From 903a7cc25327a0ff2da8a258d3e9a8fea36787b3 Mon Sep 17 00:00:00 2001 From: Marlon Costa Date: Thu, 6 Aug 2026 19:27:46 -0300 Subject: [PATCH 1/2] docs(security): Semgrep triage inventory (6 findings) Inventario dos findings da plataforma Semgrep com regra, arquivo e linha por achado. Totais: high 1, medium 5, low 0 (high confidence: 4) Classes: Insecure Configuration x4; (sem classe) x1; Improper Authorization x1 Bead: mro-p57t.5 Nenhuma alteracao de codigo de producao. Findings SAST exigem analise caso a caso do fluxo de dados. --- docs/security/semgrep-triage.md | 39 +++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 docs/security/semgrep-triage.md diff --git a/docs/security/semgrep-triage.md b/docs/security/semgrep-triage.md new file mode 100644 index 000000000..105fc1ce7 --- /dev/null +++ b/docs/security/semgrep-triage.md @@ -0,0 +1,39 @@ +# Triagem Semgrep — flext-sh/flext-core + +Gerado do dump da plataforma Semgrep (deployment `datacosmos`, 2026-08-06). + +Bead de rastreio: `mro-p57t.5` + +## Resumo + +**6 findings** — high 1, medium 5, low 0 +Confiança: high 4, medium 0, low 2 + +| regra | achados | +|---|---| +| `package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown` | 3 | +| `python.lang.compatibility.python37.python37-compatibility-importlib2` | 1 | +| `package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown` | 1 | +| `python.lang.security.audit.non-literal-import.non-literal-import` | 1 | + +## Findings + +Coluna **Decisão** a preencher: `corrigir` / `falso-positivo` / `risco-aceito`. + +| # | sev | conf | regra | arquivo | linha | Decisão | +|---|---|---|---|---|---|---| +| 1 | high | low | `python37-compatibility-importlib2` | `src/flext_core/_constants/_enforcement_data/__init__.py` | 9 | | +| 2 | medium | high | `dependabot-missing-cooldown` | `.github/dependabot.yml` | 4 | | +| 3 | medium | high | `dependabot-missing-cooldown` | `.github/dependabot.yml` | 11 | | +| 4 | medium | high | `dependabot-missing-cooldown` | `.github/dependabot.yml` | 18 | | +| 5 | medium | high | `uv-missing-dependency-cooldown` | `pyproject.toml` | 632 | | +| 6 | medium | low | `non-literal-import` | `src/flext_core/_utilities/_beartype/_helpers_parts/helpers_part_01.py` | 31 | | + +## Como triar + +1. Abrir `arquivo:linha` e seguir o fluxo até o sink. +2. Classificar: **corrigir** (entrada externa alcança o sink), **falso-positivo** (registrar via `nosemgrep` ou `.semgrepignore` com justificativa), **risco-aceito** (com prazo de revisão). +3. Priorizar findings high com confidence=high. + +Dados brutos: `~/semgrep-violations/by-repo/flext-sh__flext-core.json` + From 0f48f9d6e3875aa0191e11bcf403d0e4649a81b0 Mon Sep 17 00:00:00 2001 From: Marlon Costa Date: Thu, 6 Aug 2026 20:00:12 -0300 Subject: [PATCH 2/2] docs(security): enrich Semgrep triage with code snippets and full rule messages Cada achado agora traz: - codigo real numerado extraido da worktree (linha >>> = sink) - mensagem completa da regra (descricao do problema e do fix) - CWE/classe de vulnerabilidade e effort onde disponivel --- docs/security/semgrep-triage.md | 129 ++++++++++++++++++++++++++++---- 1 file changed, 114 insertions(+), 15 deletions(-) diff --git a/docs/security/semgrep-triage.md b/docs/security/semgrep-triage.md index 105fc1ce7..eb8e706f0 100644 --- a/docs/security/semgrep-triage.md +++ b/docs/security/semgrep-triage.md @@ -2,7 +2,7 @@ Gerado do dump da plataforma Semgrep (deployment `datacosmos`, 2026-08-06). -Bead de rastreio: `mro-p57t.5` +Bead: `mro-p57t.5` ## Resumo @@ -16,24 +16,123 @@ Confiança: high 4, medium 0, low 2 | `package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown` | 1 | | `python.lang.security.audit.non-literal-import.non-literal-import` | 1 | +## Como usar + +Cada finding traz a **mensagem completa da regra** (o Semgrep descreve o problema e frequentemente o fix), o **código real** (linha `>>>`), classe de vulnerabilidade, CWE/OWASP. +**Decisão**: `corrigir` / `falso-positivo` (`nosemgrep` ou `.semgrepignore` com justificativa) / `risco-aceito`. Priorizar high com confidence=high. + ## Findings -Coluna **Decisão** a preencher: `corrigir` / `falso-positivo` / `risco-aceito`. +### 1 · 🟠 HIGH · conf low · `python.lang.compatibility.python37.python37-compatibility-importlib2` +**Classe**: - · **Local**: `src/flext_core/_constants/_enforcement_data/__init__.py:9` + +> Found 'importlib.resources', which is a module only available on Python 3.7+. This does not work in lower versions, and therefore is not backwards compatible. Use importlib_resources instead for older Python versions. + +```python + 5 """ + 6 + 7 from __future__ import annotations + 8 +>>> 9 import importlib.resources + 10 from typing import TYPE_CHECKING, Final + 11 + 12 from pydantic import BaseModel, Field + 13 +``` + +**Decisão**: + +### 2 · 🟡 MEDIUM · conf high · `package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown` +**Classe**: Insecure Configuration · **Local**: `.github/dependabot.yml:4` + +> This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-option + +```yaml + 1 # Generated by `flext-infra codegen conform` for flext-core — DO NOT EDIT. + 2 version: 2 + 3 updates: +>>> 4 - package-ecosystem: github-actions + 5 directory: / + 6 schedule: + 7 interval: weekly + 8 open-pull-requests-limit: 5 +``` + +**Decisão**: + +### 3 · 🟡 MEDIUM · conf high · `package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown` +**Classe**: Insecure Configuration · **Local**: `.github/dependabot.yml:11` + +> This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-option + +```yaml + 7 interval: weekly + 8 open-pull-requests-limit: 5 + 9 labels: [dependencies, github-actions] + 10 +>>> 11 - package-ecosystem: devcontainers + 12 directory: / + 13 schedule: + 14 interval: weekly + 15 open-pull-requests-limit: 5 +``` + +**Decisão**: + +### 4 · 🟡 MEDIUM · conf high · `package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown` +**Classe**: Insecure Configuration · **Local**: `.github/dependabot.yml:18` + +> This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-option + +```yaml + 14 interval: weekly + 15 open-pull-requests-limit: 5 + 16 labels: [dependencies, devcontainers] + 17 +>>> 18 - package-ecosystem: pip + 19 directory: / + 20 schedule: + 21 interval: weekly + 22 open-pull-requests-limit: 5 +``` + +**Decisão**: + +### 5 · 🟡 MEDIUM · conf high · `package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown` +**Classe**: Insecure Configuration · **Local**: `pyproject.toml:632` + +> This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns + +```toml + 628 all = true + 629 in_place = true + 630 sort_first = ["build-system", "dependency-groups", "project", "tool"] + 631 +>>> 632 [tool.uv] + 633 link-mode = "copy" + 634 + 635 [[tool.uv.exclude-dependencies]] + 636 dependencies = ["flext-core"] +``` + +**Decisão**: -| # | sev | conf | regra | arquivo | linha | Decisão | -|---|---|---|---|---|---|---| -| 1 | high | low | `python37-compatibility-importlib2` | `src/flext_core/_constants/_enforcement_data/__init__.py` | 9 | | -| 2 | medium | high | `dependabot-missing-cooldown` | `.github/dependabot.yml` | 4 | | -| 3 | medium | high | `dependabot-missing-cooldown` | `.github/dependabot.yml` | 11 | | -| 4 | medium | high | `dependabot-missing-cooldown` | `.github/dependabot.yml` | 18 | | -| 5 | medium | high | `uv-missing-dependency-cooldown` | `pyproject.toml` | 632 | | -| 6 | medium | low | `non-literal-import` | `src/flext_core/_utilities/_beartype/_helpers_parts/helpers_part_01.py` | 31 | | +### 6 · 🟡 MEDIUM · conf low · `python.lang.security.audit.non-literal-import.non-literal-import` +**Classe**: Improper Authorization · **Local**: `src/flext_core/_utilities/_beartype/_helpers_parts/helpers_part_01.py:31` -## Como triar +> Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. -1. Abrir `arquivo:linha` e seguir o fluxo até o sink. -2. Classificar: **corrigir** (entrada externa alcança o sink), **falso-positivo** (registrar via `nosemgrep` ou `.semgrepignore` com justificativa), **risco-aceito** (com prazo de revisão). -3. Priorizar findings high com confidence=high. +```python + 27 """Return ``(alias, module_path, suffix)`` rows from package ``_LAZY_IMPORTS``.""" + 28 package = sys.modules.get(package_name) + 29 if package is None: + 30 try: +>>> 31 package = importlib.import_module(package_name) + 32 except (ImportError, ModuleNotFoundError): + 33 return () + 34 if not hasattr(package, "_LAZY_IMPORTS"): + 35 return () +``` -Dados brutos: `~/semgrep-violations/by-repo/flext-sh__flext-core.json` +**Decisão**: