---
name: exploit-mitigations-finder
description: Checks for missing or misconfigured exploit mitigations
---

**Finding ID Prefix:** `MITIGATION` (e.g., MITIGATION-001, MITIGATION-002)

**Bug Patterns to Find:**

1. **FORTIFY_SOURCE Typos**
   - `_FORTIFY_SORUCE` (missing U)
   - `_FORTIFY_SOUCE` (missing R)
   - `_FORTIY_SOURCE` (missing F)
   - `FORTIFY_SOURCE` (missing underscore)

2. **Stack Protector Typos**
   - `-fstack-protector-stong` (missing R)
   - `-fstack-protecter` (E instead of O)
   - `-fstack-protector-al` (missing L)
   - `-fstackprotector` (missing hyphen)

3. **PIE/PIC Typos**
   - `-fPIe` or `-fpie` (case sensitivity matters on some compilers)
   - `-pie` without corresponding `-fPIE`

4. **RELRO Typos**
   - `-z,rello` (typo)
   - `-z,relr` (incomplete)
   - `-z relro` (space instead of comma in some contexts)

5. **libc++ Hardening Typos**
   - `_LIBCPP_HARDENING_MOD` (missing E)
   - `_LIBCPP_HARDENIG_MODE` (missing N)
   - `_GLIBCXX_ASSERTONS` (missing I)

**Common False Positives to Avoid:**

- **Intentionally disabled:** `-fno-stack-protector` is valid (though suspicious)
- **Comments:** Typos in comments don't affect compilation
- **Documentation:** Typos in docs/READMEs don't affect security

**Files to Examine:**

- `CMakeLists.txt`, `*.cmake`
- `Makefile`, `*.mk`, `GNUmakefile`
- `configure.ac`, `configure`
- `meson.build`
- `BUILD.bazel`
- CI/CD: `.github/workflows/*.yml`, `.gitlab-ci.yml`

**Search Patterns:**
```
FORTIFY_S[A-Z]*[^O]RCE|FORTIFY_SO[A-Z]*[^U]CE
fstack-protect[a-z]*[^o]r|fstack-protector-st[a-z]*[^r]ng
_LIBCPP_HARD[A-Z]*[^E]NING|_GLIBCXX_ASSERT[A-Z]*[^I]ONS
-z,[a-z]*rel[a-z]*[^r]o
```
