fix: address PR review feedback

  - Fix generic-api-key regex to match unquoted values
  - Replace manual introspection validation with Zod schema
  - Extract parseJsonObject/hasAnyKey helpers in laravel-debug
  - Rewrite wordpress-readme to defineCheckV2 with stricter validation
  - Remove HTML-matching regex from xml-input-detection
  - Disable cookie-httponly and cookie-secure in light/balanced presets

Author: six2dez

packages/backend/src/checks/generic-api-key/index.spec.ts

@@ -103,6 +103,26 @@ describe("generic-api-key", () => {
     expect(history[0]?.steps[0]?.findings).toHaveLength(1);
   });
 
+  it("detects unquoted api_key value", async () => {
+    const history = await runCheck(check, [
+      {
+        request: createMockRequest({
+          id: "1",
+          host: "example.com",
+          method: "GET",
+          path: "/",
+        }),
+        response: createMockResponse({
+          id: "1",
+          code: 200,
+          body: "api_key=ABCDEFGHIJKLMNOPQRSTUVWXyz",
+        }),
+      },
+    ]);
+    expect(history).toHaveLength(1);
+    expect(history[0]?.steps[0]?.findings).toHaveLength(1);
+  });
+
   it("ignores short values", async () => {
     const history = await runCheck(check, [
       {

packages/backend/src/checks/generic-api-key/index.ts

@@ -12,7 +12,7 @@ export default defineRegexCheck({
   tags: [Tags.SECRET],
   severity: Severity.LOW,
   patterns: [
-    /(?:api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?token)["']?\s{0,5}[:=]\s{0,5}["']([A-Za-z0-9_-]{20,64})["']/i,
+    /(?:api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?token)["']?\s{0,5}[:=]\s{0,5}["']?([A-Za-z0-9_-]{20,64})(?:["']|\b)/i,
   ],
   dedupeKey: keyStrategy().withHost().withPort().withPath().build(),
   when: whenTextResponse,

packages/backend/src/checks/graphql/introspection/index.ts

@@ -1,40 +1,23 @@
 import { defineCheckV2, Result, Severity } from "engine";
+import { z } from "zod";
 
 import { Tags } from "../../../types";
 import { keyStrategy } from "../../../utils/key";
 
 const INTROSPECTION_QUERY = '{"query":"{ __schema { types { name } } }"}';
 const GET_INTROSPECTION_QUERY = "query={__schema{types{name}}}";
 
+const IntrospectionSchema = z.object({
+  data: z.object({
+    __schema: z.object({
+      types: z.array(z.unknown()),
+    }),
+  }),
+});
+
 function hasIntrospectionResult(body: string): boolean {
   try {
-    const parsed = JSON.parse(body) as {
-      data?: { __schema?: { types?: unknown[] } };
-    };
-
-    if (typeof parsed !== "object" || parsed === null) {
-      return false;
-    }
-
-    if (!("data" in parsed)) {
-      return false;
-    }
-
-    const data = parsed.data;
-    if (typeof data !== "object" || data === null) {
-      return false;
-    }
-
-    if (!("__schema" in data)) {
-      return false;
-    }
-
-    const schema = data.__schema;
-    if (typeof schema !== "object" || schema === null) {
-      return false;
-    }
-
-    return "types" in schema && Array.isArray(schema.types);
+    return IntrospectionSchema.safeParse(JSON.parse(body)).success;
   } catch {
     return false;
   }

packages/backend/src/checks/laravel-debug/index.ts

@@ -20,6 +20,34 @@ type EndpointConfig = {
   validator: (body: string, contentType: string) => boolean;
 };
 
