8dfab4ba14
Ausfuehrbares Pruefpaket fuer Payment-Terminal-Systeme: 1. Semgrep-Regeln (25 Regeln in 5 Dateien): - Logging: Sensitive Daten, Tokens, Debug-Flags - Crypto: MD5/SHA1/DES/ECB, Hardcoded Secrets, Weak Random, TLS - API: Debug-Routes, Exception Leaks, IDOR, Input Validation - Config: Test-Endpoints, CORS, Cookies, Retry - Data: Telemetrie, Cache, Export, Queue, Testdaten 2. CodeQL Query-Specs (5 Briefings): - Sensitive Data → Logs - Sensitive Data → HTTP Response - Tenant Context Loss - Sensitive Data → Telemetry - Cache/Export Leak 3. State-Machine-Tests (10 Testfaelle): - 11 Zustaende, 15 Events, 8 Invarianten - Duplicate Response, Timeout+Late Success, Decline - Invalid Reversal, Cancel, Backend Timeout - Parallel Reversal, Unknown Response, Reconnect - Late Response after Cancel 4. Finding Schema (JSON Schema): - Einheitliches Format fuer alle Engines - control_id, engine, status, confidence, evidence, verdict_text Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
31 lines
1.3 KiB
YAML
31 lines
1.3 KiB
YAML
rules:
|
|
- id: payment-sensitive-in-telemetry
|
|
message: Sensitive Zahlungsdaten in Telemetrie oder Tracing pruefen.
|
|
severity: ERROR
|
|
languages: [python, javascript, typescript, java, go]
|
|
pattern-regex: (?i)(trace|span|metric|telemetry).*(pan|cvv|track2|cardnumber|pin|expiry)
|
|
|
|
- id: payment-sensitive-in-cache
|
|
message: Sensitiver Wert in Cache-Key oder Cache-Payload pruefen.
|
|
severity: WARNING
|
|
languages: [python, javascript, typescript, java, go]
|
|
pattern-regex: (?i)(cache|redis|memcache).*(pan|cvv|track2|cardnumber|pin)
|
|
|
|
- id: payment-sensitive-export
|
|
message: Export oder Report mit sensitiven Feldern pruefen.
|
|
severity: WARNING
|
|
languages: [python, javascript, typescript, java, go]
|
|
pattern-regex: (?i)(export|report|csv|xlsx|pdf).*(pan|cvv|track2|cardnumber|pin)
|
|
|
|
- id: payment-test-fixture-real-data
|
|
message: Testdaten mit moeglichen echten Kartendaten pruefen.
|
|
severity: WARNING
|
|
languages: [json, yaml, python, javascript, typescript]
|
|
pattern-regex: (?i)(4111111111111111|5555555555554444|track2|cvv)
|
|
|
|
- id: payment-queue-sensitive-payload
|
|
message: Queue-Nachricht mit sensitiven Zahlungsfeldern pruefen.
|
|
severity: WARNING
|
|
languages: [python, javascript, typescript, java, go]
|
|
pattern-regex: (?i)(publish|send|enqueue).*(pan|cvv|track2|cardnumber|pin)
|