pwn 0.5.716 → 0.5.718

data/lib/pwn/plugins/findings.rb

@@ -30,6 +30,10 @@ module PWN
           evidence: opts[:evidence].to_s,
           poc: opts[:poc].to_s,
           poc_artifacts: arts,
+          cvss: opts[:cvss].to_s,
+          status: (opts[:status] || 'open').to_s,
+          engagement_id: opts[:engagement_id].to_s,
+          chain_parent_id: opts[:chain_parent_id].to_s,
           session_id: opts[:session_id].to_s,
           at: Time.now.utc.iso8601
         }
@@ -51,6 +55,21 @@ module PWN
         rows
       end
 
+      public_class_method def self.query(opts = {})
+        report(opts)
+      end
+
+      public_class_method def self.chain(opts = {})
+        parent_id = opts[:parent_id].to_s
+        raise 'ERROR: parent_id is required' if parent_id.empty?
+
+        child = record(opts.merge(chain_parent_id: parent_id))
+        ranks = { 'info' => 0, 'low' => 1, 'medium' => 2, 'high' => 3, 'critical' => 4 }
+        parent = report.find { |r| r[:id].to_s == parent_id }
+        sev = [parent&.[](:severity), child[:severity]].compact.max_by { |s| ranks[s.to_s] || 0 }
+        child.merge(composite_severity: sev)
+      end
+
       public_class_method def self.render(opts = {})
         dir = opts[:dir_path].to_s
         dir = File.join(Dir.home, '.pwn', 'exports') if dir.empty?
@@ -60,7 +79,8 @@ module PWN
         {
           markdown: PWN::Reports::Markdown.generate(results_hash: payload, dir_path: dir, report_name: name),
           html: PWN::Reports::HTML.generate(results_hash: payload, dir_path: dir, report_name: name),
-          json: PWN::Reports::JSON.generate(results_hash: payload, dir_path: dir, report_name: name)
+          json: PWN::Reports::JSON.generate(results_hash: payload, dir_path: dir, report_name: name),
+          sarif: PWN::Reports::SARIF.generate(results_hash: payload, dir_path: dir, report_name: name)
         }
       end
 
@@ -81,6 +101,25 @@ module PWN
             evidence: 'optional - proof text or path',
             poc: 'optional - filesystem path of a PoC',
             poc_artifacts: 'required - Array of artifact paths proving the issue',
+            cvss: 'optional - CVSS vector or score string',
+            status: 'optional - open|closed (defaults to open)',
+            engagement_id: 'optional - engagement identifier',
+            session_id: 'optional - pwn-ai session id',
+            chain_parent_id: 'optional - id of a parent finding this issue chains from'
+          )
+
+          # Alias of report for querying stored findings.
+          #{self}.query(
+            host: 'optional - affected host or URL'
+          )
+
+          # Record a child finding chained to a parent and return composite severity.
+          #{self}.chain(
+            parent_id: 'required - id of the parent finding',
+            title: 'required - short finding title',
+            severity: 'optional - info|low|medium|high|critical (defaults to info)',
+            poc_artifacts: 'required - Array of artifact paths proving the issue',
+            host: 'optional - affected host or URL',
             session_id: 'optional - pwn-ai session id'
           )
 
@@ -89,7 +128,7 @@ module PWN
             host: 'optional - only rows whose host matches this string'
           )
 
-          # Render findings as markdown, html, and json reports.
+          # Render findings as markdown, html, json, and SARIF reports.
           #{self}.render(
             dir_path: 'optional - output directory (defaults to ~/.pwn/exports)',
             report_name: 'optional - basename without extension (defaults to findings)'

data/lib/pwn/plugins/jobs.rb

@@ -4,6 +4,7 @@ require 'json'
 require 'fileutils'
 require 'securerandom'
 require 'open3'
+require 'time'
 
 module PWN
   module Plugins
@@ -31,6 +32,7 @@ module PWN
           command: cmd.to_s,
           log: log,
           session_id: opts[:session_id],
+          max_runtime: opts[:max_runtime].to_i,
           started_at: Time.now.utc.iso8601
         }
         File.write(meta, JSON.generate(row))
@@ -46,7 +48,20 @@ module PWN
         rescue Errno::ESRCH, Errno::EPERM
           false
         end
-        row.merge(alive: alive)
+        max = row[:max_runtime].to_i
+        if alive && max.positive?
+          started = begin
+            Time.parse(row[:started_at].to_s)
+          rescue StandardError
+            Time.now
+          end
+          if Time.now - started > max
+            Process.kill('TERM', row[:pid].to_i)
+            alive = false
+            row[:status] = 'TIMEOUT'
+          end
+        end
+        row.merge(alive: alive, status: row[:status] || (alive ? 'RUNNING' : 'COMPLETED'))
       end
 
