Claude/security audit dependencies 01 bm d3cw m2 gwhcxfd8 q82jd l

.github/workflows/ci.yml

@@ -0,0 +1,231 @@
+name: CI/CD Pipeline
+
+on:
+  push:
+    branches: [ main, master, develop, 'claude/*' ]
+  pull_request:
+    branches: [ main, master, develop ]
+  schedule:
+    # Run weekly security scan
+    - cron: '0 0 * * 0'
+
+jobs:
+  build-and-test:
+    name: Build and Test
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-22.04]
+        build_type: [Release, Debug]
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Install dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y \
+          cmake \
+          build-essential \
+          git \
+          autoconf \
+          automake \
+          libtool
+
+    - name: Create build directory
+      run: mkdir -p build
+
+    - name: Configure CMake
+      working-directory: build
+      run: cmake -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} ..
+
+    - name: Build
+      working-directory: build
+      run: make -j$(nproc)
+
+    - name: Run tests
+      working-directory: build
+      run: ctest --output-on-failure --timeout 300
+      continue-on-error: ${{ matrix.build_type == 'Debug' }}
+
+    - name: Check for security vulnerabilities in Debug build
+      if: matrix.build_type == 'Debug'
+      run: |
+        echo "WARNING: Debug builds have weakened cryptography"
+        echo "N-factor is reduced, entropy is minimized"
+        echo "DO NOT use Debug builds in production!"
+
+  static-analysis:
+    name: Static Analysis
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Install analysis tools
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y cppcheck clang-tools
+
+    - name: Run cppcheck
+      run: |
+        cppcheck --enable=all --suppress=missingIncludeSystem \
+          --error-exitcode=1 \
+          --inline-suppr \
+          --std=c99 \
+          src/ 2>&1 | tee cppcheck_report.txt
+      continue-on-error: true
+
+    - name: Upload cppcheck report
+      uses: actions/upload-artifact@v4
+      with:
+        name: cppcheck-report
+        path: cppcheck_report.txt
+
+    - name: Check for dangerous functions
+      run: |
+        echo "Checking for dangerous function usage..."
+        DANGEROUS_FUNCS="strcpy strcat sprintf gets"
+        FOUND_ISSUES=0
+        for func in $DANGEROUS_FUNCS; do
+          echo "Checking for $func..."
+          if grep -r "\\b$func\\s*(" src/ --include="*.c" --include="*.h" | grep -v "sqrl_secure_"; then
+            echo "WARNING: Found potential unsafe $func usage"
+            FOUND_ISSUES=1
+          fi
+        done
+        if [ $FOUND_ISSUES -eq 1 ]; then
+          echo "Found potentially dangerous functions - review recommended"
+        else
+          echo "No dangerous functions found outside of secure wrappers"
+        fi
+
+  memory-sanitizer:
+    name: Memory Sanitizer Check
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Install dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y cmake build-essential git autoconf automake libtool
+
+    - name: Create build directory
+      run: mkdir -p build
+
+    - name: Configure with AddressSanitizer
+      working-directory: build
+      run: |
+        cmake -DCMAKE_BUILD_TYPE=Debug \
+              -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
+              -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address" \
+              ..
+
+    - name: Build with sanitizers
+      working-directory: build
+      run: make -j$(nproc)
+
+    - name: Run sanitized tests
+      working-directory: build
+      run: |
+        export ASAN_OPTIONS=detect_leaks=1:check_initialization_order=1
+        ctest --output-on-failure --timeout 600 || true
+
+  security-scan:
+    name: Security Vulnerability Scan
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Check for sensitive data patterns
+      run: |
+        echo "Scanning for potential sensitive data exposure..."
+
+        # Check for hardcoded secrets
+        if grep -r "password\s*=\s*['\"]" src/ --include="*.c" --include="*.h"; then
+          echo "WARNING: Potential hardcoded password found"
+        fi
+
+        # Check for free() without clear
+        echo "Checking for potential CWE-226 violations..."
+        grep -n "free(" src/*.c src/**/*.c 2>/dev/null | head -20
+
+        echo "Security scan complete - review findings above"
+
+    - name: Verify secure memory handling
+      run: |
+        echo "Verifying secure memory handling functions are used..."
+
+        # Check that sqrl_secure functions exist
+        if [ -f "src/sqrl_secure.c" ]; then
+          echo "✓ Secure utility functions implemented"
+        else
+          echo "✗ Missing secure utility functions"
+          exit 1
+        fi
+
+        # Check for sodium_memzero usage
+        MEMZERO_COUNT=$(grep -r "sodium_memzero" src/ --include="*.c" | wc -l)
+        echo "Found $MEMZERO_COUNT sodium_memzero calls"
+
+        if [ "$MEMZERO_COUNT" -lt 10 ]; then
+          echo "WARNING: Low sodium_memzero usage - verify sensitive data is cleared"
+        fi
+
+  dependency-check:
+    name: Dependency Security Check
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Check libsodium version
+      run: |
+        SODIUM_VERSION=$(grep "GIT_TAG" CMakeLists.txt | grep libsodium -A 10 | grep "GIT_TAG" | head -1 | awk '{print $2}')
+        echo "libsodium version: $SODIUM_VERSION"
+
+        if [ "$SODIUM_VERSION" = "stable" ]; then
+          echo "WARNING: libsodium is not pinned to a specific version"
+          echo "This can lead to reproducibility issues"
+          exit 1
+        fi
+
+        echo "✓ libsodium is pinned to version: $SODIUM_VERSION"
+
+    - name: Check CMake minimum version
+      run: |
+        CMAKE_MIN=$(grep "cmake_minimum_required" CMakeLists.txt | grep -oP "VERSION\s+\K[0-9.]+")
+        echo "CMake minimum version: $CMAKE_MIN"
+
+        # Check if version is at least 3.10
+        MAJOR=$(echo $CMAKE_MIN | cut -d. -f1)
+        MINOR=$(echo $CMAKE_MIN | cut -d. -f2)
+
+        if [ "$MAJOR" -lt 3 ] || ([ "$MAJOR" -eq 3 ] && [ "$MINOR" -lt 10 ]); then
+          echo "WARNING: CMake minimum version should be at least 3.10"
+          exit 1
+        fi
+
+        echo "✓ CMake minimum version is adequate"
+
+    - name: Check build configuration
+      run: |
+        BUILD_TYPE=$(grep "set(CMAKE_BUILD_TYPE" CMakeLists.txt | grep -v "^#" | head -1)
+        echo "Default build type: $BUILD_TYPE"
+
+        if echo "$BUILD_TYPE" | grep -q "Debug"; then
+          echo "WARNING: Default build type is Debug"
+          echo "Debug builds have weakened cryptography!"
+          exit 1
+        fi
+
+        echo "✓ Build type is Release"

