From d808f4215346331443c90fc55dca86fd5d81d04c Mon Sep 17 00:00:00 2001 From: Marlon Costa Date: Thu, 6 Aug 2026 19:29:29 -0300 Subject: [PATCH 1/2] docs(security): Semgrep triage inventory (5 findings) Inventario dos findings da plataforma Semgrep com regra, arquivo e linha por achado. Totais: high 0, medium 5, low 0 (high confidence: 4) Classes: Insecure Configuration x4; Improper Authorization x1 Bead: mro-p57t.31 Nenhuma alteracao de codigo de producao. Findings SAST exigem analise caso a caso do fluxo de dados. --- docs/security/semgrep-triage.md | 37 +++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 docs/security/semgrep-triage.md diff --git a/docs/security/semgrep-triage.md b/docs/security/semgrep-triage.md new file mode 100644 index 00000000..3fc31c88 --- /dev/null +++ b/docs/security/semgrep-triage.md @@ -0,0 +1,37 @@ +# Triagem Semgrep — flext-sh/flext-tests + +Gerado do dump da plataforma Semgrep (deployment `datacosmos`, 2026-08-06). + +Bead de rastreio: `mro-p57t.31` + +## Resumo + +**5 findings** — high 0, medium 5, low 0 +Confiança: high 4, medium 0, low 1 + +| regra | achados | +|---|---| +| `package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown` | 3 | +| `package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown` | 1 | +| `python.lang.security.audit.non-literal-import.non-literal-import` | 1 | + +## Findings + +Coluna **Decisão** a preencher: `corrigir` / `falso-positivo` / `risco-aceito`. + +| # | sev | conf | regra | arquivo | linha | Decisão | +|---|---|---|---|---|---|---| +| 1 | medium | high | `dependabot-missing-cooldown` | `.github/dependabot.yml` | 4 | | +| 2 | medium | high | `dependabot-missing-cooldown` | `.github/dependabot.yml` | 11 | | +| 3 | medium | high | `dependabot-missing-cooldown` | `.github/dependabot.yml` | 18 | | +| 4 | medium | high | `uv-missing-dependency-cooldown` | `pyproject.toml` | 602 | | +| 5 | medium | low | `non-literal-import` | `src/flext_tests/_fixtures/settings.py` | 44 | | + +## Como triar + +1. Abrir `arquivo:linha` e seguir o fluxo até o sink. +2. Classificar: **corrigir** (entrada externa alcança o sink), **falso-positivo** (registrar via `nosemgrep` ou `.semgrepignore` com justificativa), **risco-aceito** (com prazo de revisão). +3. Priorizar findings high com confidence=high. + +Dados brutos: `~/semgrep-violations/by-repo/flext-sh__flext-tests.json` + From 1d061dfbe91187dc19fbe0910329648555b08ca8 Mon Sep 17 00:00:00 2001 From: Marlon Costa Date: Thu, 6 Aug 2026 20:00:57 -0300 Subject: [PATCH 2/2] docs(security): enrich Semgrep triage with code snippets and full rule messages Cada achado agora traz: - codigo real numerado extraido da worktree (linha >>> = sink) - mensagem completa da regra (descricao do problema e do fix) - CWE/classe de vulnerabilidade e effort onde disponivel --- docs/security/semgrep-triage.md | 109 ++++++++++++++++++++++++++++---- 1 file changed, 95 insertions(+), 14 deletions(-) diff --git a/docs/security/semgrep-triage.md b/docs/security/semgrep-triage.md index 3fc31c88..df8abd22 100644 --- a/docs/security/semgrep-triage.md +++ b/docs/security/semgrep-triage.md @@ -2,7 +2,7 @@ Gerado do dump da plataforma Semgrep (deployment `datacosmos`, 2026-08-06). -Bead de rastreio: `mro-p57t.31` +Bead: `mro-p57t.31` ## Resumo @@ -15,23 +15,104 @@ Confiança: high 4, medium 0, low 1 | `package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown` | 1 | | `python.lang.security.audit.non-literal-import.non-literal-import` | 1 | +## Como usar + +Cada finding traz a **mensagem completa da regra** (o Semgrep descreve o problema e frequentemente o fix), o **código real** (linha `>>>`), classe de vulnerabilidade, CWE/OWASP. +**Decisão**: `corrigir` / `falso-positivo` (`nosemgrep` ou `.semgrepignore` com justificativa) / `risco-aceito`. Priorizar high com