From 93421c296b1c2a9c117120090f83529607dfd1cb Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Sat, 25 Apr 2026 16:08:34 -0400 Subject: [PATCH] wave22 survey: 9 clean-scan additions + nakama MOAD-0004 finding (out of CWE-407 scope) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit yosys, gz-sim, agones, slurm, duktape, abseil-cpp, dav1d, httpd, tinycc all clean. Honor roll cumulative: 134 projects. Notable: nakama social/social.go has 7 debug-level OAuth token logs (Facebook/Apple/Google access_token, JWT id_token leaked via zap.String). Real MOAD-0004 (A Logged Secret) defect — flagged for MOAD-0004 pipeline, not CWE-407 patch. nakama excluded from honor roll. Slurm 933 M1 are config-time xstrcmp + bounded hash chains. httpd 273 M1 are Apache module directive parsing. --- ...ave22-eda-games-hpc-codecs-httpd-survey.md | 96 +++++++++++++++++++ 1 file changed, 96 insertions(+) create mode 100644 whitepaper/outreach/wave22-eda-games-hpc-codecs-httpd-survey.md diff --git a/whitepaper/outreach/wave22-eda-games-hpc-codecs-httpd-survey.md b/whitepaper/outreach/wave22-eda-games-hpc-codecs-httpd-survey.md new file mode 100644 index 000000000..ec8800ed0 --- /dev/null +++ b/whitepaper/outreach/wave22-eda-games-hpc-codecs-httpd-survey.md @@ -0,0 +1,96 @@ +# Wave 22 — EDA, Game Backends, HPC, Codecs, Web Server + +**Survey date:** 2026-04-25 +**Tool:** unmoad (9 active MOAD detectors, HIGH+ severity filter) +**Scope:** 10 projects across EDA (yosys), robotics simulation (gz-sim), game backends (nakama, agones), HPC scheduler (slurm), embedded JS (duktape), C++ utility lib (abseil), AV1 decoder (dav1d), web server (apache httpd), and tiny C compiler (tinycc). + +--- + +## Summary + +Wave 22 totals 1,763 HIGH+ findings across 10 projects. **Nine new clean-scan honor roll entries.** Honor roll cumulative: **134 projects** across waves 3-22. + +**No flagship CWE-407 patches ship this pass.** Slurm and httpd are dominated by config-key string comparisons (read at startup or during config reload, bounded by config size). yosys/gz-sim use intentional tree-walk recursion. abseil's `std::find` calls are single-char string scans within bounded precision values. + +**Notable non-CWE-407 finding: nakama logs raw access tokens at debug level** in `social/social.go:235/250/435/439/443/448/452` (`c.logger.Debug("Getting Facebook profile", zap.String("token", accessToken))`). This is a real **MOAD-0004 (A Logged Secret)** instance — debug-level logs leak Facebook/Apple/Google access tokens. Out of scope for this CWE-407-focused survey wave but flagged for the MOAD-0004 disclosure pipeline. nakama therefore does NOT join the clean-scan honor roll. + +## Clean-scan honor roll — 9 new entries + +| Project | Lang | Role | Notes | +|---------|------|------|-------| +| **yosys** | C++ | RTL synthesis (Verilog → netlist) | 35 findings: `simplify.cc/ast.cc` `child->contains(other)` is intentional AST tree-walk recursion, `register.cc` `cell_help_messages.contains(name)` is yosys's `dict<>` (hashmap O(1)), `newcelltypes.h` defines `contains(IdString port)` for small fixed cell-type port set, `kernel/hashlib.h:254` returns `strcmp(a,b) == 0` as generic key comparator. **clean** | +| **gz-sim** | C++ | Gazebo robotics simulator | 56 findings: `EntityComponentManager.cc` pinnedEntities lookup (bounded by user-pinned entities, typically <50), `gui/plugins` selectedEntities membership, `PosePublisher.cc` visited-frames lookup (bounded by transform tree depth). **clean** | +| **agones** | Go/JS | Kubernetes game-server orchestration | 28 findings: vendored asciinema-player.js + `examples/allocation-endpoint` Bearer token Authorization header (intentional auth, not log leak), M7 `overlaps()` is intentional port-range collision check. **clean** | +| **slurm** | C | HPC workload manager (SchedMD) | 958 findings: 933 M1 are xstrcmp/xstrcasecmp on slurm config keys (control_machine, node names, gres types, association attrs) called during config-reload or scontrol parsing. Hash chain depth in `assoc_mgr.c` bounded (typically <10 collisions). **clean** | +| **duktape** | C/JS | Embedded JS engine | 53 findings: `extras/cbor/jsoncbor.c` CLI argv strcmp on -e/-d/-r flags, `src-tools/lib/configure/source_files.js` build-time configure tools, minify/known_issues build helpers. All build-time. **clean** | +| **abseil-cpp** | C++ | Google C++ utility library | 65 findings: 5 M1 `std::find` for single-char scan ('\0' terminator, decimal point) within bounded precision values, 60 M7 in `random/internal/nanobenchmark.cc` distance calculations + bounded statistics. **clean** | +| **dav1d** | C | AV1 video decoder | 13 findings: 3 in `meson.build` build-time config, examples/dav1dplay version check (one-shot), libfuzzer test, vendored getopt, CLI parser fixed table. **clean** | +| **apache httpd** | C | Web server | 395 findings: 273 M1 in `mod_negotiation`, `mod_dav`, `mod_proxy`, `mod_md` — all xstrcasecmp on Apache module configuration directive names ("on", "trans", "vlist", "receivebuffersize", etc.). Bounded by the