Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Resources should only be accessible to actors that are intended to use them. When resources are exposed to the wrong sphere (e.g., public instead of private), unauthorized actors can access sensitive data or functionality.
Como corrigir esta vulnerabilidade
Use PersistentVolumeClaim or emptyDir instead of hostPath volumes
apiVersion: v1 kind: Pod spec: volumes: - name: data - hostPath: - path: /data + persistentVolumeClaim: + claimName: app-data-pvc containers: - name: app image: nginx:1.25 volumeMounts: - name: data mountPath: /app/data
Use ClusterIP with Ingress or LoadBalancer instead of NodePort for production services
apiVersion: v1 kind: Service spec: - type: NodePort - ports: - - port: 80 - nodePort: 30080 + type: ClusterIP + ports: + - port: 80 + targetPort: 8080
Use ECMAScript private fields (#) for true runtime encapsulation instead of TypeScript's compile-time-only modifiers
class UserSession { - private token: string; - private _refreshToken: string; - - constructor(token: string, refresh: string) { - this.token = token; - this._refreshToken = refresh; - } - } - - const session = new UserSession('abc', 'xyz'); - const leaked = (session as any).token; - const alsoLeaked = session['_refreshToken']; + #token: string; + #refreshToken: string; + + constructor(token: string, refresh: string) { + this.#token = token; + this.#refreshToken = refresh; + } + + validateToken(input: string): boolean { + return this.#token === input; + } + } + + const session = new UserSession('abc', 'xyz'); + // session.#token -> SyntaxError at runtime + // session['#token'] -> undefined
Encontre vulnerabilidades no seu código
Use o Shoulder para escanear seu código em busca de padrões Exposure of Resource to Wrong Sphere. 3 regras.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=668 # Or scan entire project npx @shoulderdev/cli trust .
Regras de Detecção (3)
O que observar nas revisões de código
Estes padrões indicam vulnerabilidades potenciais de Exposure of Resource to Wrong Sphere. Procure-os durante revisões de código e auditorias de segurança.
Escaneie seu código para Exposure of Resource to Wrong Sphere
O Shoulder CLI encontra padrões vulneráveis em todo o seu código.