Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Resources should only be accessible to actors that are intended to use them. When resources are exposed to the wrong sphere (e.g., public instead of private), unauthorized actors can access sensitive data or functionality.
So behebst du diese Schwachstelle
Use PersistentVolumeClaim or emptyDir instead of hostPath volumes
apiVersion: v1 kind: Pod spec: volumes: - name: data - hostPath: - path: /data + persistentVolumeClaim: + claimName: app-data-pvc containers: - name: app image: nginx:1.25 volumeMounts: - name: data mountPath: /app/data
Use ClusterIP with Ingress or LoadBalancer instead of NodePort for production services
apiVersion: v1 kind: Service spec: - type: NodePort - ports: - - port: 80 - nodePort: 30080 + type: ClusterIP + ports: + - port: 80 + targetPort: 8080
Use ECMAScript private fields (#) for true runtime encapsulation instead of TypeScript's compile-time-only modifiers
class UserSession { - private token: string; - private _refreshToken: string; - - constructor(token: string, refresh: string) { - this.token = token; - this._refreshToken = refresh; - } - } - - const session = new UserSession('abc', 'xyz'); - const leaked = (session as any).token; - const alsoLeaked = session['_refreshToken']; + #token: string; + #refreshToken: string; + + constructor(token: string, refresh: string) { + this.#token = token; + this.#refreshToken = refresh; + } + + validateToken(input: string): boolean { + return this.#token === input; + } + } + + const session = new UserSession('abc', 'xyz'); + // session.#token -> SyntaxError at runtime + // session['#token'] -> undefined
Finden Sie Schwachstellen in Ihrem Code
Verwenden Sie Shoulder, um Ihren Code nach Exposure of Resource to Wrong Sphere-Mustern zu scannen. 3 Regeln.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=668 # Or scan entire project npx @shoulderdev/cli trust .
Erkennungsregeln (3)
Worauf bei Code-Reviews zu achten ist
Diese Muster weisen auf potenzielle Exposure of Resource to Wrong Sphere-Schwachstellen hin. Achten Sie bei Code-Reviews und Sicherheitsaudits darauf.
Scanne deine Codebasis nach Exposure of Resource to Wrong Sphere
Shoulder CLI findet anfällige Muster in deiner gesamten Codebasis.