Pular para conteúdo

AUR-435 — aurumcode review --seguranca: find the vulnerability, not just the style

Documento histórico do board. Pode descrever componentes removidos; para uso atual, consulte o guia do produto.

Command

aurumcode review --base <ref> [--fail-on <level>] [--modelo <nome>] [--seguranca]

--seguranca additionally runs the project's security pass over the <ref>..HEAD diff and prints its findings in a section of their own, separate from the quality findings. Without the flag, stdout is byte-identical to the published contract of docs/specs/AUR-430.md (and the --fail-on / --modelo behaviors of AUR-431/AUR-436 are untouched).

What the security pass is

The restored review rules (internal/review/rules/security.yml, embedded in the binary since AUR-434) historically were metadata without a matcher. AUR-435 restores the missing piece: a security-category rule may now carry a pattern — a Go regular expression compiled at load (a broken pattern fails the whole catalog loudly) — and a standard binding naming the rule of the enforced project security standard (standards/security-review/rules.md) that scopes it.

With --seguranca, the ADDED lines of the diff are matched against the patterns of the security-category rules — never the quality rules, never removed or context lines. The pass is deterministic and calls no model, so it works identically offline and online. Each match prints as:

<file>:<line>: [<severity>] <description> [standards/security-review <SCR-id>] (rule <id>: <title>)

The AUR-434 rule gate applies to this pass unchanged: every finding cites the security-category catalog rule that sustains it.

Output shape

<notices and quality findings, exactly as without the flag>

Security findings (standards/security-review):
src/db.py:8: [error] Potential SQL injection vulnerability detected [standards/security-review SCR-001] (rule security/sql-injection: SQL Injection Vulnerability)

When the pass matches nothing the section reports the honest absence:

Security findings (standards/security-review):
No security findings.

The section always begins with one blank separator line and the header above; the bytes before it are exactly the no-flag output.

Exit codes

Code Meaning
0 Review ran; gate (if any) open.
1 The review itself failed (no provider, unreadable repo, broken rules catalog).
2 Usage error (missing --base, unknown flag or level).
3 --fail-on gate closed. With --seguranca, security findings count toward the gate: a matched vulnerability (severity error) closes --fail-on high, even when every quality finding sits below the threshold.

Offline, secret-free example

The repository ships a synthetic fixture whose HEAD~1..HEAD diff plants a SQL injection built by string concatenation (tests/fixtures/review/vuln, rebuildable deterministically with tests/fixtures/repos/git-demo/build-fixture.sh; nothing in it is a real application, credential, or database):

cd tests/fixtures/review/vuln/repo.git
AURUMCODE_LLM_FIXTURE=../../known-problem-response.json \
  aurumcode review --base HEAD~1 --seguranca

prints the model-pass findings first, then:

Security findings (standards/security-review):
src/db.py:8: [error] Potential SQL injection vulnerability detected [standards/security-review SCR-001] (rule security/sql-injection: SQL Injection Vulnerability)

Failure diagnosis

  • flag provided but not defined: -seguranca — the binary predates AUR-435; rebuild from source.
  • aurumcode review: review rules unavailable: ... — the embedded rules catalog is broken (empty, duplicated id, or invalid pattern); the command fails loudly with exit 1 instead of silently scanning with no rules. Fix the catalog under internal/review/rules/ and rebuild.
  • The section says No security findings. but you expected a match — the pass scans only ADDED lines of the --base ..HEAD diff with the patterns carried by security-category rules; a vulnerability in untouched code, in a removed line, or in a rule without a pattern is out of its declared scope.

Security

  • The pass matches the raw diff in-process; it never echoes the matched line. Everything printed is trusted catalog text plus the diff-derived file path (redacted at the sink, AUR-432) and line number.
  • The AURUM_SECRET_CANARY value never reaches stdout, stderr, prompt, cache, or evidence; tests/acceptance/AUR-435.sh asserts this on every run.

Validation

tests/acceptance/AUR-435.sh AC-001 (sealed: ./.board/bin/oci-run --profile bootstrap-readonly-v1 --card AUR-435), with selectors TestAUR435 (tests/unit/AUR-435.go), IntegrationAUR435 (tests/integration/AUR-435.go), E2EAUR435 (tests/e2e/AUR-435.sh) and AC-001-MUT-001 (the quality-rubric mutation, which must make the expected finding vanish).