@clear-capabilities/agentic-security-scanner 0.134.0 → 0.136.9

package/src/sca/container.js

@@ -80,9 +80,14 @@ export function scanContainer(fp, raw) {
     });
   }
 
+  return findings;
+}
+
+function _parsePackagesFromDockerfile(raw) {
   // Pass 2: apt/apk packages — surface as components hint for the SCA pipeline.
   // We do NOT query OSV here (the engine's SCA pass owns that). Just collect names.
   const packages = [];
+  let m;
   _APT_INSTALL_RE.lastIndex = 0;
   while ((m = _APT_INSTALL_RE.exec(raw))) {
     for (const tok of m[1].split(/\s+/)) {
@@ -101,7 +106,34 @@ export function scanContainer(fp, raw) {
       if (/^[a-z0-9][\w.+-]*$/.test(name)) packages.push({ ecosystem: 'alpine', name, version: ver || '' });
     }
   }
-  // Stash packages on the first finding so the engine can consume them downstream
-  if (packages.length && findings.length) findings[0]._containerPackages = packages;
-  return findings;
+  return packages;
+}
+
+// Extract Dockerfile-declared apt/apk packages across every Dockerfile in
+// fileContents, as full SCA component entries — mirrors image-packages.js's
+// extractImagePackages(fileContents) signature/shape so both plug into the
+// engine's components merge the same way. Deliberately independent of
+// scanContainer's return value: piggybacking package data on a *finding*
+// meant no packages were ever surfaced for a Dockerfile whose FROM line
+// wasn't itself flagged (the common case — most Dockerfiles pin a
+// non-EOL base image), even though apt/apk lines were still present and
+// parseable.
+export function extractContainerPackages(fileContents) {
+  const comps = [];
+  const seen = new Set();
+  for (const [file, content] of Object.entries(fileContents || {})) {
+    if (!_DOCKERFILE_RE.test(file.replace(/\\/g, '/'))) continue;
+    if (!content || content.length > 200_000) continue;
+    for (const p of _parsePackagesFromDockerfile(content)) {
+      const key = `${p.ecosystem}:${p.name}:${p.version}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      comps.push({
+        name: p.name, version: p.version, group: '', scope: 'required',
+        purl: `pkg:${p.ecosystem === 'debian' ? 'deb/debian' : 'apk/alpine'}/${encodeURIComponent(p.name)}${p.version ? '@' + encodeURIComponent(p.version) : ''}`,
+        ecosystem: p.ecosystem, filePath: file, isUnpinned: !p.version, isOsPackage: true, reachable: true,
+      });
+    }
+  }
+  return comps;
 }

package/src/sca/dep-confusion.js

@@ -12,6 +12,7 @@ import * as path from 'node:path';
 import * as yaml from '../util/yaml.js';
 import { createRequire } from 'node:module';
 
+import { statePath } from '../posture/state-dir.js';
 const _require = createRequire(import.meta.url);
 const _POPULAR = (() => {
   try {
@@ -52,7 +53,7 @@ export function levenshtein(a, b, maxDistance = 2) {
 function _loadInternalScopes(scanRoot) {
   if (!scanRoot) return [];
   for (const name of ['internal-scopes.yml', 'internal-scopes.yaml']) {
-    const p = path.join(scanRoot, '.agentic-security', name);
+    const p = statePath(scanRoot, name);
     if (!fs.existsSync(p)) continue;
     try {
       const doc = yaml.load(fs.readFileSync(p, 'utf8'));
@@ -96,6 +97,12 @@ export function detectDepConfusion(components, scanRoot) {
             id, kind: 'sca', severity: bestDist === 1 ? 'critical' : 'high',
             vuln: `Possible typosquat: "${c.name}" (1–2 chars from "${bestMatch}")`,
             cwe: 'CWE-1357', stride: 'Tampering',
+            // CMP-1 (Stage 6 follow-up): neither finding here set `family`,
+            // so both fell through to the generic `vulnerable-dep` default
+            // every unset supplyChain finding gets — invisible to any
+            // compliance control mapped to the more specific
+            // family:dependency-confusion (ccpa.json).
+            family: 'dependency-confusion',
             file: c.filePath || 'package.json', line: 0,
             snippet: `${c.ecosystem}:${c.name}@${c.version}`,
             fix: `Verify "${c.name}" is the package you actually meant. The popular package "${bestMatch}" is ${bestDist} edit(s) away — typosquat malware commonly registers names like this. Double-check the publisher, weekly downloads, and recent changes before keeping this dep.`,
@@ -121,6 +128,7 @@ export function detectDepConfusion(components, scanRoot) {
             id, kind: 'sca', severity: 'high',
             vuln: `Internal-scoped package on public registry: "${c.name}"`,
             cwe: 'CWE-1357', stride: 'Tampering',
+            family: 'dependency-confusion',
             file: c.filePath || 'package.json', line: 0,
             snippet: `${c.ecosystem}:${c.name}@${c.version}`,
             fix: `"${c.name}" matches your internal scope "${scope}", but is being resolved from the public registry. Confirm whether your private registry is configured (e.g. .npmrc / .pypirc) — if a public copy exists with the same name an attacker could publish malicious updates and your installs would silently switch.`,

