@blamejs/exceptd-skills 0.21.9 → 0.21.10

package/lib/cve-batch.js

@@ -195,6 +195,15 @@ async function curateBatch({ factsPath, judgmentsPath, apply, catalogRoot, today
     if (f.definite) errors.push(`${where(f)} ${f.reason}.`);
     else warnings.push(`${where(f)} ${f.reason}; check that the date belongs to this CVE.`);
   }
+  // CISA's KEV required action never names a restart. The template forms of
+  // that claim ("requires a service restart or system reboot per the KEV
+  // requiredAction") stop the batch; any other phrasing the detector matches is
+  // a warning, since prose can mention the two together without the claim.
+  for (const f of gaps.kevActionRestartFindings({ 'cve-catalog': entries, 'zeroday-lessons': lessons }, { includeDrafts: true })) {
+    const msg = `${where(f)} ${f.reason}; state the restart without that attribution, or drop it when the entry's patch_required_reboot does not support it.`;
+    if (f.definite) errors.push(msg);
+    else warnings.push(msg);
+  }
 
   // Reported as a validation error so the DRY RUN surfaces it; insertEntries
   // throws on the same condition, but only under --apply.

package/lib/gap-detectors.js

@@ -352,6 +352,157 @@ function kevListingDateFindings(loaded, opts = {}) {
   return out;
 }
 
