open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

fix(policy): read policy.json only from the caller's own working tree

Browse source 
loadPolicy() read .llm-security/policy.json from whatever root it was
given, and every scanner passes the SCANNED TARGET: scan-orchestrator
(policyRoot = resolve(args.target)), entropy-scanner (thresholds and
suppression patterns), signature-scanner (sig.custom_rules_path and
enabled_families), trigger-scanner (phrase lists) and ast-taint-scanner
(enabled, python_path). A foreign/cloned target could raise its own
entropy thresholds, disable SIG families, supply its own SIG ruleset or
name the interpreter the AST scanner spawns — configuring the scan of
itself. Same defect class as S3b's .llm-security-ignore fix.

Chosen: move isOwnWorkingTree() to scanners/lib/own-working-tree.mjs (one
copy, reused by the orchestrator's ignore-file check) and make
loadPolicy() refuse an EXPLICIT root that is not the caller's own tree —
defaults plus one stderr line, same form as S3b — because one rule in one
function covers every scanner and a future call site cannot forget it.
The IMPLICIT root (CLAUDE_PROJECT_ROOT/cwd, what every hook uses) is the
caller's own project by construction and is read as before.
entropy-scanner's calibration.policy_source no longer reports an ignored
file as its source.

New tests/scanners/policy-scope.test.mjs was red on 0d37f5a (foreign
target: entropy finding silenced, custom SIG rule loaded, findings differ
from the same tree without policy.json, no stderr line) and is green now;
its own-tree scenario (known-positive) is green before and after. The 15
existing policy tests that placed own-tree fixtures under os.tmpdir() now
use tests/helpers/own-tree.mjs (fixture under $HOME, cwd set to it).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-22 20:15:17 +02:00
commit 6d0f3c31fc
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
12 changed files with 364 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

25
scanners/scan-orchestrator.mjs
View file

@ -4,8 +4,8 @@
// shares file discovery, outputs JSON envelope to stdout.
// Zero external dependencies.
import { resolve, join, dirname, sep } from 'node:path';
import { existsSync, readFileSync, writeFileSync, appendFileSync, realpathSync } from 'node:fs';
import { resolve, join, dirname } from 'node:path';
import { existsSync, readFileSync, writeFileSync, appendFileSync } from 'node:fs';
import { fileURLToPath } from 'node:url';
import { tmpdir } from 'node:os';
import { discoverFiles } from './lib/file-discovery.mjs';
@ -13,6 +13,7 @@ import { envelope, resetCounter } from './lib/output.mjs';
import { saveBaseline, diffAgainstBaseline, extractFindings } from './lib/diff-engine.mjs';
import { toSARIF } from './lib/sarif-formatter.mjs';
import { loadPolicy } from './lib/policy-loader.mjs';
import { isOwnWorkingTree } from './lib/own-working-tree.mjs';
const FAIL_ON_LEVELS = ['critical', 'high', 'medium', 'low'];
@ -32,25 +33,9 @@ const FAIL_ON_LEVELS = ['critical', 'high', 'medium', 'low'];
// under the OS temp directory (where git-clone.mjs materializes clones) —
// the second check is defense-in-depth for the case a caller's own cwd sits
// under tmpdir. Loud, not silent: a foreign target with an ignore file logs
// one stderr line saying it was not honored.
// one stderr line saying it was not honored. S3c moved isOwnWorkingTree() to
// lib/own-working-tree.mjs so loadPolicy() applies the same rule.
// ---------------------------------------------------------------------------
function isOwnWorkingTree(targetPath) {
let resolvedTarget;
let resolvedCwd;
let resolvedTmp;
try {
resolvedTarget = realpathSync(resolve(targetPath));
resolvedCwd = realpathSync(process.cwd());
resolvedTmp = realpathSync(tmpdir());
} catch {
return false;
}
if (resolvedTarget === resolvedTmp || resolvedTarget.startsWith(resolvedTmp + sep)) {
return false;
}
return resolvedTarget === resolvedCwd || resolvedTarget.startsWith(resolvedCwd + sep);
}
function loadIgnoreRules(targetPath) {
const ignoreFile = join(targetPath, '.llm-security-ignore');
if (!existsSync(ignoreFile)) return [];