8dfab4ba14
Ausfuehrbares Pruefpaket fuer Payment-Terminal-Systeme: 1. Semgrep-Regeln (25 Regeln in 5 Dateien): - Logging: Sensitive Daten, Tokens, Debug-Flags - Crypto: MD5/SHA1/DES/ECB, Hardcoded Secrets, Weak Random, TLS - API: Debug-Routes, Exception Leaks, IDOR, Input Validation - Config: Test-Endpoints, CORS, Cookies, Retry - Data: Telemetrie, Cache, Export, Queue, Testdaten 2. CodeQL Query-Specs (5 Briefings): - Sensitive Data → Logs - Sensitive Data → HTTP Response - Tenant Context Loss - Sensitive Data → Telemetry - Cache/Export Leak 3. State-Machine-Tests (10 Testfaelle): - 11 Zustaende, 15 Events, 8 Invarianten - Duplicate Response, Timeout+Late Success, Decline - Invalid Reversal, Cancel, Backend Timeout - Parallel Reversal, Unknown Response, Reconnect - Late Response after Cancel 4. Finding Schema (JSON Schema): - Einheitliches Format fuer alle Engines - control_id, engine, status, confidence, evidence, verdict_text Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
43 lines
1.8 KiB
YAML
43 lines
1.8 KiB
YAML
rules:
|
|
- id: payment-no-sensitive-logging-python
|
|
message: Sensitive Zahlungsdaten duerfen nicht geloggt werden.
|
|
severity: ERROR
|
|
languages: [python]
|
|
patterns:
|
|
- pattern-either:
|
|
- pattern: logging.$METHOD(..., $X, ...)
|
|
- pattern: logger.$METHOD(..., $X, ...)
|
|
- metavariable-pattern:
|
|
metavariable: $X
|
|
pattern-regex: (?i).*(pan|cvv|cvc|track2|track_2|cardnumber|card_number|karten|pin|expiry|ablauf).*
|
|
|
|
- id: payment-no-sensitive-logging-js
|
|
message: Sensitive Zahlungsdaten duerfen nicht geloggt werden.
|
|
severity: ERROR
|
|
languages: [javascript, typescript]
|
|
patterns:
|
|
- pattern-either:
|
|
- pattern: console.$METHOD(..., $X, ...)
|
|
- pattern: logger.$METHOD(..., $X, ...)
|
|
- metavariable-pattern:
|
|
metavariable: $X
|
|
pattern-regex: (?i).*(pan|cvv|cvc|track2|cardnumber|pin|expiry).*
|
|
|
|
- id: payment-no-token-logging
|
|
message: Tokens oder Session-IDs duerfen nicht geloggt werden.
|
|
severity: ERROR
|
|
languages: [python, javascript, typescript, java, go]
|
|
pattern-regex: (?i)(log|logger|logging|console)\.(debug|info|warn|error).*?(token|sessionid|session_id|authheader|authorization)
|
|
|
|
- id: payment-no-debug-logging-prod-flag
|
|
message: Debug-Logging darf in produktiven Pfaden nicht fest aktiviert sein.
|
|
severity: WARNING
|
|
languages: [python, javascript, typescript, java, go]
|
|
pattern-regex: (?i)(DEBUG\s*=\s*true|debug\s*:\s*true|setLevel\(.*DEBUG.*\))
|
|
|
|
- id: payment-audit-log-admin-action
|
|
message: Administrative sicherheitsrelevante Aktion ohne Audit-Hinweis pruefen.
|
|
severity: INFO
|
|
languages: [python, javascript, typescript]
|
|
pattern-regex: (?i)(deleteTerminal|rotateKey|updateConfig|disableDevice|enableMaintenance)
|