       public_class_method def self.tail(opts = {})
@@ -62,6 +77,20 @@ module PWN
         row.merge(tail: tail(opts.merge(lines: opts[:lines] || 80)))
       end
 
+      public_class_method def self.harvest(opts = {})
+        result(opts)
+      end
+
+      public_class_method def self.list(opts = {})
+        _limit = opts[:limit]
+        Dir[File.join(JOBS_DIR, '*.json')].filter_map do |path|
+          row = JSON.parse(File.read(path), symbolize_names: true)
+          status(id: row[:id])
+        rescue StandardError
+          nil
+        end
+      end
+
       public_class_method def self.stop(opts = {})
         row = load_job(opts)
         Process.kill('TERM', row[:pid].to_i)
@@ -83,7 +112,8 @@ module PWN
           #{self}.start(
             command: 'required - command value consumed by #start (defaults to opts[:cmd])',
             cmd: 'required - command string to run',
-            session_id: 'optional - session id value consumed by #start'
+            session_id: 'optional - session id value consumed by #start',
+            max_runtime: 'optional - seconds after which a live job is killed (TIMEOUT)'
           )
 
           # Run status and return its result
@@ -100,6 +130,17 @@ module PWN
             lines: 'optional - tail line count (defaults to 80)'
           )
 
+          # Alias of result for harvesting a detached job from a later session.
+          #{self}.harvest(
+            id: 'required - job id from #start',
+            lines: 'optional - tail line count (defaults to 80)'
+          )
+
+          # List job metadata rows under ~/.pwn/jobs.
+          #{self}.list(
+            limit: 'optional - unused cap reserved for callers'
+          )
+
           # Run stop and return its result
           #{self}.stop
 

data/lib/pwn/plugins/preflight_checker.rb

@@ -30,6 +30,14 @@ module PWN
         'PWN::Plugins::CredentialAttack' => { bins: %w[hydra john hashcat] }
       }.freeze
 
+      FALLBACKS = {
+        'PWN::Plugins::Metasploit' => %w[exploitdev pwn_eval],
+        'PWN::Plugins::BurpSuite' => %w[TransparentBrowser nuclei],
+        'PWN::Plugins::Zaproxy' => %w[nuclei TransparentBrowser],
+        'PWN::Plugins::K8s' => %w[pwn_eval],
+        'PWN::Plugins::ExploitDB' => %w[intel_lookup]
+      }.freeze
+
       public_class_method def self.required_bins
         []
       end
@@ -137,7 +145,9 @@ module PWN
         lines = ["HOST plugins ok=#{rows.count { |r| r[:status] == :ok }} degraded=#{degraded.length} dead=#{dead.length}"]
         (degraded + dead).first(cap).each do |r|
           miss = (Array(r[:missing_bins]) + Array(r[:missing_caps]) + Array(r[:missing_services])).join(',')
-          lines << "  #{r[:status]} #{r[:plugin]} missing=#{miss}"
+          fb = Array(FALLBACKS[r[:plugin]]).join(',')
+          extra = fb.empty? ? '' : " fallback=#{fb}"
+          lines << "  #{r[:status]} #{r[:plugin]} missing=#{miss}#{extra}"
         end
         lines.join("\n")
       end

data/lib/pwn/plugins/process_tube.rb

@@ -79,6 +79,32 @@ module PWN
         false
       end
 
+      public_class_method def self.expect(opts = {})
+        text = recvuntil(opts)
+        t = tube!(opts)
+        { matched: text, offset: t[:buf].to_s.bytesize, id: opts[:id].to_s }
+      end
+
+      public_class_method def self.stream(opts = {})
+        t = tube!(opts)
+        off = opts[:offset].to_i
+        begin
+          t[:buf] << t[:r].read_nonblock(4_096)
+        rescue IO::WaitReadable, EOFError
+          nil
+        end
+        data = t[:buf].to_s.byteslice(off..-1).to_s
+        { data: data, offset: t[:buf].to_s.bytesize, id: opts[:id].to_s }
+      end
+
+      public_class_method def self.reap_orphans(opts = {})
+        _sid = opts[:session_id]
+        n = @tubes.length
+        @tubes.each_key { |id| close(id: id) }
+        @tubes.clear
+        n
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -121,6 +147,24 @@ module PWN
             id: 'optional - id value consumed by #close'
           )
 