.whitesource

@@ -0,0 +1,8 @@
+{
+  "checkRunSettings": {
+    "vulnerableCheckRunConclusionLevel": "failure"
+  },
+  "issueSettings": {
+    "minSeverityLevel": "LOW"
+  }
+}

CMakeLists.txt

@@ -1,6 +1,8 @@
 project(libsqrl)
 set(PROJECT_NAME libsqrl)
-cmake_minimum_required(VERSION 2.8)
+# Security update: Updated CMake minimum to 3.10 (was 2.8)
+# This is required for CMake 4.0+ compatibility
+cmake_minimum_required(VERSION 3.10)
 
 # check for polluted source tree
 if(EXISTS ${CMAKE_SOURCE_DIR}/CMakeCache.txt OR
@@ -35,11 +37,37 @@ set(sqrl_version_minor 04)
 set(sqrl_build 0007)
 set(sqrl_version "${sqrl_version_major}.${sqrl_version_minor}.${sqrl_build}")
 
-#set(CMAKE_BUILD_TYPE Release)
-set(CMAKE_BUILD_TYPE Debug)
+# Security update: Changed to Release build by default (was Debug)
+# WARNING: Debug builds have weakened cryptography - DO NOT use in production
+set(CMAKE_BUILD_TYPE Release)
+#set(CMAKE_BUILD_TYPE Debug)
 
 set(CMAKE_C_FLAGS_DEBUG "-DDEBUG")
 
+# Security hardening: Add compiler flags for enhanced security
+if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_C_COMPILER_ID MATCHES "Clang")
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -Wformat-security")
+    set(CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE} -O2 -D_FORTIFY_SOURCE=2")
+
+    # Stack protection
+    include(CheckCCompilerFlag)
+    check_c_compiler_flag(-fstack-protector-strong HAS_STACK_PROTECTOR_STRONG)
+    if(HAS_STACK_PROTECTOR_STRONG)
+        set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fstack-protector-strong")
+    else()
+        check_c_compiler_flag(-fstack-protector HAS_STACK_PROTECTOR)
+        if(HAS_STACK_PROTECTOR)
+            set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fstack-protector")
+        endif()
+    endif()
+endif()
+
+# Linker hardening (Linux/Unix)
+if(UNIX AND NOT APPLE)
+    set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,-z,relro,-z,now")
+    set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Wl,-z,relro,-z,now")
+endif()
+
 enable_testing()
 