package/src/sca/sarif-ingest.js

@@ -1,187 +0,0 @@
-// 0.7.0 Feat-7: SARIF 2.1.0 ingest — normalizes and merges external scanner findings into unified report.
-//
-// Reads SARIF 2.1.0 from gitleaks / Semgrep / Bandit / Trivy / Checkov / SonarQube
-// and merges into our scan. Findings are normalised + deduplicated against our
-// own findings via a fingerprint of (CWE/CVE, file, line ±2, rule), and a
-// `sources[]` array is added to the merged finding so attribution is preserved.
-//
-// Pure ESM, no external deps. Reads JSON only — no schema validation library.
-
-import * as fs from 'node:fs';
-import * as crypto from 'node:crypto';
-
-// Tool-name → (kind, defaultSeverityIfUnset)
-const TOOL_PROFILE = {
-  'semgrep':       { kind: 'sast',   defSev: 'medium' },
-  'opengrep':      { kind: 'sast',   defSev: 'medium' },
-  'bandit':        { kind: 'sast',   defSev: 'medium' },
-  'eslint':        { kind: 'sast',   defSev: 'low' },
-  'sonarqube':     { kind: 'sast',   defSev: 'medium' },
-  'codeql':        { kind: 'sast',   defSev: 'high' },
-  'gitleaks':      { kind: 'secret', defSev: 'high' },
-  'trufflehog':    { kind: 'secret', defSev: 'high' },
-  'detect-secrets':{ kind: 'secret', defSev: 'high' },
-  'trivy':         { kind: 'sca',    defSev: 'high' },
-  'grype':         { kind: 'sca',    defSev: 'high' },
-  'osv-scanner':   { kind: 'sca',    defSev: 'high' },
-  'checkov':       { kind: 'iac',    defSev: 'medium' },
-  'tfsec':         { kind: 'iac',    defSev: 'medium' },
-  'kics':          { kind: 'iac',    defSev: 'medium' },
-};
-
-// SARIF level → our severity tier
-const LEVEL_MAP = { error: 'critical', warning: 'high', note: 'medium', none: 'low' };
-
-// Normalize a tool name into a TOOL_PROFILE key (case + version-agnostic)
-function _toolKey(rawName) {
-  if (!rawName) return null;
-  const n = String(rawName).toLowerCase().replace(/[^a-z0-9-]/g, '');
-  for (const k of Object.keys(TOOL_PROFILE)) if (n.includes(k)) return k;
-  return null;
-}
-
-function _fingerprint(file, line, vuln, cwe) {
-  // Bucketed line (±2) so that off-by-one rule reports merge correctly.
-  const bucket = Math.floor((line || 0) / 2) * 2;
-  const key = `${file}:${bucket}:${(cwe || '').toUpperCase()}:${(vuln || '').replace(/\W+/g, '_').toLowerCase()}`;
-  return crypto.createHash('sha256').update(key).digest('hex').slice(0, 16);
-}
-
-function _extractCWE(rule) {
-  // SARIF rules can carry CWE in `properties.tags`, `properties.cwe`, or `helpUri`.
-  const tags = rule?.properties?.tags || [];
-  for (const t of tags) {
-    const m = String(t).match(/CWE-?(\d+)/i);
-    if (m) return `CWE-${m[1]}`;
-  }
-  if (rule?.properties?.cwe) {
-    const m = String(rule.properties.cwe).match(/(\d+)/);
-    if (m) return `CWE-${m[1]}`;
-  }
-  if (rule?.helpUri) {
-    const m = rule.helpUri.match(/cwe\.mitre\.org\/data\/definitions\/(\d+)/i);
-    if (m) return `CWE-${m[1]}`;
-  }
-  return null;
-}
-
-function _extractCVE(result) {
-  // Trivy / Grype / osv-scanner put CVE in ruleId or properties.
-  const id = result?.ruleId || '';
-  const m = id.match(/(CVE-\d{4}-\d{4,7})/i);
-  if (m) return m[1].toUpperCase();
-  const tags = result?.properties?.tags || [];
-  for (const t of tags) {
-    const tm = String(t).match(/(CVE-\d{4}-\d{4,7})/i);
-    if (tm) return tm[1].toUpperCase();
-  }
-  return null;
-}
-
-// Convert a single SARIF result + its run context into our normalized finding.
-function _resultToFinding(result, run, toolKey, defSev) {
-  const loc = result.locations?.[0]?.physicalLocation;
-  const file = loc?.artifactLocation?.uri || result?.fingerprints?.path || '(unknown)';
-  const line = loc?.region?.startLine || 0;
-  const ruleId = result.ruleId || '';
-  const rule = (run.tool?.driver?.rules || []).find(r => r.id === ruleId);
-  const message = result.message?.text || rule?.fullDescription?.text || rule?.shortDescription?.text || ruleId;
-  const sev = LEVEL_MAP[result.level] || defSev;
-  const cwe = _extractCWE(rule || result);
-  const cve = _extractCVE(result);