+          # Expect a pattern and return matched buffer plus byte offset.
+          #{self}.expect(
+            id: 'required - tube id from spawn or connect',
+            until: 'required - substring to wait for',
+            timeout: 'optional - seconds to wait before giving up'
+          )
+
+          # Tail the PTY buffer since a prior offset.
+          #{self}.stream(
+            id: 'required - tube id from spawn or connect',
+            offset: 'optional - byte offset to start from (defaults to 0)'
+          )
+
+          # Close every open tube (session end / orphan GC).
+          #{self}.reap_orphans(
+            session_id: 'optional - agent session id for transcript grouping'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/radare2.rb

@@ -3,6 +3,7 @@
 require 'json'
 require 'open3'
 require 'securerandom'
+require 'digest'
 
 module PWN
   module Plugins
@@ -24,10 +25,17 @@ module PWN
         raise 'ERROR: path is required' if path.empty?
         raise "ERROR: binary not found: #{path}" unless File.file?(path)
 
+        sha = Digest::SHA256.file(path).hexdigest
+        hit = @sessions.find { |_id, sess| sess[:path] == path && sess[:sha256] == sha }
+        return hit[0] if hit
+
         stdin, stdout, waiter = Open3.popen2('r2', '-q0', '-e', 'scr.color=0', path)
         sid = SecureRandom.hex(8)
-        @sessions[sid] = { stdin: stdin, stdout: stdout, waiter: waiter, path: path }
+        pid = waiter.pid if waiter.respond_to?(:pid)
+        @sessions[sid] = { stdin: stdin, stdout: stdout, waiter: waiter, path: path, sha256: sha, pid: pid }
         read_until_null(io: stdout)
+        cmd(session: sid, cmd: 'aaa')
+        @sessions[sid][:aaa] = true
         sid
       end
 

data/lib/pwn/reports/sarif.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module PWN
+  module Reports
+    # SARIF 2.1.0 writer for finding export.
+    module SARIF
+      public_class_method def self.generate(opts = {})
+        payload = PWN::Reports.report_payload(opts)
+        doc = {
+          version: '2.1.0',
+          '$schema' => 'https://json.schemastore.org/sarif-2.1.0.json',
+          runs: [
+            {
+              tool: { driver: { name: 'pwn', version: (defined?(PWN::VERSION) ? PWN::VERSION : '0') } },
+              results: Array(payload[:findings]).map { |row| result_row(row: row) }
+            }
+          ]
+        }
+        path = PWN::Reports.resolve_path(opts.merge(ext: 'sarif.json'))
+        File.write(path, ::JSON.pretty_generate(doc))
+        path
+      end
+
+      private_class_method def self.result_row(opts = {})
+        row = opts[:row]
+        row = {} unless row.is_a?(Hash)
+        sev = (row['severity'] || row[:severity] || 'note').to_s
+        level = { 'critical' => 'error', 'high' => 'error', 'medium' => 'warning', 'low' => 'note', 'info' => 'note' }[sev] || 'note'
+        {
+          ruleId: (row['id'] || row[:id] || 'finding').to_s,
+          level: level,
+          message: { text: (row['title'] || row[:title]).to_s },
+          properties: row
+        }
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # Write a SARIF 2.1 document from a findings hash.
+          #{self}.generate(
+            results_hash: 'required - Hash with :findings Array',
+            dir_path: 'optional - output directory',
+            report_name: 'optional - basename without extension',
+            path: 'optional - exact output path'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/reports.rb