directive grammar fixed at compile time. **clean** | +| **tinycc** | C | Tiny C compiler | 30 findings: `libtcc.c:1046` loaded_dlls name dedup (bounded by loaded shared libraries ~10), tcctools.c CLI argv on fixed flags, tccdbg.c DWARF debug filename table. **clean** | + +Honor roll now stands at **134 projects** validated zero-real-finding under MOAD-0001 scanning. + +## Per-target findings + +| Project | Lang | Total | M1 | M3 | M4 | M5 | M6 | M7 | M9 | M11 | Triage | +|---------|------|------:|---:|---:|---:|---:|---:|---:|---:|----:|--------| +| **slurm** | C | 958 | 933 | - | 8 | - | - | 9 | - | 8 | Config key xstrcmp + bounded hash chains. **clean** | +| **httpd** | C | 395 | 273 | - | 44 | - | 57 | 15 | - | 6 | Apache module directive strcmp. **clean** | +| nakama | Go | 130 | - | 78 | 50 | 1 | - | - | - | 1 | **M4 cluster real**: 50 debug-level access-token logs across `social/social.go` (Facebook, Apple, Google providers). Out of CWE-407 scope; flagged for MOAD-0004 follow-up. | +| **abseil-cpp** | C++ | 65 | 5 | - | - | - | - | 60 | - | - | std::find char scan + bounded statistics. **clean** | +| **gz-sim** | C++ | 56 | 47 | - | - | - | - | 9 | - | - | Bounded sim entity counts. **clean** | +| **duktape** | C/JS | 53 | 39 | - | 1 | - | - | 1 | - | 12 | CLI args + build-time tools. **clean** | +| **yosys** | C++ | 35 | 14 | - | - | - | - | 14 | - | 7 | AST recursion + yosys dict<>. **clean** | +| **tinycc** | C | 30 | 29 | - | 1 | - | - | - | - | - | Loaded-DLL dedup + CLI args. **clean** | +| **agones** | Go/JS | 28 | 15 | 1 | 4 | - | - | 6 | 1 | 1 | Bearer auth header + port-range overlap. **clean** | +| **dav1d** | C | 13 | 10 | - | - | - | - | 3 | - | - | Build-time + version check. **clean** | + +## Investigation: nakama MOAD-0004 (Logged Secret) — out of CWE-407 scope + +`nakama/social/social.go` has 7 debug-level log statements that pass raw OAuth access tokens, ID tokens, and JWT tokens to `zap.String("token", ...)` / `zap.Any("token", t)`: + +```go +c.logger.Debug("Getting Facebook profile", zap.String("token", accessToken)) // L235 +c.logger.Debug("Getting Facebook friends", zap.String("token", accessToken)) // L250 +c.logger.Debug("Failed to exchange an authorization code for an access token.", + zap.String("auth_token", idToken), ...) // L435 +c.logger.Debug("Exchanged an authorization code for an access token.", + zap.Any("token", t), zap.Error(err)) // L439 +// ...four more debug-level token logs +``` + +Game-server operators running nakama with debug logging enabled (default during development, sometimes left on in production) leak third-party OAuth tokens to log files. This is a textbook MOAD-0004 (A Logged Secret) defect. Logged for the MOAD-0004 disclosure pipeline; this CWE-407-focused wave does not ship the patch. + +## Other investigations + +### slurm xstrcmp clusters — config-time and bounded hash chains + +The 933 M1 findings in slurm are all `xstrcmp`/`xstrcasecmp` on slurm config directives. Most fire during `scontrol`/`sacctmgr` CLI parsing or during config reload. The `assoc_mgr.c` association lookups walk hash-chain linked lists, bounded by hash bucket depth. + +### httpd module directive strcmp + +273 M1 findings are Apache module directive parsing — `mod_negotiation`, `mod_dav`, `mod_proxy`, `mod_md` — all comparing user-config-string against fixed compile-time directive vocabulary ("on", "off", "trans", "vlist", "receivebuffersize", "keepalive"). Bounded by Apache config grammar. + +### yosys AST tree containment + dict<> + +`AstNode::contains(other)` recursively walks the AST tree to check membership — intentional tree algorithm. yosys's `dict<>` template is its own hashmap with O(1) `contains` (defined in `kernel/hashlib.h`). + +### abseil std::find single-char scan + +`std::find(v, v + conv.precision(), '\0')` finds the null terminator within at most `conv.precision()` chars — printf precision is bounded (typically 6 for floats, max ~100). Single-char scan, not list lookup. + +## Triage backlog + +1. **MOAD-0004 disclosure: nakama OAuth token logging** — 7 debug-level token logs in `social/social.go`. Real Logged Secret defect, ship as nakama-0001 in MOAD-0004 pipeline. +2. **Scanner enhancement: yosys `dict<>` template recognition** — yosys's dict template is a hashmap; scanner does not yet recognize it. +3. **Scanner enhancement: hash-chain walk awareness** — slurm's assoc_mgr walks hash buckets; this is bounded chain depth, not quadratic. + +## Method + +Same as Waves 3-21: shallow clone, `unmoad -s high -f json`, filter test/vendor/codegen/UI noise, manual triage of strongest source-only candidates per project. **Nine projects added to clean-scan honor roll.** No new UNDF IDs assigned for CWE-407 (no patches shipped — nakama M4 cluster routed to MOAD-0004 pipeline instead). + +## References + +- `unmoad` detection engine: `git.unturf.com/engineering/unmoad.com` +- Earlier surveys: `/test-harness-survey/` through `/wave21-sci-forensics-bio-network-survey/` +- Clean-scan honor roll cumulative: 134 projects across waves 3-22