wave22 survey: 9 clean-scan additions + nakama MOAD-0004 finding (out of CWE-407 scope)
yosys, gz-sim, agones, slurm, duktape, abseil-cpp, dav1d, httpd, tinycc all clean. Honor roll cumulative: 134 projects. Notable: nakama social/social.go has 7 debug-level OAuth token logs (Facebook/Apple/Google access_token, JWT id_token leaked via zap.String). Real MOAD-0004 (A Logged Secret) defect — flagged for MOAD-0004 pipeline, not CWE-407 patch. nakama excluded from honor roll. Slurm 933 M1 are config-time xstrcmp + bounded hash chains. httpd 273 M1 are Apache module directive parsing.
This commit is contained in:
parent
0243ab3980
commit
93421c296b
1 changed files with 96 additions and 0 deletions
|
|
@ -0,0 +1,96 @@
|
|||
# Wave 22 — EDA, Game Backends, HPC, Codecs, Web Server
|
||||
|
||||
**Survey date:** 2026-04-25
|
||||
**Tool:** unmoad (9 active MOAD detectors, HIGH+ severity filter)
|
||||
**Scope:** 10 projects across EDA (yosys), robotics simulation (gz-sim), game backends (nakama, agones), HPC scheduler (slurm), embedded JS (duktape), C++ utility lib (abseil), AV1 decoder (dav1d), web server (apache httpd), and tiny C compiler (tinycc).
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
Wave 22 totals 1,763 HIGH+ findings across 10 projects. **Nine new clean-scan honor roll entries.** Honor roll cumulative: **134 projects** across waves 3-22.
|
||||
|
||||
**No flagship CWE-407 patches ship this pass.** Slurm and httpd are dominated by config-key string comparisons (read at startup or during config reload, bounded by config size). yosys/gz-sim use intentional tree-walk recursion. abseil's `std::find` calls are single-char string scans within bounded precision values.
|
||||
|
||||
**Notable non-CWE-407 finding: nakama logs raw access tokens at debug level** in `social/social.go:235/250/435/439/443/448/452` (`c.logger.Debug("Getting Facebook profile", zap.String("token", accessToken))`). This is a real **MOAD-0004 (A Logged Secret)** instance — debug-level logs leak Facebook/Apple/Google access tokens. Out of scope for this CWE-407-focused survey wave but flagged for the MOAD-0004 disclosure pipeline. nakama therefore does NOT join the clean-scan honor roll.
|
||||
|
||||
## Clean-scan honor roll — 9 new entries
|
||||
|
||||
| Project | Lang | Role | Notes |
|
||||
|---------|------|------|-------|
|
||||
| **yosys** | C++ | RTL synthesis (Verilog → netlist) | 35 findings: `simplify.cc/ast.cc` `child->contains(other)` is intentional AST tree-walk recursion, `register.cc` `cell_help_messages.contains(name)` is yosys's `dict<>` (hashmap O(1)), `newcelltypes.h` defines `contains(IdString port)` for small fixed cell-type port set, `kernel/hashlib.h:254` returns `strcmp(a,b) == 0` as generic key comparator. **clean** |
|
||||
| **gz-sim** | C++ | Gazebo robotics simulator | 56 findings: `EntityComponentManager.cc` pinnedEntities lookup (bounded by user-pinned entities, typically <50), `gui/plugins` selectedEntities membership, `PosePublisher.cc` visited-frames lookup (bounded by transform tree depth). **clean** |
|
||||
| **agones** | Go/JS | Kubernetes game-server orchestration | 28 findings: vendored asciinema-player.js + `examples/allocation-endpoint` Bearer token Authorization header (intentional auth, not log leak), M7 `overlaps()` is intentional port-range collision check. **clean** |
|
||||
| **slurm** | C | HPC workload manager (SchedMD) | 958 findings: 933 M1 are xstrcmp/xstrcasecmp on slurm config keys (control_machine, node names, gres types, association attrs) called during config-reload or scontrol parsing. Hash chain depth in `assoc_mgr.c` bounded (typically <10 collisions). **clean** |
|
||||
| **duktape** | C/JS | Embedded JS engine | 53 findings: `extras/cbor/jsoncbor.c` CLI argv strcmp on -e/-d/-r flags, `src-tools/lib/configure/source_files.js` build-time configure tools, minify/known_issues build helpers. All build-time. **clean** |
