From 382e721e3e421434b3e532b79317b8d538d01980 Mon Sep 17 00:00:00 2001 From: luciferlive112116 <291889058+luciferlive112116@users.noreply.github.com> Date: Mon, 6 Jul 2026 11:33:22 +0800 Subject: [PATCH] feat(enrichment): flag CORP unsafe-none in iac-misconfig Extend HTTP security-header coverage with Cross-Origin-Resource-Policy unsafe-none, matching the existing COOP/COEP rules. Co-authored-by: Cursor --- review-enrichment/src/analyzers/iac-misconfig.ts | 8 ++++++++ review-enrichment/src/render.ts | 2 ++ review-enrichment/src/types.ts | 3 ++- review-enrichment/test/iac-misconfig.test.ts | 4 +++- 4 files changed, 15 insertions(+), 2 deletions(-) diff --git a/review-enrichment/src/analyzers/iac-misconfig.ts b/review-enrichment/src/analyzers/iac-misconfig.ts index 960cb4bcec..6c073db1d8 100644 --- a/review-enrichment/src/analyzers/iac-misconfig.ts +++ b/review-enrichment/src/analyzers/iac-misconfig.ts @@ -116,6 +116,8 @@ const COOP_UNSAFE_NONE_RE = /\bCross-Origin-Opener-Policy\b[^\n]*\bunsafe-none\b/i; const COEP_UNSAFE_NONE_RE = /\bCross-Origin-Embedder-Policy\b[^\n]*\bunsafe-none\b/i; +const CORP_UNSAFE_NONE_RE = + /\bCross-Origin-Resource-Policy\b[^\n]*\bunsafe-none\b/i; function* patchLines(patch: string): Generator { let start = 0; @@ -557,6 +559,12 @@ export function scanPatchForIacMisconfig( ) { return findings; } + if ( + CORP_UNSAFE_NONE_RE.test(body) && + pushFinding(findings, seen, path, newLine, "corp-unsafe-none", maxFindings) + ) { + return findings; + } newLine++; } diff --git a/review-enrichment/src/render.ts b/review-enrichment/src/render.ts index 5cd5c6c97d..398b00543e 100644 --- a/review-enrichment/src/render.ts +++ b/review-enrichment/src/render.ts @@ -364,6 +364,8 @@ export function renderBrief( return "sets `Cross-Origin-Opener-Policy: unsafe-none`, allowing cross-origin pages to retain opener access"; case "coep-unsafe-none": return "sets `Cross-Origin-Embedder-Policy: unsafe-none`, disabling cross-origin isolation requirements for embedded resources"; + case "corp-unsafe-none": + return "sets `Cross-Origin-Resource-Policy: unsafe-none`, allowing any origin to load this resource without isolation"; } }; diff --git a/review-enrichment/src/types.ts b/review-enrichment/src/types.ts index 5891e4ce13..6c02e8b44a 100644 --- a/review-enrichment/src/types.ts +++ b/review-enrichment/src/types.ts @@ -272,7 +272,8 @@ export interface IacMisconfigFinding { | "referrer-policy-leak" | "cookie-not-httponly" | "coop-unsafe-none" - | "coep-unsafe-none"; + | "coep-unsafe-none" + | "corp-unsafe-none"; } /** A newly-added dependency whose install compiles native code (npm node-gyp addon) or has no prebuilt wheel diff --git a/review-enrichment/test/iac-misconfig.test.ts b/review-enrichment/test/iac-misconfig.test.ts index b65ce6e5bf..b0b705f827 100644 --- a/review-enrichment/test/iac-misconfig.test.ts +++ b/review-enrichment/test/iac-misconfig.test.ts @@ -463,6 +463,7 @@ test("scanPatchForIacMisconfig flags insecure HTTP security-header settings", () ["+ httpOnly: false", "cookie-not-httponly"], ["+ add_header Cross-Origin-Opener-Policy \"unsafe-none\";", "coop-unsafe-none"], ["+ add_header Cross-Origin-Embedder-Policy \"unsafe-none\";", "coep-unsafe-none"], + ["+ add_header Cross-Origin-Resource-Policy \"unsafe-none\";", "corp-unsafe-none"], ]; for (const [added, kind] of cases) { const findings = scanPatchForIacMisconfig( @@ -486,7 +487,8 @@ test("scanPatchForIacMisconfig does not flag secure HTTP header values (incl. Ca "+ httpOnly: true", "+ add_header Cross-Origin-Opener-Policy \"same-origin\";", "+ add_header Cross-Origin-Embedder-Policy \"require-corp\";", - // A bare `unsafe-none` config key without a COOP/COEP header token must NOT fire either rule. + "+ add_header Cross-Origin-Resource-Policy \"same-origin\";", + // A bare `unsafe-none` config key without a COOP/COEP/CORP header token must NOT fire any of those rules. "+ unsafe-none = false", ]; for (const added of safe) {