feat(sast): detect bearer DNS validation TOCTOU - #1080

Open

seonghobae wants to merge 105 commits into

sentinel/detect-bearer-dns-toctou-892

Commits on Sep 1, 2026

test(ssrf): preserve bearer DNS TOCTOU vulnerable oracle
seonghobae
committed
0e7191b
test(ssrf): preserve pinned HTTPS fixed oracle
seonghobae
committed
0530f8a
feat(ssrf): detect bearer DNS validation TOCTOU
seonghobae
committed
ba480e2
test(ssrf): exercise bearer DNS TOCTOU detector
seonghobae
committed
785119a
docs(changelog): record bearer DNS TOCTOU detector
seonghobae
committed
9fcafb7
docs(traceability): map bearer DNS TOCTOU detector evidence
seonghobae
committed
1274a13
test(ssrf): isolate DNS pinning repair boundary
seonghobae
committed
3fb319e
test(ssrf): preserve protected pinned HTTPS repair
seonghobae
committed
a99b02a
test(ssrf): bound DNS TOCTOU executable path
seonghobae
committed
d61cc18
fix(ssrf): require executable DNS TOCTOU flow
seonghobae
committed
2a7403c
test(ssrf): replay historical bearer push path
seonghobae
committed
ad7d083
fix(sast): cover ordinary urllib TOCTOU layouts
seonghobae
committed
2836857
test(sast): lock urllib TOCTOU layout boundaries
seonghobae
committed
9314528
fix(sast): cover bearer header syntax variants
seonghobae
committed
2181145
test(sast): lock bearer syntax variants
seonghobae
committed
62dd979
docs(security): record bearer TOCTOU syntax boundaries
seonghobae
committed
da21c97
test(ssrf): cover assigned and replaced bearer dispatch
seonghobae
committed
33b3033
fix(ssrf): bind bearer dispatch to live request flow
seonghobae
committed
e7a84fb
test(ssrf): preserve unsafe self-derived reassignments
seonghobae
committed
0782bab
fix(ssrf): preserve unsafe self-derived bearer flow
seonghobae
committed
d02e064
test(sast): preserve bearer DNS TOCTOU flow boundaries
seonghobae
committed
41d5833
fix(sast): ignore quoted names in TOCTOU reassignment flow
seonghobae
committed
e23bc99
docs: record TOCTOU reassignment provenance boundary
seonghobae
committed
17c89c7
fix(sast): preserve credential and conditional TOCTOU flow boundaries
seonghobae
committed
0472b40
test(sast): cover TOCTOU credential and nested-dispatch edges
seonghobae
committed
664fba5
fix(sast): tighten bearer DNS TOCTOU provenance
seonghobae
committed
ab02ca3
fix(sast): repair TOCTOU regression corpus
seonghobae
committed
2374813
docs(security): record bearer TOCTOU provenance boundaries
seonghobae
committed
c3ccac7
fix(sast): detect restored bearer credentials after preflight
seonghobae
committed
7558633
test(sast): preserve bearer restoration TOCTOU boundaries
seonghobae
committed
39aeaa9
fix(sast): bound restored bearer DNS flow
seonghobae
committed
ab5c7e1
test(sast): cover restored bearer flow barriers
seonghobae
committed
99e7ddb
docs: trace restored bearer provenance boundaries
seonghobae
committed
63dd65c
fix(sast): bind restored bearer headers to Request
seonghobae
committed
3ba1eaa
fix(sast): derive restored bearer credential at mutation
seonghobae
committed
09f0e95
test(sast): prove late bearer restoration supplies credential
seonghobae
committed
dde31d5
docs: clarify restored bearer credential provenance
seonghobae
committed
5c9e86a
fix(sast): bind bearer headers and nested request flow
seonghobae
committed
1db03cf
test(sast): lock request-header and branch replacement boundaries
seonghobae
committed
495319f
docs: trace request header and branch replacement boundaries
seonghobae
committed
d3f682b
fix(sast): model bearer header mutations as a unique subrule
seonghobae
committed
3f38342
test(sast): cover direct and restored bearer mutations
seonghobae
committed
d93c218
fix(sast): preserve POST and nested replacement flow boundaries
seonghobae
committed
01c3fa2
test(sast): lock latest bearer TOCTOU review boundaries
seonghobae
committed
fa2f791
docs(security): reconcile bearer TOCTOU detector family
seonghobae
committed
8878601
fix(sast): make bearer credential sources exclusive
seonghobae
committed
f7830e4
test(sast): enforce one bearer TOCTOU family finding
seonghobae
committed
eb3d970
fix(sast): preserve direct bearer spacing boundary
seonghobae
committed
db69ba0
test(sast): cover spaced one-line bearer overlap
seonghobae
committed
4f7ff69
test(sast): cover one-line bearer Request kwargs
seonghobae
committed
eaea642
fix(sast): detect one-line bearer Request kwargs
seonghobae
committed
661eded
test(sast): keep bearer removal branch-local
seonghobae
committed
ee0b750
fix(sast): keep bearer restore evidence branch-local
seonghobae
committed
7e61153
test(sast): cover nested bearer mutation paths
seonghobae
committed
3bdf6a4
fix(sast): follow reachable nested bearer dispatches
seonghobae
committed
04c59f2
ci: verify packaged rules on Python 3.12
seonghobae
committed
4564fef
fix(sast): track final bearer credential state
seonghobae
committed
40da1f5
fix(sast): close primary bearer provenance gaps
seonghobae
committed
46bdbcd
fix(sast): detect multiline Bearer TOCTOU syntax
seonghobae
committed
831725e
test(sast): cover multiline Bearer TOCTOU syntax
seonghobae
committed
81e8912

