Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Resources should only be accessible to actors that are intended to use them. When resources are exposed to the wrong sphere (e.g., public instead of private), unauthorized actors can access sensitive data or functionality.
この脆弱性の修正方法
Use PersistentVolumeClaim or emptyDir instead of hostPath volumes
apiVersion: v1 kind: Pod spec: volumes: - name: data - hostPath: - path: /data + persistentVolumeClaim: + claimName: app-data-pvc containers: - name: app image: nginx:1.25 volumeMounts: - name: data mountPath: /app/data
Use ClusterIP with Ingress or LoadBalancer instead of NodePort for production services
apiVersion: v1 kind: Service spec: - type: NodePort - ports: - - port: 80 - nodePort: 30080 + type: ClusterIP + ports: + - port: 80 + targetPort: 8080
Use ECMAScript private fields (#) for true runtime encapsulation instead of TypeScript's compile-time-only modifiers
class UserSession { - private token: string; - private _refreshToken: string; - - constructor(token: string, refresh: string) { - this.token = token; - this._refreshToken = refresh; - } - } - - const session = new UserSession('abc', 'xyz'); - const leaked = (session as any).token; - const alsoLeaked = session['_refreshToken']; + #token: string; + #refreshToken: string; + + constructor(token: string, refresh: string) { + this.#token = token; + this.#refreshToken = refresh; + } + + validateToken(input: string): boolean { + return this.#token === input; + } + } + + const session = new UserSession('abc', 'xyz'); + // session.#token -> SyntaxError at runtime + // session['#token'] -> undefined
コードの脆弱性を見つける
Shoulderを使用してコードのExposure of Resource to Wrong Sphereパターンをスキャンしましょう。 3 ルール.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=668 # Or scan entire project npx @shoulderdev/cli trust .
検出ルール (3)
コードレビューで注目すべき点
これらのパターンはExposure of Resource to Wrong Sphereの潜在的な脆弱性を示しています。コードレビューとセキュリティ監査中に探してください。
コードベースをスキャン: Exposure of Resource to Wrong Sphere
Shoulder CLI はコードベース全体から脆弱なパターンを見つけます。