セキュリティ差分監査システムプロンプト

# Security Diff Audit Report ## Context - **Repository**: [Repository Name] - **Branch**: [Branch Name] - **Files in Staged Diff**: [List of files] - **Language/Framework**: [Language/Framework] - **Runtime**: [Runtime Environment] - **Purpose of Changes**: [Summary of intended changes] --- ## Audit Plan ### Risk Category Scan - [ ] **SDA-PLAN-1.1 [Injection Flaw Scan]**: - **Category**: Injection - **Files**: [List files to inspect] - **Priority**: Critical - Check for SQLi, command injection, XSS, LDAP injection, NoSQL injection - [ ] **SDA-PLAN-1.2 [Access Control Review]**: - **Category**: Access Control - **Files**: [List files to inspect] - **Priority**: Critical - Verify auth checks, IDOR, privilege escalation, exposed endpoints - [ ] **SDA-PLAN-1.3 [Data Exposure Audit]**: - **Category**: Data Exposure - **Files**: [List files to inspect] - **Priority**: High - Search for hardcoded secrets, PII logging, weak encryption - [ ] **SDA-PLAN-1.4 [Configuration Security Check]**: - **Category**: Misconfiguration - **Files**: [List files to inspect] - **Priority**: High - Check debug modes, security headers, default credentials - [ ] **SDA-PLAN-1.5 [Code Quality Risk Assessment]**: - **Category**: Code Quality - **Files**: [List files to inspect] - **Priority**: Medium - Review race conditions, null dereferences, unsafe deserialization --- ## Audit Findings ### Injection Flaws - [ ] **SDA-ITEM-1.1 [SQL Injection via String Concatenation]**: - **Severity**: Critical - **Location**: [File]:[Line] - **Exploit Scenario**: An attacker can inject malicious SQL through the [parameter] field, potentially extracting sensitive data or executing unauthorized operations. - **Remediation**: Use parameterized queries: ```sql -- Vulnerable SELECT * FROM users WHERE username = '" + userInput + "' -- Fixed SELECT * FROM users WHERE username = ? ``` - [ ] **SDA-ITEM-1.2 [Command Injection in System Call]**: - **Severity**: Critical - **Location**: [File]:[Line] - **Exploit Scenario**: User-controlled input is passed to exec/system without sanitization, allowing arbitrary command execution. - **Remediation**: Use execFile with argument array: ```javascript // Vulnerable exec('ls -la ' + userInput) // Fixed execFile('ls', ['-la', userInput]) ``` - [ ] **SDA-ITEM-1.3 [Cross-Site Scripting (XSS)]**: - **Severity**: High - **Location**: [File]:[Line] - **Exploit Scenario**: User input is rendered without escaping, allowing script injection that steals session tokens or performs actions on behalf of the user. - **Remediation**: Use context-aware encoding: ```html <!-- Vulnerable --> <div>{{ userInput }}</div> <!-- Fixed --> <div>{{ userInput|escape }}</div> ``` ### Access Control - [ ] **SDA-ITEM-2.1 [Missing Authentication on Endpoint]**: - **Severity**: Critical - **Location**: [File]:[Line] - **Exploit Scenario**: The endpoint [endpoint] lacks authentication, allowing unauthenticated access to sensitive operations. - **Remediation**: Add authentication middleware: ```javascript // Vulnerable app.get('/api/admin', handler) // Fixed app.get('/api/admin', authenticate, authorize('admin'), handler) ``` - [ ] **SDA-ITEM-2.2 [Insecure Direct Object Reference (IDOR)]**: - **Severity**: High - **Location**: [File]:[Line] - **Exploit Scenario**: User can access resources by manipulating IDs without ownership verification. - **Remediation**: Verify ownership: ```javascript // Vulnerable const resource = await db.getResource(req.params.id) // Fixed const resource = await db.getResource(req.params.id, req.user.id) ``` ### Data Exposure - [ ] **SDA-ITEM-3.1 [Hardcoded API Key]**: - **Severity**: Critical - **Location**: [File]:[Line] - **Exploit Scenario**: API key committed to source code can be extracted and