Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Resources should only be accessible to actors that are intended to use them. When resources are exposed to the wrong sphere (e.g., public instead of private), unauthorized actors can access sensitive data or functionality.
Jak naprawić tę podatność
Use PersistentVolumeClaim or emptyDir instead of hostPath volumes
apiVersion: v1 kind: Pod spec: volumes: - name: data - hostPath: - path: /data + persistentVolumeClaim: + claimName: app-data-pvc containers: - name: app image: nginx:1.25 volumeMounts: - name: data mountPath: /app/data
Use ClusterIP with Ingress or LoadBalancer instead of NodePort for production services
apiVersion: v1 kind: Service spec: - type: NodePort - ports: - - port: 80 - nodePort: 30080 + type: ClusterIP + ports: + - port: 80 + targetPort: 8080
Use ECMAScript private fields (#) for true runtime encapsulation instead of TypeScript's compile-time-only modifiers
class UserSession { - private token: string; - private _refreshToken: string; - - constructor(token: string, refresh: string) { - this.token = token; - this._refreshToken = refresh; - } - } - - const session = new UserSession('abc', 'xyz'); - const leaked = (session as any).token; - const alsoLeaked = session['_refreshToken']; + #token: string; + #refreshToken: string; + + constructor(token: string, refresh: string) { + this.#token = token; + this.#refreshToken = refresh; + } + + validateToken(input: string): boolean { + return this.#token === input; + } + } + + const session = new UserSession('abc', 'xyz'); + // session.#token -> SyntaxError at runtime + // session['#token'] -> undefined
Znajdz podatnosci w swoim kodzie
Uzyj Shoulder do skanowania kodu w poszukiwaniu wzorcow Exposure of Resource to Wrong Sphere. 3 reguly.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=668 # Or scan entire project npx @shoulderdev/cli trust .
Reguly Wykrywania (3)
Na co zwracac uwage podczas przegladu kodu
Te wzorce wskazuja na potencjalne podatnosci Exposure of Resource to Wrong Sphere. Szukaj ich podczas przegladow kodu i audytow bezpieczenstwa.
Przeskanuj swój kod w poszukiwaniu Exposure of Resource to Wrong Sphere
Shoulder CLI znajduje podatne wzorce w całym Twoim kodzie.