|
||||
| **abseil-cpp** | C++ | Google C++ utility library | 65 findings: 5 M1 `std::find` for single-char scan ('\0' terminator, decimal point) within bounded precision values, 60 M7 in `random/internal/nanobenchmark.cc` distance calculations + bounded statistics. **clean** |
|
||||
| **dav1d** | C | AV1 video decoder | 13 findings: 3 in `meson.build` build-time config, examples/dav1dplay version check (one-shot), libfuzzer test, vendored getopt, CLI parser fixed table. **clean** |
|
||||
| **apache httpd** | C | Web server | 395 findings: 273 M1 in `mod_negotiation`, `mod_dav`, `mod_proxy`, `mod_md` — all xstrcasecmp on Apache module configuration directive names ("on", "trans", "vlist", "receivebuffersize", etc.). Bounded by the directive grammar fixed at compile time. **clean** |
|
||||
| **tinycc** | C | Tiny C compiler | 30 findings: `libtcc.c:1046` loaded_dlls name dedup (bounded by loaded shared libraries ~10), tcctools.c CLI argv on fixed flags, tccdbg.c DWARF debug filename table. **clean** |
|
||||
|
||||
Honor roll now stands at **134 projects** validated zero-real-finding under MOAD-0001 scanning.
|
||||
|
||||
## Per-target findings
|
||||
|
||||
| Project | Lang | Total | M1 | M3 | M4 | M5 | M6 | M7 | M9 | M11 | Triage |
|
||||
|---------|------|------:|---:|---:|---:|---:|---:|---:|---:|----:|--------|
|
||||
| **slurm** | C | 958 | 933 | - | 8 | - | - | 9 | - | 8 | Config key xstrcmp + bounded hash chains. **clean** |
|
||||
| **httpd** | C | 395 | 273 | - | 44 | - | 57 | 15 | - | 6 | Apache module directive strcmp. **clean** |
|
||||
| nakama | Go | 130 | - | 78 | 50 | 1 | - | - | - | 1 | **M4 cluster real**: 50 debug-level access-token logs across `social/social.go` (Facebook, Apple, Google providers). Out of CWE-407 scope; flagged for MOAD-0004 follow-up. |
|
||||
| **abseil-cpp** | C++ | 65 | 5 | - | - | - | - | 60 | - | - | std::find char scan + bounded statistics. **clean** |
|
||||
| **gz-sim** | C++ | 56 | 47 | - | - | - | - | 9 | - | - | Bounded sim entity counts. **clean** |
|
||||
| **duktape** | C/JS | 53 | 39 | - | 1 | - | - | 1 | - | 12 | CLI args + build-time tools. **clean** |
|
||||
| **yosys** | C++ | 35 | 14 | - | - | - | - | 14 | - | 7 | AST recursion + yosys dict<>. **clean** |
|
||||
| **tinycc** | C | 30 | 29 | - | 1 | - | - | - | - | - | Loaded-DLL dedup + CLI args. **clean** |
|
||||
| **agones** | Go/JS | 28 | 15 | 1 | 4 | - | - | 6 | 1 | 1 | Bearer auth header + port-range overlap. **clean** |
|
||||
| **dav1d** | C | 13 | 10 | - | - | - | - | 3 | - | - | Build-time + version check. **clean** |
|
||||
|
||||
## Investigation: nakama MOAD-0004 (Logged Secret) — out of CWE-407 scope
|
||||
|
||||
`nakama/social/social.go` has 7 debug-level log statements that pass raw OAuth access tokens, ID tokens, and JWT tokens to `zap.String("token", ...)` / `zap.Any("token", t)`:
|
||||
|
||||
```go
|
||||
c.logger.Debug("Getting Facebook profile", zap.String("token", accessToken)) // L235
|
||||
c.logger.Debug("Getting Facebook friends", zap.String("token", accessToken)) // L250
|
||||
c.logger.Debug("Failed to exchange an authorization code for an access token.",
|
||||
zap.String("auth_token", idToken), ...) // L435
|
||||
c.logger.Debug("Exchanged an authorization code for an access token.",
|
||||
zap.Any("token", t), zap.Error(err)) // L439
|
||||
// ...four more debug-level token logs
|
||||
```
|
||||
|
||||
Game-server operators running nakama with debug logging enabled (default during development, sometimes left on in production) leak third-party OAuth tokens to log files. This is a textbook MOAD-0004 (A Logged Secret) defect. Logged for the MOAD-0004 disclosure pipeline; this CWE-407-focused wave does not ship the patch.
