Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Resources should only be accessible to actors that are intended to use them. When resources are exposed to the wrong sphere (e.g., public instead of private), unauthorized actors can access sensitive data or functionality.
Cómo corregir esta vulnerabilidad
Use PersistentVolumeClaim or emptyDir instead of hostPath volumes
apiVersion: v1 kind: Pod spec: volumes: - name: data - hostPath: - path: /data + persistentVolumeClaim: + claimName: app-data-pvc containers: - name: app image: nginx:1.25 volumeMounts: - name: data mountPath: /app/data
Use ClusterIP with Ingress or LoadBalancer instead of NodePort for production services
apiVersion: v1 kind: Service spec: - type: NodePort - ports: - - port: 80 - nodePort: 30080 + type: ClusterIP + ports: + - port: 80 + targetPort: 8080
Use ECMAScript private fields (#) for true runtime encapsulation instead of TypeScript's compile-time-only modifiers
class UserSession { - private token: string; - private _refreshToken: string; - - constructor(token: string, refresh: string) { - this.token = token; - this._refreshToken = refresh; - } - } - - const session = new UserSession('abc', 'xyz'); - const leaked = (session as any).token; - const alsoLeaked = session['_refreshToken']; + #token: string; + #refreshToken: string; + + constructor(token: string, refresh: string) { + this.#token = token; + this.#refreshToken = refresh; + } + + validateToken(input: string): boolean { + return this.#token === input; + } + } + + const session = new UserSession('abc', 'xyz'); + // session.#token -> SyntaxError at runtime + // session['#token'] -> undefined
Encuentra vulnerabilidades en tu código
Usa Shoulder para escanear tu código en busca de patrones Exposure of Resource to Wrong Sphere. 3 reglas.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=668 # Or scan entire project npx @shoulderdev/cli trust .
Reglas de Detección (3)
Qué buscar en las revisiones de código
Estos patrones indican vulnerabilidades potenciales de Exposure of Resource to Wrong Sphere. Búscalos durante las revisiones de código y auditorías de seguridad.
Escanea tu base de código para Exposure of Resource to Wrong Sphere
Shoulder CLI encuentra patrones vulnerables en toda tu base de código.