backlog by local implementability, and a weekly CI benchmark workflow with opt-in open-source evaluation.

Compatibility

  • Node.js 20 or newer for the CLI and adapters; Python 3.10 or newer for scanner-backed commands.
  • Policy version 1 and evidence schema version 1.0 remain compatible; scan reports add an optional per-finding fix_scaffold object (additive).
  • SARIF consumers see additive rule properties (security-severity, STRIDE tags) and run-level keys; existing fingerprints are unchanged.
  • Exit codes remain 0 pass, 1 gate failure, 2 invalid evidence.

Verification

The release commit must pass npm run check, the approved package file set check, packed-artifact smoke testing, and the full fixture battery (precision 1.0, zero findings on secure corpora) before the exact v0.8.1 tag is created.

Assets 5
Loading