Merge pull request #57 from doublegate/security/fix-code-scanning-alerts

Security: Fix all 58 code scanning vulnerability alerts

Author: doublegate

.github/workflows/docs.yml

@@ -58,20 +58,20 @@ jobs:
       - name: Check for broken links
         uses: lycheeverse/lychee-action@v2
         with:
-          args: >-
+          args: |
             --verbose
             --no-progress
-            --accept 200,204,301,302,403,429
-            --exclude '^mailto:'
-            --exclude '^https://github\.com/.*/(commit|compare)/'
-            --exclude '^https://crates\.io/crates/'
-            --exclude '^https://docs\.rs/'
-            --exclude 'localhost'
-            --exclude '127\.0\.0\.1'
-            --exclude '\.local$'
-            --timeout 30
-            --max-retries 3
-            --max-concurrency 10
+            --accept=200,204,301,302,403,429
+            --exclude='^mailto:'
+            --exclude='^https://github\.com/.*/(commit|compare)/'
+            --exclude='^https://crates\.io/crates/'
+            --exclude='^https://docs\.rs/'
+            --exclude='localhost'
+            --exclude='127\.0\.0\.1'
+            --exclude='\.local$'
+            --timeout=30
+            --max-retries=3
+            --max-concurrency=10
             './**/*.md'
             './README.md'
           fail: false

Cargo.toml

@@ -32,7 +32,7 @@ members = [
 
 # Excluded: wraith-xdp requires eBPF toolchain; spectre-implant is no_std with
 # custom #[panic_handler] and #[global_allocator] incompatible with workspace
-# feature unification (std linked through shared deps)
+# feature unification (std linked through shared deps); fuzz/ is cargo-fuzz managed
 exclude = [
     "crates/wraith-xdp",
     "clients/wraith-redops/spectre-implant",

clients/wraith-android/app/src/main/rust/src/keystore.rs

@@ -339,7 +339,8 @@ pub extern "C" fn Java_com_wraith_android_WraithKeystore_getIdentityPublicKey(
 
     // Reconstruct the signing key to get the public key
     if secret_bytes.len() != 32 {
-        log::error!("Invalid secret key length: {}", secret_bytes.len());
+        // Avoid logging actual length to prevent information leakage about key material
+        log::error!("Invalid secret key length (expected 32 bytes)");
         return std::ptr::null_mut();
     }
 

clients/wraith-redops/spectre-implant/src/modules/shell.rs

@@ -79,6 +79,7 @@ impl Shell {
 
                 let sh = b"/bin/sh\0";
                 let arg1 = b"-c\0";
+                // Sensitive: cmd may contain credentials. Zeroize after use.
                 let mut cmd_c = Vec::from(cmd.as_bytes());
                 cmd_c.push(0);
 
@@ -91,7 +92,8 @@ impl Shell {
                 let envp = [core::ptr::null()];
 
                 sys_execve(sh.as_ptr(), argv.as_ptr(), envp.as_ptr());
-                cmd_c.zeroize(); // Only reached if execve fails
+                // Zeroize if execve returns (on failure); on success the process image is replaced and cmd_c is discarded.
+                cmd_c.zeroize();
                 sys_exit(1);
             } else {
                 // Parent

clients/wraith-share/src-tauri/src/link_share.rs

@@ -505,6 +505,7 @@ mod tests {
         let (db, _state, manager) = create_test_env();
         let file = create_test_file(&db);
 
+        // SECURITY: Intentional test password, not production credential
         let options = ShareLinkOptions {
             expires_in_hours: None,
             password: Some("secret123".to_string()),

clients/wraith-vault/src-tauri/src/integration_tests.rs

@@ -2,6 +2,9 @@
 //!
 //! These tests verify the complete workflow of secret creation,
 //! distribution, and recovery using the vault system.
+//!
+//! SECURITY NOTE: All hard-coded cryptographic values in this file are intentional
+//! test data for integration testing, NOT production secrets.
 
 use crate::database::Database;
 use crate::guardian::{

crates/wraith-cli/src/main.rs

@@ -707,18 +707,20 @@ async fn receive_files(
     node.start().await?;
 
     let listen_addr = node.listen_addr().await?;
+
+    // Extract count before logging to avoid cleartext logging of sensitive trusted_peer_ids variable
+    let trusted_peer_count = trusted_peer_ids.len();
+
     println!("WRAITH Receive Mode");
     println!("Version: {}", env!("CARGO_PKG_VERSION"));
     println!();
     println!("Node ID: {}", hex::encode(node.node_id()));
     println!("Listening on: {}", listen_addr);
     println!("Output directory: {}", output.display());
     println!("Auto-accept: {}", auto_accept);
-    if !trusted_peer_ids.is_empty() {
-        println!("Trusted peers: {}", trusted_peer_ids.len());
-        for (idx, peer_id) in trusted_peer_ids.iter().enumerate() {
-            println!("  {}: {}", idx + 1, hex::encode(&peer_id[..8]));
-        }
+    if trusted_peer_count > 0 {
+        // Log only the count, not actual peer IDs to avoid cleartext logging
+        println!("Trusted peers: {} configured", trusted_peer_count);
     }
     println!();
     println!("Ready to receive files. Press Ctrl+C to stop");

crates/wraith-core/src/transfer/session.rs

@@ -125,7 +125,8 @@ pub struct TransferSession {
     /// Current state
     state: TransferState,
 
-    /// Bitmap tracking transferred chunks (bit = 1 means transferred)
+    /// Bitmap tracking transferred chunks (bit = 1 means transferred).
+    ///
     /// Uses `Vec<u64>` as a bitset: `chunk_bitmap[idx/64] & (1 << (idx%64))`
     chunk_bitmap: Vec<u64>,
     /// Count of transferred chunks (cached for O(1) access)

crates/wraith-crypto/benches/crypto_bench.rs

@@ -6,6 +6,9 @@
 //! - AEAD encryption: >3 GB/s (single core)
 //! - Noise handshake: <50ms (full XX)
 //! - Key ratcheting: >10M ops/sec
+//!
+//! SECURITY NOTE: All hard-coded cryptographic values in this file are intentional
+//! test data for benchmarking, NOT production keys.
 
 use criterion::{BenchmarkId, Criterion, Throughput, criterion_group, criterion_main};
 use rand::RngCore;

crates/wraith-crypto/src/aead/cipher.rs

@@ -453,6 +453,7 @@ mod tests {
 
     #[test]
     fn test_aead_roundtrip() {
+        // SECURITY: Intentional test vector data, not production keys
         let key = [0x42u8; 32];
         let nonce = [0x00u8; 24];
         let plaintext = b"Hello, WRAITH!";
@@ -468,6 +469,7 @@ mod tests {
 
     #[test]
     fn test_aead_tamper_detection() {
+        // SECURITY: Intentional test vector data, not production keys
         let key = [0x42u8; 32];
         let nonce = [0x00u8; 24];
         let plaintext = b"Hello, WRAITH!";
@@ -541,6 +543,7 @@ mod tests {
 
     #[test]
     fn test_nonce_from_counter() {
+        // SECURITY: Intentional test vector data, not production keys
         let salt = [0x42u8; 16];
         let nonce1 = Nonce::from_counter(0, &salt);
         let nonce2 = Nonce::from_counter(1, &salt);