@blamejs/exceptd-skills 0.14.0 → 0.14.1

package/sources/validators/cve-validator.js

@@ -112,6 +112,27 @@ function extractNvdCvss(nvdJson) {
   };
 }
 
+// NVD carries the authoritative assignment lifecycle in `vulnStatus`
+// ("Rejected", "Disputed", "Analyzed", "Awaiting Analysis", "Modified", …)
+// and dispute/quality flags in `cveTags[].tags` (e.g. "disputed",
+// "unsupported-when-assigned"). Both live on the same vuln object the CVSS
+// extractor already reads — surfacing them is what lets exceptd answer
+// "is this CVE rejected/disputed?" instead of leaving an agent to look it up.
+function extractNvdStatus(nvdJson) {
+  const vuln = nvdJson?.vulnerabilities?.[0]?.cve;
+  if (!vuln) return { vulnStatus: null, tags: [] };
+  const tags = [];
+  for (const ct of (Array.isArray(vuln.cveTags) ? vuln.cveTags : [])) {
+    for (const t of (Array.isArray(ct?.tags) ? ct.tags : [])) {
+      if (typeof t === 'string') tags.push(t);
+    }
+  }
+  return {
+    vulnStatus: typeof vuln.vulnStatus === 'string' ? vuln.vulnStatus : null,
+    tags,
+  };
+}
+
 function pushDiscrepancy(list, field, local, fetched, severity = 'warning') {
   list.push({ field, local, fetched, severity });
 }
@@ -153,6 +174,9 @@ async function validateCve(cveId, localEntry) {
     in_kev: null,
     kev_date: null,
     epss: null,
+    nvd_vuln_status: null,   // NVD's authoritative status string, e.g. "Rejected"
+    cve_tags: [],            // NVD cveTags, e.g. ["disputed"]
+    description: null,       // NVD English description — the product/scope claim a citation must match
     sources: { nvd: null, kev: null, epss: null },
   };
   const discrepancies = [];
@@ -175,6 +199,12 @@ async function validateCve(cveId, localEntry) {
       fetched.sources.nvd = { reachable: true, found: false };
     } else {
       cveFoundInNvd = true;
+      const st = extractNvdStatus(nvdResult.json);
+      fetched.nvd_vuln_status = st.vulnStatus;
+      fetched.cve_tags = st.tags;
+      const vuln = nvdResult.json?.vulnerabilities?.[0]?.cve;
+      const enDesc = (Array.isArray(vuln?.descriptions) ? vuln.descriptions : []).find(d => d?.lang === "en");
+      fetched.description = (enDesc && typeof enDesc.value === "string") ? enDesc.value : null;
       const cvss = extractNvdCvss(nvdResult.json);
       if (cvss) {
         fetched.cvss_score = cvss.score;
@@ -224,6 +254,21 @@ async function validateCve(cveId, localEntry) {
     return { cve_id: cveId, status: 'missing', discrepancies, fetched, local, drift };
   }
 
+  // --- Rejected / disputed short-circuit ---
+  // A MITRE/NVD-REJECTED record still returns totalResults:1, so without this
+  // a rejected CVE would fall through and be CVSS-drift-checked as if valid.
+  // Surface it as its own status — this is the signal that catches a cited
+  // CVE that was withdrawn after assignment (the class an agent otherwise has
+  // to confirm by hand against NVD).
+  if (cveFoundInNvd && /^rejected$/i.test(fetched.nvd_vuln_status || '')) {
+    return { cve_id: cveId, status: 'rejected', discrepancies, fetched, local, drift };
+  }
+  const disputed = (fetched.cve_tags || []).some(t => /disputed/i.test(t)) ||
+    /disputed/i.test(fetched.nvd_vuln_status || '');
+  if (cveFoundInNvd && disputed) {
+    pushDiscrepancy(discrepancies, 'cve_status', local?.status ?? null, 'disputed', 'high');
+  }
+
   // --- Compare CVSS (only if NVD reachable & has data) ---
   if (cveFoundInNvd && fetched.cvss_score !== null && local.cvss_score !== null) {
     if (Math.abs(fetched.cvss_score - local.cvss_score) > 0.05) {
@@ -274,4 +319,4 @@ async function validateCve(cveId, localEntry) {
   return { cve_id: cveId, status, discrepancies, fetched, local, drift };
 }
 
-module.exports = { validateCve, getKevCache, resetKevCache };
+module.exports = { validateCve, getKevCache, resetKevCache, extractNvdStatus };