-  const profile = TOOL_PROFILE[toolKey] || { kind: 'sast', defSev: 'medium' };
-  return {
-    file: file.replace(/^file:\/\//, ''),
-    line,
-    severity: sev,
-    vuln: cve ? `${cve}: ${message}`.slice(0, 240) : message.slice(0, 240),
-    cwe,
-    cve,
-    kind: profile.kind,
-    ruleId,
-    snippet: result.locations?.[0]?.physicalLocation?.contextRegion?.snippet?.text
-          || result.locations?.[0]?.physicalLocation?.region?.snippet?.text
-          || '',
-    sources: [run.tool?.driver?.name || toolKey],
-  };
-}
-
-// Load and parse a SARIF file. Returns an array of normalized findings.
-export function ingestSARIFFile(filePath) {
-  let raw;
-  try { raw = fs.readFileSync(filePath, 'utf8'); }
-  catch (e) { throw new Error(`Cannot read SARIF file ${filePath}: ${e.message}`); }
-  let doc;
-  try { doc = JSON.parse(raw); }
-  catch (e) { throw new Error(`Invalid JSON in SARIF file ${filePath}: ${e.message}`); }
-  if (!doc || !Array.isArray(doc.runs)) {
-    throw new Error(`Not a SARIF document (missing runs[]): ${filePath}`);
-  }
-  const out = [];
-  for (const run of doc.runs) {
-    const toolName = run.tool?.driver?.name;
-    const toolKey = _toolKey(toolName);
-    const profile = TOOL_PROFILE[toolKey] || { kind: 'sast', defSev: 'medium' };
-    for (const result of (run.results || [])) {
-      try { out.push(_resultToFinding(result, run, toolKey || (toolName||'').toLowerCase(), profile.defSev)); }
-      catch (_) {}
-    }
-  }
-  return out;
-}
-
-// Merge an array of external findings into the scan result. Mutates `scan` in place.
-// Behaviour:
-//   - Findings whose fingerprint matches an existing scan.findings entry have their
-//     source tool name appended to scan.findings[i].sources[] and (if the external
-//     finding's severity is higher) the existing severity is bumped.
-//   - New findings (no match) are appended to scan.findings, scan.secrets, or
-//     scan.supplyChain depending on `kind`.
-export function mergeSARIFFindings(scan, externals) {
-  // Index existing findings by fingerprint
-  const existingFP = new Map();
-  for (const f of (scan.findings || [])) {
-    const fp = _fingerprint((f.file||'').split(' -> ').pop(), f.line||f.source?.line||f.sink?.line||0, f.vuln||f.type, f.cwe);
-    existingFP.set(fp, f);
-  }
-  let merged = 0, added = 0;
-  const SEV_RANK = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
-  for (const ext of externals) {
-    const fp = _fingerprint(ext.file, ext.line, ext.vuln, ext.cwe);
-    const existing = existingFP.get(fp);
-    if (existing) {
-      existing.sources = Array.from(new Set([...(existing.sources || ['agentic-security']), ...ext.sources]));
-      // Bump severity if the external tool reported higher
-      if ((SEV_RANK[ext.severity] || 0) > (SEV_RANK[existing.severity] || 0)) {
-        existing.severity = ext.severity;
-      }
-      merged++;
-      continue;
-    }
-    // Append as new finding into the right bucket
-    const id = `sarif-ingest:${fp}`;
-    const newFinding = {
-      id, kind: ext.kind, severity: ext.severity, vuln: ext.vuln,
-      cwe: ext.cwe, file: ext.file, line: ext.line, snippet: ext.snippet || '',
-      sources: ext.sources, parser: 'SARIF',
-    };
-    if (ext.kind === 'secret') (scan.secrets = scan.secrets || []).push(newFinding);
-    else if (ext.kind === 'sca') (scan.supplyChain = scan.supplyChain || []).push({ ...newFinding, type: 'vulnerable_dep' });
-    else if (ext.kind === 'iac' || ext.kind === 'sast' || ext.kind === 'logic') (scan.findings = scan.findings || []).push(newFinding);
-    added++;
-  }
-  return { merged, added };
-}
-
-export function ingestAndMerge(scan, sarifPaths) {
-  let totalMerged = 0, totalAdded = 0;
-  for (const p of sarifPaths) {
-    let externals;
-    try { externals = ingestSARIFFile(p); }
-    catch (e) { /* swallow per-file errors so one bad SARIF doesn't break the run */ continue; }
-    const { merged, added } = mergeSARIFFindings(scan, externals);
-    totalMerged += merged;
-    totalAdded += added;
-  }
-  return { merged: totalMerged, added: totalAdded };
-}