|
||||
|
||||
## Other investigations
|
||||
|
||||
### slurm xstrcmp clusters — config-time and bounded hash chains
|
||||
|
||||
The 933 M1 findings in slurm are all `xstrcmp`/`xstrcasecmp` on slurm config directives. Most fire during `scontrol`/`sacctmgr` CLI parsing or during config reload. The `assoc_mgr.c` association lookups walk hash-chain linked lists, bounded by hash bucket depth.
|
||||
|
||||
### httpd module directive strcmp
|
||||
|
||||
273 M1 findings are Apache module directive parsing — `mod_negotiation`, `mod_dav`, `mod_proxy`, `mod_md` — all comparing user-config-string against fixed compile-time directive vocabulary ("on", "off", "trans", "vlist", "receivebuffersize", "keepalive"). Bounded by Apache config grammar.
|
||||
|
||||
### yosys AST tree containment + dict<>
|
||||
|
||||
`AstNode::contains(other)` recursively walks the AST tree to check membership — intentional tree algorithm. yosys's `dict<>` template is its own hashmap with O(1) `contains` (defined in `kernel/hashlib.h`).
|
||||
|
||||
### abseil std::find single-char scan
|
||||
|
||||
`std::find(v, v + conv.precision(), '\0')` finds the null terminator within at most `conv.precision()` chars — printf precision is bounded (typically 6 for floats, max ~100). Single-char scan, not list lookup.
|
||||
|
||||
## Triage backlog
|
||||
|
||||
1. **MOAD-0004 disclosure: nakama OAuth token logging** — 7 debug-level token logs in `social/social.go`. Real Logged Secret defect, ship as nakama-0001 in MOAD-0004 pipeline.
|
||||
2. **Scanner enhancement: yosys `dict<>` template recognition** — yosys's dict template is a hashmap; scanner does not yet recognize it.
|
||||
3. **Scanner enhancement: hash-chain walk awareness** — slurm's assoc_mgr walks hash buckets; this is bounded chain depth, not quadratic.
|
||||
|
||||
## Method
|
||||
|
||||
Same as Waves 3-21: shallow clone, `unmoad -s high -f json`, filter test/vendor/codegen/UI noise, manual triage of strongest source-only candidates per project. **Nine projects added to clean-scan honor roll.** No new UNDF IDs assigned for CWE-407 (no patches shipped — nakama M4 cluster routed to MOAD-0004 pipeline instead).
|
||||
|
||||
## References
|
||||
|
||||
- `unmoad` detection engine: `git.unturf.com/engineering/unmoad.com`
|
||||
- Earlier surveys: `/test-harness-survey/` through `/wave21-sci-forensics-bio-network-survey/`
|
||||
- Clean-scan honor roll cumulative: 134 projects across waves 3-22
|
||||
Loading…
Add table
Add a link
Reference in a new issue