@@ -18,6 +18,7 @@ module PWN
     autoload :PDF, 'pwn/reports/pdf'
     autoload :Phone, 'pwn/reports/phone'
     autoload :SAST, 'pwn/reports/sast'
+    autoload :SARIF, 'pwn/reports/sarif'
     autoload :URIBuster, 'pwn/reports/uri_buster'
     autoload :XML, 'pwn/reports/xml'
 

data/lib/pwn/sessions.rb

@@ -162,6 +162,7 @@ module PWN
       include_current = opts[:include_current] == true
 
       hits = []
+      target = opts[:target].to_s.downcase
       list.sort_by { |s| s[:mtime].to_s }.reverse.first(max_files).each do |sess|
         sid = sess[:id].to_s
         next if !include_current && !exclude.empty? && sid == exclude
@@ -172,9 +173,12 @@ module PWN
 
           body = row[:content].to_s
           next if body.strip.empty?
+          next if !target.empty? && !body.downcase.include?(target)
 
           score = recall_score(body: body.downcase, query: query, tokens: tokens)
-          next if score <= 0
+          next if score <= 0 && target.empty?
+
+          score = [score, 1].max unless target.empty?
 
           hits << {
             session_id: sid,
@@ -561,7 +565,18 @@ module PWN
       dest = File.join(dir, "#{sid}.tar.gz")
       manifest = { File.basename(src) => Digest::SHA256.file(src).hexdigest }
       Dir.mktmpdir do |tmp|
-        FileUtils.cp(src, File.join(tmp, File.basename(src)))
+        body = File.read(src)
+        body = redact(content: body)
+        File.write(File.join(tmp, File.basename(src)), body)
+        eng = opts[:engagement_id].to_s
+        unless eng.empty? && opts[:engagement] != true
+          rendered = PWN::Plugins::Findings.render(dir_path: tmp, report_name: 'findings') if defined?(PWN::Plugins::Findings)
+          Array(rendered&.values).each do |p|
+            next unless p.to_s != '' && File.file?(p.to_s)
+
+            manifest[File.basename(p)] = Digest::SHA256.file(p).hexdigest
+          end
+        end
         File.write(File.join(tmp, 'manifest.json'), JSON.generate(manifest))
         system('tar', '-czf', dest, '-C', tmp, '.')
       end
@@ -653,7 +668,8 @@ module PWN
           include_current: 'optional - Boolean include excluded id (default false)',
           limit: 'optional - max hits (default 12)',
           max_files: 'optional - newest files to scan (default 40)',
-          truncate: 'optional - chars per hit (default 280)'
+          truncate: 'optional - chars per hit (default 280)',
+          target: 'optional - IP, host, or token that must appear in the hit'
         )
 
         # Run to response history and return its result
@@ -704,7 +720,9 @@ module PWN
 
         # Pack a session jsonl plus artifacts into ~/.pwn/exports/<id>.tar.gz.
         #{self}.export(
-          session_id: 'required - session id to export'
+          session_id: 'required - session id to export',
+          engagement_id: 'optional - include findings SARIF/md/json in the tarball',
+          engagement: 'optional - Boolean include findings even without an id'
         )
 
         # Delete session jsonl files older than days (defaults to 90).

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.716'
+  VERSION = '0.5.718'
 end

data/spec/lib/pwn/ai/agent/fixtures/error_class_docker.json

@@ -1,6 +1,6 @@
 {
   "cases": [
-    {"error": "pull access denied for library/foo", "class": "auth_denied"},
+    {"error": "pull access denied for library/foo", "class": "docker_registry_auth"},
     {"error": "Conflict. The container name is already in use", "class": "name_conflict"},
     {"error": "template parsing error: unexpected token", "class": "parse_error"}
   ]

data/spec/lib/pwn/ai/agent/mistakes_spec.rb

@@ -197,8 +197,9 @@ describe PWN::AI::Agent::Mistakes do
   end
 
   it 'classifies pull-denied and name-conflict as distinct error classes' do
-    expect(described_class.error_class(error: 'pull access denied')).to eq('auth_denied')
+    expect(described_class.error_class(error: 'pull access denied')).to eq('docker_registry_auth')
     expect(described_class.error_class(error: 'name already in use')).to eq('name_conflict')
+    expect(described_class.error_class(error: 'Cannot connect to the Docker daemon')).to eq('docker_daemon')
   end
 
   it 'does not collapse docker socket perms into missing_path' do

data/spec/lib/pwn/ai/agent/reward_spec.rb

@@ -411,7 +411,7 @@ describe 'PWN::AI::Agent::Reward vs TUI plan' do
 
   it 'floors verified PASS analytical answers at 0.6' do
     src = File.read(PWN::AI::Agent::Reward.method(:judge).source_location.first)
-    expect(src).to include('[score, 0.6].max')
+    expect(src).to include('[score, 0.7].max')
     expect(src).to include('\bPASS\b')
   end
 

