8dfab4ba14
Ausfuehrbares Pruefpaket fuer Payment-Terminal-Systeme: 1. Semgrep-Regeln (25 Regeln in 5 Dateien): - Logging: Sensitive Daten, Tokens, Debug-Flags - Crypto: MD5/SHA1/DES/ECB, Hardcoded Secrets, Weak Random, TLS - API: Debug-Routes, Exception Leaks, IDOR, Input Validation - Config: Test-Endpoints, CORS, Cookies, Retry - Data: Telemetrie, Cache, Export, Queue, Testdaten 2. CodeQL Query-Specs (5 Briefings): - Sensitive Data → Logs - Sensitive Data → HTTP Response - Tenant Context Loss - Sensitive Data → Telemetry - Cache/Export Leak 3. State-Machine-Tests (10 Testfaelle): - 11 Zustaende, 15 Events, 8 Invarianten - Duplicate Response, Timeout+Late Success, Decline - Invalid Reversal, Cancel, Backend Timeout - Parallel Reversal, Unknown Response, Reconnect - Late Response after Cancel 4. Finding Schema (JSON Schema): - Einheitliches Format fuer alle Engines - control_id, engine, status, confidence, evidence, verdict_text Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
38 lines
1.5 KiB
YAML
38 lines
1.5 KiB
YAML
rules:
|
|
- id: payment-debug-route
|
|
message: Debug- oder Diagnosepfad im produktiven API-Code pruefen.
|
|
severity: WARNING
|
|
languages: [python, javascript, typescript, java, go]
|
|
pattern-regex: (?i)(/debug|/internal|/test|/actuator|/swagger|/openapi)
|
|
|
|
- id: payment-admin-route-without-auth
|
|
message: Administrative Route ohne offensichtlichen Auth-Schutz pruefen.
|
|
severity: WARNING
|
|
languages: [python]
|
|
patterns:
|
|
- pattern: |
|
|
@app.$METHOD($ROUTE)
|
|
def $FUNC(...):
|
|
...
|
|
- metavariable-pattern:
|
|
metavariable: $ROUTE
|
|
pattern-regex: (?i).*(admin|config|terminal|maintenance|device|key).*
|
|
|
|
- id: payment-raw-exception-response
|
|
message: Roh-Exceptions duerfen nicht direkt an Clients zurueckgegeben werden.
|
|
severity: ERROR
|
|
languages: [python, javascript, typescript]
|
|
pattern-regex: (?i)(return .*str\(e\)|res\.status\(500\)\.send\(e|json\(.*error.*e)
|
|
|
|
- id: payment-missing-input-validation
|
|
message: Zahlungsrelevanter Endpunkt ohne offensichtliche Validierung pruefen.
|
|
severity: INFO
|
|
languages: [python, javascript, typescript]
|
|
pattern-regex: (?i)(amount|currency|terminalId|transactionId)
|
|
|
|
- id: payment-idor-risk
|
|
message: Direkter Zugriff ueber terminalId/transactionId ohne Pruefung.
|
|
severity: WARNING
|
|
languages: [python, javascript, typescript, java, go]
|
|
pattern-regex: (?i)(get.*terminalId|find.*terminalId|get.*transactionId|find.*transactionId)
|