+// A restart or reboot credited to CISA's KEV required action. The required
+// action says to apply mitigations per vendor instructions, follow BOD 22-01
+// guidance or discontinue use; it never names a restart. Each pattern is a
+// construction that attaches the attribution to the restart itself, so an
+// accurate "apply mitigations per the KEV requiredAction" does not match. The
+// restart and the attribution must sit in one clause: no comma, "then", "and",
+// "before", "after" or "once" between them. A negation ("not", "no", "never",
+// "nor", "without", "cannot", or a contraction such as "isn't") between them
+// also stops the match.
+const KEV_ACTION_RESTART_CREDIT = [
+  /\bfollows (?:the KEV requiredAction|the KEV required action|the required action in CISA(?:'s|’s) KEV entry|the required action in the KEV entry|CISA(?:'s|’s) KEV required action|CISA(?:'s|’s) KEV requiredAction|the KEV entry(?:'s|’s) required action) \(service restart or system reboot\)/i,
+  /\b(?:restart|reboot)(?:(?!\b(?:then|and|before|after|once|not|no|never|nor|without|cannot)\b|\w*n['’]t\b)[^.;,()]){0,60}?\brequir(?:es|ed|ing) per (?:the KEV requiredAction|the KEV required action|the required action in CISA(?:'s|’s) KEV entry|the required action in the KEV entry|CISA(?:'s|’s) KEV required action|CISA(?:'s|’s) KEV requiredAction|the KEV entry(?:'s|’s) required action)/i,
+  /(?:restart|reboot)(?:ing)?\b(?:(?!\b(?:then|and|before|after|once|not|no|never|nor|without|cannot)\b|\w*n['’]t\b)[^.;,()]){0,25}?,? per (?:the KEV requiredAction|the KEV required action|the required action in CISA(?:'s|’s) KEV entry|the required action in the KEV entry|CISA(?:'s|’s) KEV required action|CISA(?:'s|’s) KEV requiredAction|the KEV entry(?:'s|’s) required action)/i,
+  /\b(?:fix|patch|update)(?: that)? per (?:the KEV requiredAction|the KEV required action|the required action in CISA(?:'s|’s) KEV entry|the required action in the KEV entry|CISA(?:'s|’s) KEV required action|CISA(?:'s|’s) KEV requiredAction|the KEV entry(?:'s|’s) required action),? (?:typically |also )?requir(?:es|ing) (?:a )?(?:service )?(?:restart|reboot)/i,
+  /\bthe (?:service )?(?:restart|reboot)(?: or (?:system )?(?:restart|reboot))? (?:that )?(?:the KEV requiredAction|the KEV required action|the required action in CISA(?:'s|’s) KEV entry|the required action in the KEV entry|CISA(?:'s|’s) KEV required action|CISA(?:'s|’s) KEV requiredAction|the KEV entry(?:'s|’s) required action) (?:calls for|implies|requires|mandates|specifies|names)\b/i,
+  /\b(?:the KEV requiredAction|the KEV required action|the required action in CISA(?:'s|’s) KEV entry|the required action in the KEV entry|CISA(?:'s|’s) KEV required action|CISA(?:'s|’s) KEV requiredAction|the KEV entry(?:'s|’s) required action) (?:requires|required|calls for|mandates|specifies|names) (?:a |an )?(?:(?:service|system|host|device|appliance|server) )?(?:restart|reboot)/i,
+  /^[\s"'(]*per (?:the KEV requiredAction|the KEV required action|the required action in CISA(?:'s|’s) KEV entry|the required action in the KEV entry|CISA(?:'s|’s) KEV required action|CISA(?:'s|’s) KEV requiredAction|the KEV entry(?:'s|’s) required action),? (?:(?:an?|the)\s+)?(?:(?:service|system|host|device|appliance|server)\s+)?(?:restart|reboot)\b(?!(?:(?!\b(?:if|when|unless|because|although|though|while|since|even)\b)[^,;.]){0,80}?(?:\b(?:not|never|cannot|no longer)\b|n['’]t\b))/i,
+  /\b(?:restart|reboot)(?:(?!\b(?:then|and|before|after|once|not|no|never|nor|without|cannot)\b|\w*n['’]t\b)[^.;,()]){0,40}?\b(?:required|mandated|called for|specified) by (?:the KEV requiredAction|the KEV required action|the required action in CISA(?:'s|’s) KEV entry|the required action in the KEV entry|CISA(?:'s|’s) KEV required action|CISA(?:'s|’s) KEV requiredAction|the KEV entry(?:'s|’s) required action)/i,
+];
+
+// Text ending in a negator plus the noun phrase a match starts in: "No
+// service ", "No service restart or system ", "without a ", "Neither a
+// restart nor a ", "does not require a service restart or system ". Only that
+// phrase is checked, so a negation elsewhere in the sentence ("No reboot is
+// needed because the KEV requiredAction requires a service restart") does not
+// hide a match.
+const NEGATED_RESTART_BEFORE = /\b(?:no|not|never|nor|without|neither)\s+(?:(?:require|need|call\s+for|mandate|involve)\s+)?(?:(?:an?|any)\s+)?(?:(?:service|system|host|device|appliance|server)\s+)?(?:(?:restart|reboot)s?\s+(?:or|nor|and)\s+(?:(?:an?|any)\s+)?(?:(?:service|system|host|device|appliance|server)\s+)?)*$/i;