data/spec/lib/pwn/ai/agent/tool_guard_spec.rb

@@ -184,7 +184,8 @@ describe PWN::AI::Agent::ToolGuard do
       allow(Dir).to receive(:home).and_return(dir)
       expect(described_class.scope_refusal(command: 'scan 10.0.0.5')).to be_nil
       expect(described_class.scope_refusal(command: 'scan 192.168.1.2')).to be_nil
-      expect(described_class.scope_refusal(command: 'scan 8.8.8.8')).to include('8.8.8.8')
+      expect(described_class.scope_refusal(command: 'scan 8.8.8.8')[:token]).to eq('8.8.8.8')
+      expect(described_class.scope_refusal(command: 'scan 8.8.8.8')[:code]).to eq('SCOPE_DENY')
     end
   end
 

data/spec/lib/pwn/ai/agent/tools/pty_session_spec.rb

@@ -13,5 +13,6 @@ describe 'PWN::AI::Agent::Tools pty_session' do
     expect(PWN::AI::Agent::Registry.lookup(name: 'pty_send')).not_to be_nil
     expect(PWN::AI::Agent::Registry.lookup(name: 'pty_read')).not_to be_nil
     expect(PWN::AI::Agent::Registry.lookup(name: 'pty_close')).not_to be_nil
+    expect(PWN::AI::Agent::Registry.lookup(name: 'pty_session')).not_to be_nil
   end
 end

data/spec/lib/pwn/ai/agent/tools/verify_spec.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+describe 'PWN::AI::Agent::Tools verify' do
+  before(:all) do
+    PWN::AI::Agent::Registry.discover(force: true)
+    load '/opt/pwn/lib/pwn/ai/agent/tools/verify.rb'
+  end
+
+  it 'registers expected tool names' do
+    expect(PWN::AI::Agent::Registry.lookup(name: 'verify')).not_to be_nil
+  end
+
+  it 'passes file_exists when the path is on disk' do
+    Dir.mktmpdir do |dir|
+      path = File.join(dir, 'x')
+      File.write(path, 'ok')
+      out = PWN::AI::Agent::Registry.lookup(name: 'verify').handler.call(checks: [{ type: 'file_exists', path: path }])
+      expect(out[:passed]).to be true
+    end
+  end
+end

data/spec/lib/pwn/plugins/binary_parser_spec.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'tmpdir'
 
 describe PWN::Plugins::BinaryParser do
   it 'should display information for authors' do
@@ -18,4 +19,17 @@ describe PWN::Plugins::BinaryParser do
     expect(info[:class].to_s).to match(/ELF|elf/i)
     expect(described_class.sections(path: path)).to be_an(Array)
   end
+
+  it 'triage returns structured JSON fields and caches by sha256' do
+    path = %w[/bin/ls /usr/bin/ls /bin/true /usr/bin/true].find { |p| File.file?(p) }
+    skip 'no ELF on PATH' unless path
+    Dir.mktmpdir do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      first = described_class.triage(path: path)
+      expect(first).to include(:format, :arch, :protections, :sha256, :sections)
+      expect(first[:cached]).to be false
+      second = described_class.triage(path: path)
+      expect(second[:cached]).to be true
+    end
+  end
 end

data/spec/lib/pwn/plugins/detect_os_spec.rb

@@ -80,7 +80,6 @@ describe PWN::Plugins::DetectOS do
       expect(row[:native]).not_to include('gdb', 'r2', 'nuclei')
       expect(row).not_to have_key(:missing)
       expect(row[:summary]).to include('kali')
-      expect(row[:summary]).to include('jq')
       expect(row[:summary]).not_to include('missing=')
     end
 

data/spec/lib/pwn/plugins/exploit_db_spec.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'tmpdir'
+require 'fileutils'
 
 describe PWN::Plugins::ExploitDB do
   it 'should display information for authors' do
@@ -11,11 +13,49 @@ describe PWN::Plugins::ExploitDB do
     expect(described_class).to respond_to :help
   end
 
