trailofbits-skills/plugins/c-review/prompts/windows-userspace/named-pipe-finder.md at 870955f1af03acfec736f77c287219bc01af11e9

mirror of https://github.com/trailofbits/skills synced 2026-06-21 14:12:00 +00:00

Files

T

Paweł Płatek 870955f1af C review (#156 )

* init c review

* lsp

* agents -> prompts

* wip

* add windows, update judges

* improve

* upgrade

* size update

* rm toon format, improve workflow, cluster agents/prompts by issue type, improve prompt cache

* improve general workflow, fix bugs

* sarif via script, cluster manifest

* fix bugs

* fix workflow2

* workflow updates

* more fixes

* more fixes

* improvements

* update readme

* update codeowners

* update codeowners2

* fix small inconsistencies

* Address review feedback on c-review plugin

Critical:
- Move SKILL.md into named skill subdirectory (plugins/c-review/skills/c-review/)
  so plugin discovery and the Codex validator find it; add .codex/skills/c-review
  symlink.
- Convert allowed-tools in SKILL.md from YAML list to space-delimited string
  (spec compliance per #139).
- Fix parse_scalar in generate_sarif.py to respect quoted strings when splitting
  inline lists; ["a,b", c] no longer corrupts to ['"a', 'b"', 'c'].
- Fix location_parts trailing-colon handling so 'src/foo.c:' resolves to
  ('src/foo.c', 1) instead of keeping the colon in the filename.

Important:
- Convert agent tools: from YAML list to comma-separated string in worker,
  dedup-judge, fp-judge.
- Refactor build_run_plan.py main() (131 → 77 lines) by extracting
  _validate_run_inputs / _render_workers / _print_summary helpers.
- Fix ty possibly-missing-attribute warning by typing workers list explicitly.
- Add PEP 723 inline metadata + plugins/c-review/scripts/pyproject.toml.
- Rewrite SKILL.md description as scenario-based; add When to Use /
  When NOT to Use section headers.
- Add Usage section to README.
- Resolve Tier 2 contradiction in dedup-judge: unparseable/multi findings
  now skip Tier 2 and go straight to Tier 3.
- Standardize placeholder convention in fp-judge ({var} not <var>).
- Fix "Widthness Overflows" → "Width Truncation" in integer-overflow-finder.
- Standardize "Bug Patterns to Find" heading in signal-handler and
  thread-safety finders.
- Replace ls -1 glob in worker shard-write with find for shell portability.
- Bump version 1.1.0 → 1.1.1 in plugin.json + marketplace.json.

Verification: codex validator passes (73 plugin skills); ruff + ty clean;
main() 77 lines (limit 100); SARIF generator runtime tests pass; end-to-end
build_run_plan.py produces all 11 clusters with cache primer.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Address claude[bot] review feedback on c-review

- Phase 1 is_posix/is_windows probes in SKILL.md now include C++ extensions
  (.cpp, .cxx, .cc, .hpp, .hh) in their --include lists. A pure C++ POSIX
  daemon was silently dropping ~17 POSIX-gated passes plus all is_windows
  clusters because pthread.h / windows.h includes only in .cpp/.hpp files
  failed both --include='*.c' --include='*.h' filters.
- generate_sarif.py informationUri points at trailofbits/skills (the actual
  repo) instead of trailofbits/tob-skills (404).
- CODEOWNERS: add @dguido co-owner to /plugins/c-review/ and move it to the
  top of the c* alphabetical group (- < l < o < u under ASCII collation).
- README.md: move c-review row after burpsuite-project-parser (b < c).
- Bump version 1.1.1 → 1.1.2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-03 15:59:55 -04:00

1.4 KiB

Raw Blame History

name, description

name	description
named-pipe-finder	Identifies named pipe security issues

Finding ID Prefix: NAMEDPIPE (e.g., NAMEDPIPE-001, NAMEDPIPE-002)

Bug Patterns to Find:

Missing Security Descriptor
- lpSecurityAttributes is NULL
- Default DACL allows Everyone access
- No explicit ACL on pipe
Remote Access Enabled
- Missing PIPE_REJECT_REMOTE_CLIENTS flag
- Pipe accessible over network
Single Instance DoS
- nMaxInstances is 1
- Malicious process can claim pipe first
- Legitimate client blocked
Impersonation Without Verification
- ImpersonateNamedPipeClient without checking client identity
- Privilege escalation via token impersonation
Data Validation
- Untrusted data from pipe not validated
- Deserialization of pipe data
- Command injection via pipe input

Common False Positives to Avoid:

Explicit restrictive DACL: Security descriptor properly configured
PIPE_REJECT_REMOTE_CLIENTS set: Remote access blocked
High nMaxInstances: Multiple instances prevent DoS
Server-side only: Pipe used only for server-to-client communication

Search Patterns:

CreateNamedPipe[AW]?\s*\(|CallNamedPipe[AW]?\s*\(
\\\\\\\\.\\\\pipe\\\\|\\\\\\?\\\\pipe\\\\
PIPE_REJECT_REMOTE_CLIENTS|PIPE_ACCESS
ImpersonateNamedPipeClient|RevertToSelf
lpSecurityAttributes|SECURITY_ATTRIBUTES

1.4 KiB Raw Blame History

1.4 KiB

Raw Blame History