Risk audit

Plugs and Libraries
1

Risk Audit

Description

The Enhanced Risk Audit f for SilverBullet analyzes scripts for potentially dangerous constructs and API calls.
It provides a risk audit report that includes a trust score for each code block, a summary of findings, and a list of rules used to analyze scripts.

Commands

  • Security: Scan Current Page: Runs the scanner on the current page and generates a risk audit report.
  • Security: Scan All Children Pages: Scans all child pages of the current page and generates a risk audit report for each page.

Reports

audit1
audit2

Code

In my library,
https://github.com/malys/silverbullet-libraries/blob/main/src/RiskAudit.md

2 Likes
2

Rules and static analysis must be improved, but it seems correct.

3

Massive improvements:

  • revert scoring
  • add more dangerous pattern
5
  • add some screencasts
6

I love the idea of auditing and appreciate you sharing your work. I will be taking a closer look at it in the near future.

7

Feel free to contribute and to propose new checking rules.

1 Like
8

Might it eventually be used as an optional default filter before/after SB imports a library?

This makes SB both powerful (lots of APIs) and secure (with API restrictions on calls).

9

yes a hook before to install imported script

10

thanks !

11

I will update dependy analysis to integrate new internal api

12

Update! see changelog in md file.

  • performance
  • security checks improved
  • …
13

@zef
I’m looking for a way to get dynamically the list of internal api (ex: string, net ) from space lua to know intenal global declaration.

From space lua, is it possible?

14

Is system.listSyscalls() what you are looking or at least usable for that purpose?

15

Not possible right now, but let me quickly see if I can expose the _G global variable (which is a Lua thing but I never implemented it).

1 Like
16

From this commit you can access the global object via _G: Expose _G global variable in Space Lua · silverbulletmd/silverbullet@a89ab96 · GitHub (e.g. you can do table.keys(_G) to get a names of all top-level global variables)

2 Likes
17

You are very reactive. I suppose this commit is available on edge docker image? I will implement it in parallel of my current integration and switch on it to the next release.

It will be used in static code analysis and security code audit.
Many thanks

18

Yes, it’s on the edge builds already.

19

Bug fixes and performance improvements
See changelog in md file

1 Like