-  it 'returns log4shell from the local intel CSV when searchsploit is absent' do
-    allow(PWN::Plugins::PreflightChecker).to receive(:bin?).and_return(false)
-    row = described_class.search(query: 'CVE-2021-44228')
-    blob = row.to_s.downcase
-    expect(blob).to match(/log4|44228/)
+  it 'searches a CSV already synced under ~/.pwn/intel' do
+    Dir.mktmpdir do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      intel = File.join(dir, '.pwn', 'intel')
+      FileUtils.mkdir_p(intel)
+      File.write(File.join(intel, 'files_exploits.csv'), "id,file,description,cve\n1,e.rb,Apache Log4j RCE,CVE-2021-44228\n")
+      allow(PWN::Plugins::PreflightChecker).to receive(:bin?).and_return(false)
+      row = described_class.search(query: 'CVE-2021-44228')
+      expect(row.to_s.downcase).to match(/log4|44228/)
+    end
+  end
+
+  it 'looks up tar from gtfobins.json under ~/.pwn/intel' do
+    Dir.mktmpdir do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      intel = File.join(dir, '.pwn', 'intel')
+      FileUtils.mkdir_p(intel)
+      File.write(File.join(intel, 'gtfobins.json'), '{"tar":{"binary":"tar","functions":["file-read"]}}')
+      row = described_class.gtfobins(binary: 'tar')
+      expect(row[:hit].to_s.downcase).to include('tar')
+    end
+  end
+
+  it 'sync fetches latest ExploitDB CSV and GTFOBins into ~/.pwn/intel' do
+    Dir.mktmpdir do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      csv = "id,file,description,cve\n1,e.rb,Apache Log4j RCE,CVE-2021-44228\n"
+      json = '{"tar":{"binary":"tar","functions":["file-read"]}}'
+      get = lambda do |url|
+        url.to_s.include?('files_exploits') ? csv : json
+      end
+      out = described_class.sync(get: get)
+      intel = File.join(dir, '.pwn', 'intel')
+      expect(out[:dest]).to eq(intel)
+      expect(File.read(File.join(intel, 'files_exploits.csv'))).to include('CVE-2021-44228')
+      expect(File.read(File.join(intel, 'gtfobins.json'))).to include('tar')
+      expect(out[:fetched]).to include('files_exploits.csv', 'gtfobins.json')
+    end
+  end
+
+  it 'does not copy from a tree-bundled etc/intel directory' do
+    src = File.read(described_class.method(:sync).source_location.first)
+    expect(src).not_to include('etc/intel')
   end
 
   it 'responds to search and cve_for_cpe' do

data/spec/lib/pwn/plugins/findings_spec.rb

@@ -24,7 +24,19 @@ describe PWN::Plugins::Findings do
       out = described_class.render(dir_path: dir, report_name: 'findings')
       expect(File.file?(out[:markdown])).to be true
       expect(File.file?(out[:html])).to be true
-      expect(File.file?(out[:json])).to be true
+      expect(File.file?(out[:sarif])).to be true
+    end
+  end
+
+  it 'chains a child finding and reports composite severity' do
+    Dir.mktmpdir do |dir|
+      stub_const('PWN::Plugins::Findings::FILE', File.join(dir, 'findings.jsonl'))
+      poc = File.join(dir, 'poc.rb')
+      File.write(poc, 'puts 1')
+      parent = described_class.record(title: 'xss', poc_artifacts: [poc], severity: 'medium')
+      child = described_class.chain(parent_id: parent[:id], title: 'account-takeover', poc_artifacts: [poc], severity: 'high')
+      expect(child[:chain_parent_id]).to eq(parent[:id])
+      expect(child[:composite_severity]).to eq('high')
     end
   end
 end

data/spec/lib/pwn/reports/sarif_spec.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'json'
+require 'tmpdir'
+
+describe PWN::Reports::SARIF do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'writes a SARIF 2.1 document with finding results' do
+    Dir.mktmpdir do |dir|
+      path = described_class.generate(
+        results_hash: { title: 't', findings: [{ id: 'a1', title: 'xss', severity: 'high' }] },
+        dir_path: dir,
+        report_name: 'eng'
+      )
+      doc = JSON.parse(File.read(path))
+      expect(doc['version']).to eq('2.1.0')
+      expect(doc['runs'].first['results'].first['message']['text']).to eq('xss')
+    end
+  end
+end