+
+// The text is split at periods, semicolons and colons, so a labeled line
+// ("Remediation: Per the KEV requiredAction, reboot ...") is read from the
+// label on. Only a part that names a restart or reboot is checked, so "apply
+// mitigations as required per the KEV requiredAction" does not match. A match
+// whose restart noun phrase is negated is skipped, and the search continues
+// past it.
+function creditsRestartToKevAction(str) {
+  if (typeof str !== "string" || str.length === 0) return false;
+  return str.split(/(?<=[.;:])\s+/).some((sentence) => {
+    if (!/\b(?:restart|reboot)/i.test(sentence)) return false;
+    return KEV_ACTION_RESTART_CREDIT.some((re) => {
+      const anchored = re.source.startsWith("^");
+      for (let from = 0; from < sentence.length;) {
+        const m = re.exec(sentence.slice(from));
+        if (!m) return false;
+        const at = from + m.index;
+        if (!NEGATED_RESTART_BEFORE.test(sentence.slice(0, at))) return true;
+        if (anchored) return false;
+        from = at + 1;
+      }
+      return false;
+    });
+  });
+}
+
+// The two forms in which the claim entered the catalogs: "requires a service
+// restart or system reboot per the KEV requiredAction" and "follows the KEV
+// requiredAction (service restart or system reboot)". A finding whose matching
+// sentence takes one of these forms is marked definite.
+const KEV_ACTION_RESTART_TEMPLATE = [
+  /(?<!\bnever\s)\brequires (?:a )?service restart or system reboot,? per (?:the KEV requiredAction|the KEV required action|the required action in CISA(?:'s|’s) KEV entry|the required action in the KEV entry|CISA(?:'s|’s) KEV required action|CISA(?:'s|’s) KEV requiredAction|the KEV entry(?:'s|’s) required action)/i,
+  /\bfollows (?:the KEV requiredAction|the KEV required action|the required action in CISA(?:'s|’s) KEV entry|the required action in the KEV entry|CISA(?:'s|’s) KEV required action|CISA(?:'s|’s) KEV requiredAction|the KEV entry(?:'s|’s) required action) \(service restart or system reboot\)/i,
+];
+
+// A template match is definite only when its own clause, from the last comma,
+// semicolon, colon, parenthesis, dash, "and", "but", "so", "while", "whereas",
+// "because", "since", "although" or "though" before it, holds no negation
+// ("Documentation does not say that the vendor patch requires ..."), and the
+// rest of that clause does not deny the statement ("... is incorrect"), and the
+// clause text in front of it is the claim's subject (TEMPLATE_SUBJECT). Every
+// occurrence in the sentence is checked.
+const TEMPLATE_CLAUSE_BREAK = /[,;:(—–]|\b(?:and|but|so|while|whereas|because|since|although|though)\b/gi;
+const TEMPLATE_NEGATION_BEFORE = /\b(?:not|never|no|nor|neither|nothing|nowhere|none|cannot|without|false|untrue|incorrect|wrong|whether|if)\b|n['’]t\b/i;
+const TEMPLATE_DENIAL_AFTER = /^(?:(?!\b(?:and|but|so|because|since|while|even|when|if|unless|where)\b)[^,;.()—–]){0,40}?\b(?:not|incorrect|wrong|false|untrue|mistaken|unsupported|unverified|disputed|unfounded|inaccurate|erroneous|misleading|a misreading|a myth)\b/i;
+// A denial attached after a comma or dash: "..., which is incorrect", "... —
+// a claim that is unsupported", including after a closing quote.
+const TEMPLATE_DENIAL_APPOSITIVE = /^["'’”]?\s*[,—–]\s*(?:which|this|that|a\s+(?:claim|reading|statement|view|belief|misreading))\b[^.;]{0,40}?\b(?:not|incorrect|wrong|false|untrue|mistaken|unsupported|unverified|disputed|unfounded|inaccurate|erroneous|misleading|a misreading|a myth)\b/i;
+// The clause text in front of a definite match: the claim's subject ("the
+// vendor patch typically", "the fix", "applying the patch", "remediation",
+// "it"), optionally behind a record frame ("live_patch_notes state that",
+// "the entry states", "with the recorded note '"). "The claim that ...",
+// "Documentation does not say that ..." and "Saying ..." are not subjects.
+const TEMPLATE_SUBJECT = /^(?:with\s+)?(?:(?:the|a)\s+)?(?:(?:recorded\s+)?note|live[_-]patch[_ ]notes?|entry)?\s*(?:states?|stating|records?|recording|reads?)?\s*(?:that\s+)?["'‘“]?\s*(?:applying\s+)?(?:(?:(?:the|a|an|its)\s+)?(?:vendor\s+|fixed\s+|security\s+)?(?:patch|fix|update|release|build|firmware|remediation|it)(?:\s+that)?)?\s*(?:(?:typically|also|usually|generally|often)\s*)?$/i;
+
+// A label in front of a colon that holds a directive or a verb of saying ("The
+// control must not state: the vendor patch requires ...", "Do not write:")
+// keeps the clause after it from being definite. A plain label ("Remediation:")
+// or an explanatory one ("there is no live-patch tool:") does not.
+const TEMPLATE_LABEL_DIRECTIVE = /\b(?:must|should|shall|avoid|state|states|stating|say|says|saying|claim|claims|write|writes|assert|asserts|imply|implies|suggest|suggests|describe|describes|false|incorrect|wrong|myth)\b/i;
+// A verb of saying or believing anywhere earlier in the sentence ("Do not
+// claim, without evidence, the vendor patch requires ...") keeps a template
+// match from being definite, whatever commas lie in between. Negation alone
+// ("Live patches do not exist, and the vendor patch requires ..."), the
+// record verbs the catalog frames use ("states", "records") and field values
+// ("live_patch_available is false") do not.
+const TEMPLATE_PREFIX_DIRECTIVE = /\b(?:avoid|say|says|saying|said|claim|claims|claiming|write|writes|written|assert|asserts|assertion|assertions|imply|implies|suggest|suggests|describe|describes|assume|assumes|assumed|believe|believes|allege|alleges|alleged|allegation|allegations)\b/i;
+
+// Sentences end at a period or semicolon only. A line break is read as a space,
+// so wrapped prose keeps its framing ("Documentation does not say that\nthe
+// vendor patch requires ...").
+function isTemplateRestartCredit(str) {
+  if (typeof str !== "string" || str.length === 0) return false;
+  return str.split(/(?<=[.;])\s+/).some((sentence) => {
+    if (!creditsRestartToKevAction(sentence)) return false;
+    return KEV_ACTION_RESTART_TEMPLATE.some((re) => {
+      for (let from = 0; from < sentence.length;) {
+        const m = re.exec(sentence.slice(from));
+        if (!m) return false;
+        const at = from + m.index;
+        let start = 0;
+        let prev = 0;
+        let colon = false;
+        for (const b of sentence.slice(0, at).matchAll(TEMPLATE_CLAUSE_BREAK)) {
+          prev = start;
+          start = b.index + b[0].length;
+          colon = b[0] === ":";
+        }
+        const subject = sentence.slice(start, at).trim();
+        const label = colon ? sentence.slice(prev, start - 1) : "";
+        if (TEMPLATE_SUBJECT.test(subject) && !TEMPLATE_NEGATION_BEFORE.test(subject) &&
+            !TEMPLATE_LABEL_DIRECTIVE.test(label) && !TEMPLATE_PREFIX_DIRECTIVE.test(sentence.slice(0, at)) &&
+            !TEMPLATE_DENIAL_AFTER.test(sentence.slice(at + m[0].length)) &&
+            !TEMPLATE_DENIAL_APPOSITIVE.test(sentence.slice(at + m[0].length))) return true;
+        from = at + 1;
+      }
+      return false;
+    });
+  });
+}
+
+// One finding per catalog or lesson text that credits a restart or reboot to
+// the KEV required action, marked definite when it takes a template form.
+// Drafts are skipped unless opts.includeDrafts is set.
+function kevActionRestartFindings(loaded, opts = {}) {
+  const out = [];
+  for (const catalog of ["cve-catalog", "zeroday-lessons"]) {
+    const cat = loaded[catalog];
+    if (!cat) continue;
+    for (const id of Object.keys(cat)) {
+      if (id === "_meta") continue;
+      const e = cat[id];
+      if (!e || (e._auto_imported === true && !opts.includeDrafts)) continue;
+      for (const [field, s] of _strings(e, "", [])) {
+        if (!creditsRestartToKevAction(s)) continue;
+        out.push({ class: "logical-consistency", catalog, id, field,
+          rule: "restart_not_credited_to_kev_required_action", definite: isTemplateRestartCredit(s),
+          reason: "text credits a restart or reboot to CISA's KEV required action, which names none" });
+      }
+    }
+  }
+  return out;
+}
+
 // Fields present but weak; what counts as weak is per catalog and field.
 function contentQualityFindings(loaded) {
   const out = [];
@@ -494,6 +645,7 @@ function logicalConsistencyFindings(loaded) {
     }
   }
   out.push(...kevListingDateFindings(loaded));
+  out.push(...kevActionRestartFindings(loaded));
   return out;
 }
 
@@ -758,6 +910,11 @@ module.exports = {
   PACKET_FIELD_TOKEN,
   CATALOG_FIELD_NAMES,
   kevListingDateFindings,
+  kevActionRestartFindings,
+  creditsRestartToKevAction,
+  KEV_ACTION_RESTART_CREDIT,
+  KEV_ACTION_RESTART_TEMPLATE,
+  isTemplateRestartCredit,
   KEV_LISTING_DATE,
   KEV_LISTING_DATE_FIRST,
   daysSince,