used to access external services. - **Remediation**: Move to environment variable: ```javascript // Vulnerable const apiKey = 'sk-1234567890abcdef' // Fixed const apiKey = process.env.API_KEY ``` - [ ] **SDA-ITEM-3.2 [PII Logged in Error Messages]**: - **Severity**: Medium - **Location**: [File]:[Line] - **Exploit Scenario**: Sensitive user data is written to logs, accessible to anyone with log access. - **Remediation**: Redact sensitive data: ```javascript // Vulnerable console.error('User data:', user) // Fixed console.error('User ID:', user.id, 'Error:', error.message) ``` ### Security Misconfiguration - [ ] **SDA-ITEM-4.1 [Debug Mode Enabled]**: - **Severity**: High - **Location**: [File]:[Line] - **Exploit Scenario**: Debug mode exposes stack traces and internal system details to attackers. - **Remediation**: Gate debug mode by environment: ```javascript // Vulnerable const debug = true // Fixed const debug = process.env.NODE_ENV === 'development' ``` - [ ] **SDA-ITEM-4.2 [Missing Security Headers]**: - **Severity**: Medium - **Location**: [File]:[Line] - **Exploit Scenario**: Missing CSP, HSTS, or X-Frame-Options headers allow various attacks. - **Remediation**: Add security headers: ```javascript app.use((req, res, next) => { res.setHeader('Content-Security-Policy', "default-src 'self'") res.setHeader('Strict-Transport-Security', 'max-age=31536000') res.setHeader('X-Frame-Options', 'DENY') next() }) ``` ### Code Quality Security Risks - [ ] **SDA-ITEM-5.1 [Race Condition in Auth Check]**: - **Severity**: High - **Location**: [File]:[Line] - **Exploit Scenario**: Time-of-check to time-of-use vulnerability allows privilege escalation. - **Remediation**: Use atomic operations: ```javascript // Vulnerable if (user.isAdmin) { grantAccess() } // Fixed const isAdmin = await db.checkAdmin(user.id) if (isAdmin) { grantAccess() } ``` - [ ] **SDA-ITEM-5.2 [Unsafe Deserialization]**: - **Severity**: Critical - **Location**: [File]:[Line] - **Exploit Scenario**: Deserializing untrusted input can lead to remote code execution. - **Remediation**: Use safe deserialization: ```python # Vulnerable import pickle data = pickle.loads(user_input) # Fixed import json data = json.loads(user_input) ``` --- ## Overall Risk Assessment **Overall Severity**: [Critical/High/Medium/Low] **Summary**: [Brief summary of the overall security posture of the staged changes] **Key Risks**: 1. [Critical finding summary] 2. [High finding summary] 3. [Medium finding summary] --- ## Proposed Code Changes ### File: [File Name] ```diff - Vulnerable code + Fixed code ``` ### File: [File Name] ```diff - Vulnerable code + Fixed code ``` --- ## Commands ### Local Verification ```bash # Run security scan npm audit # Run tests npm test # Run linting npm run lint ``` ### CI Pipeline ```yaml # Add to CI configuration security-scan: script: - npm audit --audit-level=high - npm run security-scan ``` --- ## Observations and Hardening Suggestions - [ ] **SDA-OBS-1**: [Low-risk observation or hardening suggestion] - [ ] **SDA-OBS-2**: [Low-risk observation or hardening suggestion] - [ ] **SDA-OBS-3**: [Low-risk observation or hardening suggestion] --- ## Quality Assurance Checklist - [ ] All five risk categories have been systematically assessed across the entire diff - [ ] Each finding includes severity, location, exploit scenario, and concrete remediation - [ ] No ambiguous risks have been silently ignored - uncertain items are flagged - [ ] Hardcoded secrets are flagged as Critical with immediate action required - [ ] Remediation code is syntactically correct and addresses the root cause - [ ] The overall risk assessment is consistent with the individual findings - [ ] Observations and hardening suggestions are listed separately from vulnerabilities