Commits on Sep 2, 2026

fix(sast): preserve multiline DNS TOCTOU flow barriers
seonghobae
committed
28bc627
test(sast): cover multiline DNS TOCTOU barriers
seonghobae
committed
1815b30
docs(security): trace multiline DNS TOCTOU rules
seonghobae
committed
c8620cc
fix(sast): cover fully multiline Bearer mutations
seonghobae
committed
fc5cdad
test(sast): cover fully multiline Bearer mutation flows
seonghobae
committed
a06ddce
docs(security): clarify multiline endpoint barrier
seonghobae
committed
3960226
test(sast): cover request state mutation boundaries
seonghobae
committed
5a8ea1b
fix(sast): track request destination and credential mutation
seonghobae
committed
abb0e0b
feat(sast): detect provable dynamic Bearer replacement
seonghobae
committed
ffeed61
docs(security): record request-state provenance boundaries
seonghobae
committed
2d34e41
test(sast): assert dynamic Bearer rule packaging
seonghobae
committed
a4421d7
fix(sast): compile dynamic bearer replacement detector
seonghobae
committed
c7cbe1d
test(sast): require compiled dynamic bearer detector
seonghobae
committed
4126fb2
fix(sast): carry request-state barriers into multiline bearer rules
seonghobae
committed
8a81dd0
test(sast): cover multiline request-state barriers
seonghobae
committed
427d4f2
test(sast): cover dynamic Bearer reviewed opener
seonghobae
committed
e228625
fix(sast): detect dynamic Bearer reviewed opener
seonghobae
committed
331f04c
fix(sast): restore compiled dynamic bearer detector
seonghobae
committed
e41dac0
fix(sast): track unredirected bearer credential store
seonghobae
committed
311062c
test(sast): cover unredirected bearer persistence
seonghobae
committed
f18367a
fix(sast): compile dynamic bearer detector in canonical rule
seonghobae
committed
f3ea510
chore(sast): keep one canonical dynamic bearer rule
seonghobae
committed
a84d5bb
docs(security): trace urllib credential-store provenance
seonghobae
committed
b952c82
docs(security): record unredirected bearer persistence
seonghobae
committed
e2c8fcc
test(sast): enforce unredirected family ownership
seonghobae
committed
2fc31ea
fix(sast): bind dynamic bearer Request destination
seonghobae
committed
f12c99c
fix(sast): model urllib header-store precedence
seonghobae
committed
2fbae8d
test(sast): verify urllib header precedence and destination binding
seonghobae
committed
58eb981
test(sast): enforce dynamic Request destination binding
seonghobae
committed
196a3c5
docs(security): correct urllib credential precedence
seonghobae
committed
45c1bd4
docs(security): correct unredirected header precedence
seonghobae
committed
44ba203
test(sast): lock dynamic destination provenance regressions
seonghobae
committed
5c91e61
fix(sast): terminate stale dynamic destination provenance
seonghobae
committed
eff3743
test(sast): preserve self-derived validated-url provenance
seonghobae
committed
1b073fa
test(sast): lock inverse-condition bearer path compatibility
seonghobae
committed
9f1cb8b
fix(sast): reject inverse-guard bearer branch joins
seonghobae
committed
217e90e
fix(sast): reject inverse-guard multiline branch joins
seonghobae
committed
b03e452
docs(traceability): record inverse-guard path boundary
seonghobae
committed
b231d6a
docs(changelog): record path-provenance detector repairs
seonghobae
committed
037b8be
test(ssrf): lock dynamic and unredirected provenance barriers
seonghobae
committed
75526a4
fix(ssrf): track dynamic bearer state before mutation
seonghobae
committed
38be651
fix(ssrf): invalidate stale unredirected request provenance
seonghobae
committed
fd7e764
test(sast): lock exhaustive Bearer branch boundaries
seonghobae
committed
865b0e1
fix(sast): model exhaustive Bearer branch state
seonghobae
committed
678c77d
test(sast): lock one-branch sanitizer reachability
seonghobae
committed
0a752c0