feat: address Table C, D, and E feedback items (regex fixes, HMAC commitments, static sinks)

[Tanishq1030]

Description

This Pull Request addresses the remaining items in Table C (Security & Cryptography Claims) and Table E (Minor/Consistency/Small Bugs) from the external feedback report.

---

Proposed Changes

1. Fix SEC-004 Regex Pattern Compilation Error (Table E – Item E1)

Issue

The regex pattern for SEC-004 (Bulk Environment Variable Access) contained the inline (?i) case-insensitive flag in the middle of the expression.

Beginning with Python 3.11, this causes a runtime exception:

re.error: global flags not at the start of the expression

As a result, the detector silently failed to execute.

Fix

• Moved the (?i) flag to the beginning of the regex pattern in:

  anchor/governance/mitigation.anchor
  

• Updated the normalized SHA-256 integrity hash:

  MITIGATION_SHA256
  

  located in:

  anchor/core/constitution.py
  

  so the integrity verification remains consistent with the modified mitigation catalog.

---

2. Implement Keyed/Salted findings_hash Commitment (Table C – Item C2)

Issue

The ledger previously computed findings_hash as:

sha256(json.dumps(rule_ids))

Because the rule vocabulary is relatively small (approximately 47 rules), an attacker could feasibly enumerate all possible rule combinations offline and infer which governance rules were triggered.

Fix

Replaced the unhashed commitment with a keyed HMAC-SHA256 commitment salted using the unique entry_id (UUID4).

findings_hash = hmac.new(
    secret_key.encode("utf-8"),
    (json.dumps(rule_ids) + entry_id).encode("utf-8"),
    hashlib.sha256
).hexdigest()

Security Benefits

• Prevents offline dictionary attacks.
• Ensures identical violations produce unique commitments.
• Protects the privacy of triggered governance findings.
• Maintains deterministic verification for authorized auditors possessing the secret key.

---

3. Add Static Detectors for eval, pickle.loads, and Hardcoded Credentials (Table E – Item E2)

Issue

Several intentionally planted insecure constructs were not detected during static analysis, including:

• eval()
• exec()
• pickle.loads()
• pickle.load()
• marshal.loads()
• Hardcoded credentials

Fix

Extended the mitigation catalog:

anchor/governance/mitigation.anchor

with two additional static detection rules.

MIT-004-B (SEC-004)

Detects hardcoded credentials such as:

api_key = "..."
token = "..."
password = "..."
secret = "..."

MIT-010-A (SEC-010)

Detects dynamic execution sinks including:

• eval(
• exec(
• pickle.loads(
• pickle.load(
• marshal.loads(

---

Verification Plan

Automated Tests

Added:

tests/unit/test_feedback_fixes.py

The new test suite validates:

• Successful compilation and execution of the corrected SEC-004 regex.
• Distinct findings_hash outputs for identical rule violations, confirming the keyed and salted HMAC implementation.
• Successful static detection of:
  • eval()
  • pickle.loads()
  • Hardcoded credentials

---

Test Results

Executed the full test suite:

======================= 68 passed, 5 warnings in 24.56s =======================

All tests completed successfully with no regressions observed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.