 set(SRCDIR ${CMAKE_SOURCE_DIR}/src)
@@ -73,7 +101,9 @@ ExternalProject_Add(libsodium
 #	BINARY_DIR ${CMAKE_BINARY_DIR}/libsodium
 	BUILD_IN_SOURCE 1
 	GIT_REPOSITORY https://github.com/jedisct1/libsodium.git
-	GIT_TAG stable
+	# Security update: Pin to specific version 1.0.20 (was: stable branch)
+	# This ensures reproducible builds and known security characteristics
+	GIT_TAG 1.0.20
 	UPDATE_COMMAND ""
 	CONFIGURE_COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/scripts/sodium-conf.sh ${CMAKE_BINARY_DIR}
 	BUILD_COMMAND make -s
@@ -108,12 +138,12 @@ set(SG_SERVER ${CMAKE_SOURCE_DIR}/src/server.c ${CMAKE_SOURCE_DIR}/src/server_pr
 source_group(Server FILES ${SG_SERVER})
 set(SG_CRYPTO ${CMAKE_SOURCE_DIR}/src/crypto/aes.c ${CMAKE_SOURCE_DIR}/src/crypto/gcm.c ${CMAKE_SOURCE_DIR}/src/crypto/crypt.c ${CMAKE_SOURCE_DIR}/src/crypto/aes.h ${CMAKE_SOURCE_DIR}/src/crypto/gcm.h)
 source_group(Crypto FILES ${SG_CRYPTO})
-set(SG_UTIL ${CMAKE_SOURCE_DIR}/src/util.c ${CMAKE_SOURCE_DIR}/src/encdec.c ${CMAKE_SOURCE_DIR}/src/realtime.c ${CMAKE_SOURCE_DIR}/src/uri.c ${CMAKE_SOURCE_DIR}/src/platform.c ${CMAKE_BINARY_DIR}/sqrl_depends.c)
+set(SG_UTIL ${CMAKE_SOURCE_DIR}/src/util.c ${CMAKE_SOURCE_DIR}/src/encdec.c ${CMAKE_SOURCE_DIR}/src/realtime.c ${CMAKE_SOURCE_DIR}/src/uri.c ${CMAKE_SOURCE_DIR}/src/platform.c ${CMAKE_SOURCE_DIR}/src/sqrl_secure.c ${CMAKE_BINARY_DIR}/sqrl_depends.c)
 source_group(Utility FILES ${SG_UTIL})
 set(SG_ENTROPY ${CMAKE_SOURCE_DIR}/src/entropy/entropy.c ${CMAKE_SOURCE_DIR}/src/entropy/rdrand.c ${CMAKE_SOURCE_DIR}/src/entropy/entropy.h ${CMAKE_SOURCE_DIR}/src/entropy/entropy_linux.h ${CMAKE_SOURCE_DIR}/src/entropy/entropy_mac.h ${CMAKE_SOURCE_DIR}/src/entropy/entropy_win.h ${CMAKE_SOURCE_DIR}/src/entropy/rdrand.h)
 source_group(Entropy FILES ${SG_ENTROPY})
 
-set(SG_HEADERS src/sqrl_internal.h src/sqrl_expert.h src/sqrl_client.h src/sqrl_server.h src/sqrl_common.h src/detect_platform.h src/utstring.h)
+set(SG_HEADERS src/sqrl_internal.h src/sqrl_expert.h src/sqrl_client.h src/sqrl_server.h src/sqrl_common.h src/detect_platform.h src/utstring.h src/sqrl_secure.h)
 source_group(Headers FILES ${SG_HEADERS})
 
 set(SRC ${SG_CLIENT_USER} ${SG_CLIENT} ${SG_SERVER} ${SG_CRYPTO} ${SG_UTIL} ${SG_ENTROPY})
@@ -176,7 +206,12 @@ add_executable(server_test src/test/server_test.c)
 target_link_libraries(server_test sqrl)
 set_target_properties(server_test PROPERTIES FOLDER Tests)
 
-install(FILES src/utstring.h src/sqrl_expert.h src/sqrl_client.h src/sqrl_server.h src/sqrl_common.h
+add_executable(secure_test src/test/secure_test.c src/sqrl_secure.c)
+add_dependencies(secure_test libsodium)
+target_link_libraries(secure_test sodium)
+set_target_properties(secure_test PROPERTIES FOLDER Tests)
+
+install(FILES src/utstring.h src/sqrl_expert.h src/sqrl_client.h src/sqrl_server.h src/sqrl_common.h src/sqrl_secure.h
 	DESTINATION include)
 
 install(TARGETS sqrl LIBRARY DESTINATION lib)
@@ -214,6 +249,7 @@ add_test(user_test ${EXECUTABLE_OUTPUT_PATH}/user_test)
 add_test(client_test ${EXECUTABLE_OUTPUT_PATH}/client_test)
 add_test(server_test ${EXECUTABLE_OUTPUT_PATH}/server_test)
 add_test(protocol_test ${EXECUTABLE_OUTPUT_PATH}/protocol_test)
+add_test(secure_test ${EXECUTABLE_OUTPUT_PATH}/secure_test)
 add_test(NAME sodium-test
 	WORKING_DIRECTORY ${CMAKE_BINARY_DIR}/src/libsodium/src/libsodium
 	COMMAND make check)