+function parseJsonObject(
+  body: string,
+  contentType: string,
+): Record<string, unknown> | undefined {
+  if (!isJsonContentType(contentType)) {
+    return undefined;
+  }
+
+  try {
+    const parsed: unknown = JSON.parse(body);
+
+    if (typeof parsed !== "object" || parsed === null) {
+      return undefined;
+    }
+
+    return parsed as Record<string, unknown>;
+  } catch {
+    return undefined;
+  }
+}
+
+function hasAnyKey(
+  value: Record<string, unknown>,
+  keys: readonly string[],
+): boolean {
+  return keys.some((key) => key in value);
+}
+
 const LARAVEL_ENDPOINTS: EndpointConfig[] = [
   {
     path: "_ignition/health-check",
@@ -30,19 +58,10 @@ const LARAVEL_ENDPOINTS: EndpointConfig[] = [
     impact:
       "Attackers can confirm the application uses Laravel with Ignition debug mode enabled, and in vulnerable versions execute arbitrary code on the server.",
     validator: (body: string, contentType: string) => {
-      if (!isJsonContentType(contentType)) {
-        return false;
-      }
-      try {
-        const parsed = JSON.parse(body) as Record<string, unknown>;
-        return (
-          typeof parsed === "object" &&
-          parsed !== null &&
-          "can_execute_commands" in parsed
-        );
-      } catch {
-        return false;
-      }
+      const parsed = parseJsonObject(body, contentType);
+      return (
+        parsed !== undefined && hasAnyKey(parsed, ["can_execute_commands"])
+      );
     },
   },
   {
@@ -54,22 +73,11 @@ const LARAVEL_ENDPOINTS: EndpointConfig[] = [
     impact:
       "Attackers can access detailed profiling information including SQL queries with parameters, session data, authentication details, and application configuration.",
     validator: (body: string, contentType: string) => {
-      if (!isJsonContentType(contentType)) {
-        return false;
-      }
-      try {
-        const parsed = JSON.parse(body) as Record<string, unknown>;
-        return (
-          typeof parsed === "object" &&
-          parsed !== null &&
-          ("id" in parsed ||
-            "method" in parsed ||
-            "uri" in parsed ||
-            "time" in parsed)
-        );
-      } catch {
-        return false;
-      }
+      const parsed = parseJsonObject(body, contentType);
+      return (
+        parsed !== undefined &&
+        hasAnyKey(parsed, ["id", "method", "uri", "time"])
+      );
     },
   },
   {
@@ -81,19 +89,10 @@ const LARAVEL_ENDPOINTS: EndpointConfig[] = [
     impact:
       "Attackers can view all application requests, exceptions with stack traces, database queries, log entries, and scheduled tasks.",
     validator: (body: string, contentType: string) => {
-      if (!isJsonContentType(contentType)) {
-        return false;
-      }
-      try {
-        const parsed = JSON.parse(body) as Record<string, unknown>;
-        return (
-          typeof parsed === "object" &&
-          parsed !== null &&
-          ("data" in parsed || "entries" in parsed || "type" in parsed)
-        );
-      } catch {
-        return false;
-      }
+      const parsed = parseJsonObject(body, contentType);
+      return (
+        parsed !== undefined && hasAnyKey(parsed, ["data", "entries", "type"])
+      );
     },
   },
 ];

packages/backend/src/checks/slack-token-disclosure/index.spec.ts

@@ -10,7 +10,8 @@ const FAKE_SUFFIX = "FAKETESTVALUENOTREAL000000";
 const XOXB_TOKEN = XOXB_PREFIX + FAKE_MID + FAKE_SUFFIX;
 const XOXP_TOKEN = XOXP_PREFIX + FAKE_MID + FAKE_SUFFIX;
 const WEBHOOK_PREFIX = "https://hooks.slack.com/services/";
-const WEBHOOK_TOKEN = WEBHOOK_PREFIX + "T00000000/B00000000/ABCDEFGHIJKLMNOPQRSTUVWX";
+const WEBHOOK_TOKEN =
+  WEBHOOK_PREFIX + "T00000000/B00000000/ABCDEFGHIJKLMNOPQRSTUVWX";
 
 describe("slack-token-disclosure", () => {
   it("does not run on non-200 response", async () => {