Skip to content

v0.6.0 — Deep Scan

Choose a tag to compare

View all tags
@sabahattink sabahattink released this 29 Oct 20:18
v0.6.0
de87d9b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Deep Scan: CodeDiag now covers Fastify, finds JWT and session misconfiguration, template injection, prototype pollution, and secrets outside source code. It can compare two scans or limit a scan to the files a branch changes.

npx @sabahattink/codediag@0.6.0 scan . --compare previous.json
npx @sabahattink/codediag@0.6.0 scan . --changed-since origin/main

Fastify

The API Health analyzer now reads Fastify apps:

  • routes from fastify.get() and fastify.route(), including routes inside register()-ed plugins and fastify-plugin plugins
  • onRequest, preParsing, preValidation, and preHandler auth hooks on the route or its encapsulation context
  • body schemas on mutating routes
  • setErrorHandler
  • health endpoints

There are four new rules: no-fastify-routes, missing-auth-hook, missing-route-schema, and missing-error-handler.

New security rules

  • jwt-none-algorithm (critical): algorithms: ['none'], algorithm: 'none', or jose's UnsecuredJWT
  • jwt-expiration-ignored: ignoreExpiration: true
  • insecure-cookie: session and token cookies without httpOnly and secure, and session middleware that turns either flag off
  • server-side-template-injection (critical): request data compiled as an EJS, Pug, Handlebars, Nunjucks, Eta, doT, or lodash template
  • prototype-pollution: target[a][b] = value with keys from request data (critical), and recursive merges without a __proto__ guard (warning)
  • dynamic-command-execution now also covers spawn() and execFile() with shell: true

Secrets beyond source code

hardcoded-secret now scans these files for provider tokens and for long, high-entropy values of secret-like keys:

  • JSON, YAML, TOML, INI, XML, and properties files
  • Dockerfiles
  • .npmrc and .yarnrc

The new committed-env-secret rule reports secrets in .env files that Git tracks. Ignored .env files are never read, and no report includes a secret's value.

Compare scans, or scan only what changed

  • --compare <report.json> shows score and per-analyzer deltas since an earlier JSON report, plus new findings (NEW, isNew) and fixed findings. It works in every output format; SARIF results get baselineState.
  • --changed-since <revision> reports and scores only the findings in files changed since a Git revision. That includes commits since the merge base, staged and unstaged edits, and untracked files.

Redesigned HTML report and project page

The HTML report adds:

  • a score gauge
  • analyzer weights and deltas
  • a change panel and a scope banner
  • search and a "New" filter
  • rule links and print styles

It still loads nothing from the network.

The project page was redesigned as well.

VS Code extension 0.4.0

Quick fixes on each problem suppress the rule on that line or in that file (you type the reason), or open the rule's documentation. The .vsix is attached to this release.

Known limitations

  • Fastify plugins loaded with @fastify/autoload are not followed yet.
  • Fastify auth and validation are recognized by naming, as with Express.

Rules: 70 → 80 · Full changelog: https://github.com/sabahattink/codediag/blob/main/CHANGELOG.md

Assets 3
Loading