confidence=high. + ## Findings -Coluna **Decisão** a preencher: `corrigir` / `falso-positivo` / `risco-aceito`. +### 1 · 🟡 MEDIUM · conf high · `package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown` +**Classe**: Insecure Configuration · **Local**: `.github/dependabot.yml:4` + +> This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-option + +```yaml + 1 # Generated by `flext-infra codegen conform` for flext-tests — DO NOT EDIT. + 2 version: 2 + 3 updates: +>>> 4 - package-ecosystem: github-actions + 5 directory: / + 6 schedule: + 7 interval: weekly + 8 open-pull-requests-limit: 5 +``` + +**Decisão**: + +### 2 · 🟡 MEDIUM · conf high · `package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown` +**Classe**: Insecure Configuration · **Local**: `.github/dependabot.yml:11` + +> This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-option + +```yaml + 7 interval: weekly + 8 open-pull-requests-limit: 5 + 9 labels: [dependencies, github-actions] + 10 +>>> 11 - package-ecosystem: devcontainers + 12 directory: / + 13 schedule: + 14 interval: weekly + 15 open-pull-requests-limit: 5 +``` + +**Decisão**: + +### 3 · 🟡 MEDIUM · conf high · `package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown` +**Classe**: Insecure Configuration · **Local**: `.github/dependabot.yml:18` + +> This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-option + +```yaml + 14 interval: weekly + 15 open-pull-requests-limit: 5 + 16 labels: [dependencies, devcontainers] + 17 +>>> 18 - package-ecosystem: pip + 19 directory: / + 20 schedule: + 21 interval: weekly + 22 open-pull-requests-limit: 5 +``` + +**Decisão**: + +### 4 · 🟡 MEDIUM · conf high · `package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown` +**Classe**: Insecure Configuration · **Local**: `pyproject.toml:602` + +> This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns + +```toml + 598 all = true + 599 in_place = true + 600 sort_first = ["build-system", "dependency-groups", "project", "tool"] + 601 +>>> 602 [tool.uv] + 603 link-mode = "copy" + 604 + 605 [[tool.uv.exclude-dependencies]] + 606 dependencies = ["flext-tests"] +``` + +**Decisão**: -| # | sev | conf | regra | arquivo | linha | Decisão | -|---|---|---|---|---|---|---| -| 1 | medium | high | `dependabot-missing-cooldown` | `.github/dependabot.yml` | 4 | | -| 2 | medium | high | `dependabot-missing-cooldown` | `.github/dependabot.yml` | 11 | | -| 3 | medium | high | `dependabot-missing-cooldown` | `.github/dependabot.yml` | 18 | | -| 4 | medium | high | `uv-missing-dependency-cooldown` | `pyproject.toml` | 602 | | -| 5 | medium | low | `non-literal-import` | `src/flext_tests/_fixtures/settings.py` | 44 | | +### 5 · 🟡 MEDIUM · conf low · `python.lang.security.audit.non-literal-import.non-literal-import` +**Classe**: Improper Authorization · **Local**: `src/flext_tests/_fixtures/settings.py:44` -## Como triar +> Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. -1. Abrir `arquivo:linha` e seguir o fluxo até o sink. -2. Classificar: **corrigir** (entrada externa alcança o sink), **falso-positivo** (registrar via `nosemgrep` ou `.semgrepignore` com justificativa), **risco-aceito** (com prazo de revisão). -3. Priorizar findings high com confidence=high. +```python + 40 ) -> None: + 41 """Bind canonical FLEXT runtime aliases onto pytest class instances.""" + 42 package_root = module.__package__ or module.__name__ + 43 package_name = package_root.split(".", maxsplit=1)[0] +>>> 44 tests_package = importlib.import_module(package_name) + 45 service_type = getattr(tests_package, "s", s) + 46 if not isinstance(service_type, type) or not issubclass(service_type, s): + 47 service_type = s + 48 service = service_type.fetch_global() +``` -Dados brutos: `~/semgrep-violations/by-repo/flext-sh__flext-tests.json` +**Decisão**: