@clear-capabilities/agentic-security-scanner 0.136.2 → 0.137.0

package/src/sast/iac-terraform.js

@@ -42,6 +42,23 @@ function buildResolver(text) {
 
 function lineOf(text, idx) { return text.slice(0, idx).split('\n').length; }
 
+// AWS security-group `cidr_blocks` lives inside either an `ingress { }` or
+// `egress { }` block. Egress-to-anywhere (0.0.0.0/0 outbound) is the
+// standard default for nearly every security group and is not itself a
+// finding; only the same value on an ingress (inbound) rule is an exposure.
+// Finds the nearest enclosing block by walking back to the last occurrence
+// of either keyword before the match position — security-group ingress/
+// egress blocks don't nest another ingress/egress block inside themselves,
+// so the closest preceding one is the enclosing one.
+const _BLOCK_KEYWORD_RE = /\b(ingress|egress)\s*\{/g;
+function _enclosingBlockType(raw, idx) {
+  let last = null;
+  _BLOCK_KEYWORD_RE.lastIndex = 0;
+  let m;
+  while ((m = _BLOCK_KEYWORD_RE.exec(raw)) && m.index < idx) last = m[1];
+  return last;
+}
+
 const CHECKS = [
   {
     id: 'open-ingress', cwe: 'CWE-284', sev: 'high',
@@ -49,6 +66,13 @@ const CHECKS = [
     bad: (val) => /\b0\.0\.0\.0\/0\b|::\/0\b/.test(val),
     vuln: 'Terraform: security-group ingress open to the world (0.0.0.0/0)',
     fix: 'Restrict cidr_blocks to known networks; never default an ingress CIDR to 0.0.0.0/0.',
+    // Only ingress (inbound) exposure is a finding — egress-to-anywhere is
+    // the standard, expected default. A cidr_blocks outside any
+    // ingress/egress block (no enclosing keyword found) is kept: that's
+    // the standalone `aws_security_group_rule` resource shape, which needs
+    // a separate `type = "ingress"` attribute this module doesn't parse —
+    // erring toward reporting rather than silently dropping it.
+    blockGate: (blockType) => blockType !== 'egress',
   },
   {
     id: 'public-bucket', cwe: 'CWE-732', sev: 'high',
@@ -76,6 +100,7 @@ export function scanTerraform(fp, raw) {
     const re = new RegExp(check.attr.source, check.attr.flags);
     let m;
     while ((m = re.exec(raw))) {
+      if (check.blockGate && !check.blockGate(_enclosingBlockType(raw, m.index))) continue;
       const rawVal = m[1];
       // A literal list may hold several entries; resolve each token.
       const tokens = rawVal.replace(/^\[|\]$/g, '').split(',').map(t => t.trim()).filter(Boolean);

package/src/sast/java-bench-extras.js

@@ -671,7 +671,7 @@ const REQUEST_WRAPPER_CLASS_RE = /\b(?:public\s+|private\s+|protected\s+|static\
 
 /** Parse a Java file and return the names of any classes that wrap an
  *  HttpServletRequest and expose String-returning getters. */
-export function findRequestWrapperGetters(file, raw) {
+function findRequestWrapperGetters(file, raw) {
   if (!JAVA_EXT.test(file) || !raw || raw.length > 500_000) return [];
   const content = blankComments(raw);
   const out = [];

package/src/sast/java-constant-fold.js

@@ -68,7 +68,7 @@ function intLocals(raw) {
 // Pattern 1: Constant ternary assigning to bar.
 //   bar = (<expr> [+-*]) num <cmp> <literal> ? "<safe>" : param;
 // where `num` is a local int constant and the comparison folds to a known bool.
-export function hasConstantTernaryBarSafe(raw) {
+function hasConstantTernaryBarSafe(raw) {
   const ints = intLocals(raw);
   // Try a few common shape variants. The first looks for the (lhs ± num) > N pattern.
   // We allow either order — `bar = literal ? ... : ...` style.
@@ -105,7 +105,7 @@ export function hasConstantTernaryBarSafe(raw) {
 }
 
 // Pattern 2: Constant if/else assigning to bar — same idea.
-export function hasConstantIfBarSafe(raw) {
+function hasConstantIfBarSafe(raw) {
   const ints = intLocals(raw);
   // `if ((N op M) op2 num cmp K) bar = "<literal>"; else bar = param;`
   const re = /\bif\s*\(\s*\((-?\d+)\s*([+\-*])\s*(-?\d+)\)\s*([+\-])\s*(\w+)\s*([><=!]=?|==)\s*(-?\d+)\s*\)\s*bar\s*=\s*"[^"]*"\s*;\s*else\s+bar\s*=\s*(\w+)\s*;/g;
@@ -143,7 +143,7 @@ export function hasConstantIfBarSafe(raw) {
 //   map.put("keyB-XXX", param);
 //   bar = map.get("keyB-XXX");
 //   bar = map.get("keyA-XXX");   // overwrites with safe
-export function hasMapDoubleGetSafe(raw) {
+function hasMapDoubleGetSafe(raw) {
   // Use a tolerant regex — we don't need to bind every put to every get.
   // The presence of these three lines in this order suffices.
   const re = /\.\s*put\s*\(\s*("[^"]+")\s*,\s*"[^"]*"\s*\)\s*;[\s\S]{0,400}?\.\s*put\s*\(\s*("[^"]+")\s*,\s*\w+\s*\)[\s\S]{0,500}?\bbar\s*=\s*(?:\(String\)\s*)?\w+\.get\(\s*\2\s*\)[\s\S]{0,200}?\bbar\s*=\s*(?:\(String\)\s*)?\w+\.get\(\s*\1\s*\)/;
@@ -203,7 +203,7 @@ function _simulateListBar(raw) {
   return anyResolved;
 }
 
-export function hasListGetIndex0Safe(raw) {
+function hasListGetIndex0Safe(raw) {
   return _simulateListBar(raw);
 }
 
@@ -217,7 +217,7 @@ export function hasListGetIndex0Safe(raw) {
 //     case 'B': bar = "literal";   break;   // TAKEN
 //     ...
 //   }
-export function hasSwitchCharAtConstantSafe(raw) {
+function hasSwitchCharAtConstantSafe(raw) {
   // 1. Find `String <var> = "<lit>";` then `char <other> = <var>.charAt(<idx>);`.
   const decl = /\bString\s+(\w+)\s*=\s*"([^"]+)"\s*;\s*(?:\/\/[^\n]*\n)?\s*char\s+\w+\s*=\s*\1\s*\.\s*charAt\s*\(\s*(\d+)\s*\)\s*;/g;
   let m;

package/src/sast/llm-owasp.js

@@ -369,7 +369,10 @@ export function scanLLMOwasp(fp, raw) {
     if (!USER_INJECTED_RAG_RE.test(lines[li])) continue;
     // Suppress if there's an obvious auth or provenance check in the surrounding context
     const ctx20 = _windowText(lines, Math.max(0, li - 10), 20);
-    if (/\b(?:require_auth|is_admin|check_permission|verified_source|provenance|signed|hmac)\b/i.test(ctx20)) break;
+    // continue, not break: a guard near THIS match says nothing about a
+    // later, unrelated match elsewhere in the file — stopping the loop here
+    // would hide every subsequent unguarded instance.
+    if (/\b(?:require_auth|is_admin|check_permission|verified_source|provenance|signed|hmac)\b/i.test(ctx20)) continue;
     push({
       id: `llm-owasp:${fp}:${li + 1}:llm03-user-injected-rag`,
       kind: 'sast', severity: 'high',
@@ -379,7 +382,6 @@ export function scanLLMOwasp(fp, raw) {
       fix: 'Authenticate the submitter and validate content before it enters the knowledge base. Tag each chunk with source, owner, and trust_level metadata at ingest time. At retrieval, filter or down-rank chunks from unverified sources. Scan injected content for prompt-injection markers before storing.',
       confidence: 0.88,
     });
-    break;
   }
 
   // --- LLM03: auto-ingested third-party feed that may be compromised ---

package/src/sast/mcp-audit.js

@@ -101,10 +101,17 @@ export function scanMCP(fp, raw) {
 
   const findings = [];
   const seen = new Set();
+  // CMP-1 (Stage 6 follow-up): no call site here ever set `family`, so every
+  // finding fell through to a generic backfilled value — invisible to any
+  // compliance control mapped to `family:agent-tool-exec` (owasp-llm-top-10's
+  // LLM07), and to the family-keyed cost tables in risk-dollars.js/
+  // time-to-fix.js, which both already carry an 'agent-tool-exec' entry with
+  // nothing in the codebase that could ever produce a matching finding.
   const push = (f) => {
     const key = `${f.file}:${f.line}:${f.vuln}`;
     if (seen.has(key)) return;
     seen.add(key);
+    if (!f.family) f.family = 'agent-tool-exec';
     findings.push(f);
   };
 

package/src/sast/pipeline.js

@@ -43,6 +43,13 @@ const PIPELINE_PATTERNS = [
     vuln: 'Pipeline: untrusted github.event input interpolated into shell context',
     sev: 'critical', cwe: 'CWE-78',
     fix: 'Pipe untrusted github.event values through an environment variable instead of interpolating into the shell, e.g. `env: TITLE: ${{ github.event.issue.title }}` then use `"$TITLE"` in the run script.',
+    // Suppress the exact pattern this fix recommends: a pure YAML mapping
+    // entry (`KEY: ${{ github.event.… }}`) assigns the value to an env var
+    // at the workflow-engine level, not into a shell command string — the
+    // shell later reads it as an ordinary env-var reference ("$KEY"), which
+    // is safe. A match embedded inside a larger line (a run: script body)
+    // does not have this shape and is still flagged.
+    lineSafeRe: /^[\w.-]+\s*:\s*\$\{\{[^}]*\}\}\s*$/,
   },
   {
     re: /\bid-token\s*:\s*write\b/g,
@@ -70,6 +77,7 @@ export function scanPipeline(fp, raw) {
     let m;
     while ((m = re.exec(raw))) {
       const line = raw.substring(0, m.index).split('\n').length;
+      if (p.lineSafeRe && p.lineSafeRe.test((lines[line - 1] || '').trim())) continue;
       const id = `pipeline:${fp}:${line}:${p.vuln.replace(/\s/g, '_').slice(0, 48)}`;
       if (seen.has(id)) continue;
       seen.add(id);

package/src/sast/prompt-template.js

@@ -92,11 +92,6 @@ export function scanPromptTemplate(fp, raw) {
   const seen = new Set();
   const push = (f) => { if (!seen.has(f.id)) { seen.add(f.id); findings.push(f); } };
 
-  // Strong negative for code files: a proper role-separated messages array anywhere
-  // in the file means the developer is using the framework correctly. Suppress
-  // inline-string findings in this case (still scan prompt template files).
-  const hasRoleSeparation = isCodeFile && ROLE_SEPARATION_RE.test(raw);
-
   // CASE 1 — Prompt template files: scan the entire file content for
   // user-input interpolations without isolation markers nearby.
   if (isPromptFile) {
@@ -120,7 +115,7 @@ export function scanPromptTemplate(fp, raw) {
 
   // CASE 2 — Inline prompt strings in code files. Scan f-strings (Python) and
   // template literals (JS/TS) for prompt-shape markers + user interpolation.
-  if (isCodeFile && !hasRoleSeparation) {
+  if (isCodeFile) {
     const candidates = [];
     if (/\.py$/i.test(fpNorm)) {
       let m;
@@ -142,6 +137,13 @@ export function scanPromptTemplate(fp, raw) {
       if (!pyInterp && !jsInterp) continue;
       // Suppress if isolation markers are inside the prompt string itself
       if (ISOLATION_MARKER_RE.test(c.text)) continue;
+      // Suppress if THIS candidate is itself the `content:` value inside a
+      // role-separated messages:[{role,content}] object — checked in a
+      // tight preceding window (same object literal), not file-wide, so a
+      // well-formed call elsewhere in the file can't blanket-suppress an
+      // unrelated, unisolated candidate.
+      const roleWindow = raw.substring(Math.max(0, c.start - 120), c.start);
+      if (ROLE_SEPARATION_RE.test(roleWindow) || /\brole\s*[:=]/i.test(roleWindow)) continue;
       const line = raw.substring(0, c.start).split('\n').length;
       push(_emit(fp, line,
         'Prompt Template: user input interpolated into prompt string without isolation',

package/src/sast/prototype-pollution.js

@@ -89,9 +89,13 @@ export function scanPrototypePollution(fp, raw) {
     const r2 = new RegExp(re.source, re.flags);
     let mm;
     while ((mm = r2.exec(code))) {
-      // Only flag write context: look for `=` within 20 chars after.
+      // Only flag write context: an `=` that is a genuine assignment, not
+      // part of a comparison operator (==, ===, !=, !==, <=, >=). The
+      // previous /=\s*[^=]/ check wasn't anchored to the first `=`, so it
+      // matched the trailing `=` of a `===` chain (e.g.
+      // `obj.__proto__ === Object.prototype`) as a false "write."
       const post = code.slice(mm.index, mm.index + 60);
-      if (!/=\s*[^=]/.test(post)) continue;
+      if (!/(?<![=!<>])=(?!=)/.test(post)) continue;
       const line = lineOf(raw, mm.index);
       push({
         id: `prototype-pollution-direct:${fp}:${line}`,

package/src/sast/redos-nfa.js

@@ -273,7 +273,7 @@ export function isUnsafeRegex(body) {
   return detectSuperlinear(parsed.tree);
 }
 
-export function extractJsRegexBodies(code) {
+function extractJsRegexBodies(code) {
   const out = [];
   // Regex literals: /pattern/flags
   for (const m of code.matchAll(/\/([^/\n]+)\/[gimsuy]*/g)) {
@@ -307,7 +307,7 @@ export function extractJavaRegexBodies(code) {
 
 // Go: regexp.MustCompile / Compile / MatchString("…") — Go string literals use
 // "…" (interpreted) or `…` (raw). Both carry the pattern verbatim.
-export function extractGoRegexBodies(code) {
+function extractGoRegexBodies(code) {
   const out = [];
   for (const m of code.matchAll(/\bregexp\.(?:MustCompile|Compile|CompilePOSIX|MatchString|Match)\s*\(\s*"((?:\\.|[^"\n])+)"/g)) {
     out.push({ body: m[1].replace(/\\\\/g, '\\'), line: code.slice(0, m.index).split('\n').length });
@@ -320,7 +320,7 @@ export function extractGoRegexBodies(code) {
 
 // PHP: preg_match / preg_match_all / preg_replace("/…/flags", …) — the regex is
 // a delimited string; strip the delimiter + trailing flags.
-export function extractPhpRegexBodies(code) {
+function extractPhpRegexBodies(code) {
   const out = [];
   for (const m of code.matchAll(/\bpreg_(?:match|match_all|replace|replace_callback|split)\s*\(\s*(['"])(.+?)\1/g)) {
     let lit = m[2];
@@ -334,7 +334,7 @@ export function extractPhpRegexBodies(code) {
 }
 
 // Ruby: a regex literal /…/ used with =~ / .match / .match? / Regexp.new("…").
-export function extractRubyRegexBodies(code) {
+function extractRubyRegexBodies(code) {
   const out = [];
   for (const m of code.matchAll(/(?:=~|\.match\??|\.scan|\.gsub|\.sub|grep)\s*\(?\s*\/((?:\\.|[^\/\n])+)\//g)) {
     out.push({ body: m[1], line: code.slice(0, m.index).split('\n').length });
@@ -346,7 +346,7 @@ export function extractRubyRegexBodies(code) {
 }
 
 // C#: new Regex("…") / Regex.IsMatch(s, "…") / Regex.Match / Regex.Replace.
-export function extractCsharpRegexBodies(code) {
+function extractCsharpRegexBodies(code) {
   const out = [];
   for (const m of code.matchAll(/\bnew\s+Regex\s*\(\s*@?"((?:\\.|""|[^"\n])+)"/g)) {
     out.push({ body: m[1].replace(/""/g, '"'), line: code.slice(0, m.index).split('\n').length });
@@ -358,7 +358,7 @@ export function extractCsharpRegexBodies(code) {
 }
 
 // Kotlin: Regex("…") / "…".toRegex() / Pattern.compile("…").
-export function extractKotlinRegexBodies(code) {
+function extractKotlinRegexBodies(code) {
   const out = [];
   for (const m of code.matchAll(/\bRegex\s*\(\s*"((?:\\.|[^"\n])+)"/g)) {
     out.push({ body: m[1].replace(/\\\\/g, '\\'), line: code.slice(0, m.index).split('\n').length });

package/src/sast/secret-concat.js

@@ -48,11 +48,22 @@ export function scanSecretConcat(fp, raw) {
     const id = `secret-concat:${fp}:${line}`;
     if (seen.has(id)) continue;
     seen.add(id);
+    // Stage 4 correctness audit (coverage breadth, secrets): same
+    // unredacted-snippet leak found in engine.js's scanEntropySecrets/
+    // scanCredentials — `snippet` carried the raw source line, including
+    // the full reassembled secret's literal pieces, straight through to
+    // every report format this scanner emits. This detector never
+    // computed a masked value at all (the other two secret detectors do).
+    // Mask the exact matched concat-expression text (m[2], the same
+    // substring this detector reassembled `value` from) within the
+    // snippet before reporting it.
+    const masked = value.length > 8 ? value.substring(0, 4) + '…' + value.substring(value.length - 4) : '••••';
+    const rawSnippet = (raw.split('\n')[line - 1] || '').trim().slice(0, 200);
     findings.push({
       id, file: fp, line,
       vuln: 'Hardcoded credential — secret split across concatenated literals to evade detection',
-      severity: 'high', cwe: 'CWE-798', family: 'secret', parser: 'SECRET-CONCAT', confidence: 0.78,
-      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      severity: 'high', cwe: 'CWE-798', family: 'hardcoded-secret', parser: 'SECRET-CONCAT', confidence: 0.78,
+      snippet: rawSnippet.split(m[2]).join(masked), masked,
       remediation: 'Load the secret from the environment or a secrets manager (process.env / os.environ / Vault / AWS Secrets Manager). Splitting the literal across a concatenation does not protect it — rotate the exposed value, it must be considered compromised.',
     });
   }

package/src/sast/ssrf-cloud-metadata.js

@@ -66,15 +66,18 @@ export function scanSSRFCloudMetadata(fp, raw) {
   }
 
   // 2. User-controlled URL into an HTTP client, with no metadata guard nearby.
-  const fileHasMetadataGuard = METADATA_GUARD_RE.test(code);
   const r = new RegExp(SSRF_CLIENT_RE.source, SSRF_CLIENT_RE.flags);
   let m;
   while ((m = r.exec(code))) {
     const line = lineOf(raw, m.index);
-    // Skip if a guard appears in ±10 lines.
+    // Skip if a guard appears in ±10 lines. A file-wide "does this file
+    // contain a guard anywhere" check used to OR into this and blanket-
+    // suppressed every unguarded call site once any one call site was
+    // properly guarded — removed; proximity is what makes a guard actually
+    // apply to a given call.
     const lines = raw.split('\n');
     const window = lines.slice(Math.max(0, line - 11), line + 10).join(' ');
-    if (METADATA_GUARD_RE.test(window) || fileHasMetadataGuard) continue;
+    if (METADATA_GUARD_RE.test(window)) continue;
     push({
       id: `ssrf-meta-usercontrolled:${fp}:${line}`,
       file: fp, line,

package/src/sast/xss-reflected-multilang.js

@@ -91,7 +91,7 @@ export function scanXssReflectedMultilang(fp, raw) {
   for (const v of Object.values(LANGS)) { if (v.ext.test(fp)) { lang = v; break; } }
   if (!lang) return [];
 
-  const code = blankComments(raw, /\.(?:rb|php)$/i.test(fp) ? 'py' : undefined);
+  const code = blankComments(raw, /\.rb$/i.test(fp) ? 'py' : (/\.(?:php|phtml)$/i.test(fp) ? 'php' : undefined));
   const lines = code.split('\n');
   const findings = [];
   const seen = new Set();

package/src/sast/xxe.js

@@ -180,7 +180,7 @@ export function scanXXE(fp, raw) {
   };
 
   if (/\.(?:php|phtml)$/i.test(fp)) {
-    const code = blankComments(raw, 'py');
+    const code = blankComments(raw, 'php');
     _emitOptIn(code, PHP_XXE_RE, null,
       () => 'XXE: XML parsed with LIBXML_NOENT / LIBXML_DTDLOAD (external entities enabled)',
       () => 'Drop the LIBXML_NOENT / LIBXML_DTDLOAD flags — PHP >= 8.0 disables entity substitution by default, so plain loadXML($xml) / simplexml_load_string($xml) is safe. If you must accept DTDs, set libxml_set_external_entity_loader to reject network/file access.');

package/src/sca/CLAUDE.md

@@ -7,7 +7,7 @@ ecosystems and the most common lockfiles in each.
 
 Most of the SCA *pipeline* lives in `../engine.js` (the manifest dispatch
 in `parseManifests`, OSV/KEV/EPSS enrichment, attack-path computation).
-This directory holds the eight specialized modules called from there.
+This directory holds the seven specialized modules called from there.
 
 ## Modules
 
@@ -16,10 +16,9 @@ This directory holds the eight specialized modules called from there.
 | `index.js` | Re-exports six public symbols from `../engine.js` so external consumers can `import { parseManifests, queryOSV, … } from '@…/sca'`. |
 | `binary-metadata.js` | **Opt-in via `AGENTIC_SECURITY_BINARY_SCA=1`.** Reads dependency metadata from compiled artifacts: JAR `META-INF/MANIFEST.MF` + `pom.properties`, Go binary `go.buildinfo`. Never executes the binary. JAR extraction uses `fs.mkdtemp` for an isolated scratch dir (premortem-derived: shared `/tmp` lets a hostile JAR plant a symlinked manifest that escapes the scratch). |
 | `container.js` | Dockerfile parser. Detects EOL `FROM` base images (alpine/debian/ubuntu/node/python) against `base-images.json`, and synthesizes lightweight SCA components from `apt-get install` / `apk add` package lists. No Docker daemon required. |
-| `dep-confusion.js` | Two related detectors. **Typosquat:** Levenshtein distance ≤ 2 against the top-1000 packages in `popular-packages.json`. **Dependency confusion:** internal-scoped names (declared in `.agentic-security/internal-scopes.yml`) appearing on the public registry. Local-first; OSV consulted only to confirm confusion findings. |
+| `dep-confusion.js` | Two related detectors. **Typosquat:** Levenshtein distance ≤ 2 against `popular-packages.json` — **188 packages (115 npm + 73 pypi), not "top-1000"** as this row previously said; re-derive the count from the file rather than trusting a hardcoded number here again. **Dependency confusion:** internal-scoped names (declared in `.agentic-security/internal-scopes.yml`) appearing on the public registry. Local-first; **this module does not itself call OSV** — it reads a flag set by an earlier, separate OSV/queryRegistries pass upstream (whether a dep "resolved by OSV"), which is different from "OSV consulted [by this module] to confirm confusion findings" as previously stated. |
 | `llm-function-extract.js` | **Opt-in via `AGENTIC_SECURITY_LLM_SCA=1`.** LLM-assisted extraction of vulnerable function names for CVEs that lack OSV `ecosystem_specific.vulnerable_functions` data. Cached per CVE under `~/.config/agentic-security/llm-sca-cache/`. Endpoint-dependent — degrades to no-op when unreachable. |
 | `py-package-functions.js` | **Opt-in via `AGENTIC_SECURITY_DEEP=1`** (Python only). Locates installed Python packages via `site-packages` and parses them with the CPython `ast` module (subprocess) to *validate* that an OSV-named vulnerable function exists in the installed version. Closes the "OSV says this function is vulnerable, but the version you installed actually removed it" false-positive class. |
-| `sarif-ingest.js` | Normalizes SARIF 2.1.0 from external scanners and merges into the unified scan. Deduplicates by fingerprint `(CWE, file, line ± 2, rule)`. Twelve tool profiles supported with default-severity + semantic-kind mapping. |
 | `vendor-detect.js` | Detects libraries copied into `src/` (lodash, jQuery, Angular, React, etc.) via characteristic version strings and function signatures. Catches the case where a vulnerable library bypasses the lockfile because someone vendored it directly. |
 
 ## Data sources + caches
@@ -132,7 +131,7 @@ if a detector forgets to set them.
   is updated periodically; an alpine-3.16 today might not appear EOL until
   the file is refreshed. Bias is toward false negatives.
 - **Typosquat threshold is a single distance.** Levenshtein ≤ 2 against
-  the top-1000 list. Increasing the threshold blows up the FP rate;
+  the popular-packages.json list (188 entries, not top-1000). Increasing the threshold blows up the FP rate;
   decreasing it loses real typosquats. This is the calibrated default.
 
 ## Adding a new detector here

package/src/sca/container.js

@@ -80,9 +80,14 @@ export function scanContainer(fp, raw) {
     });
   }
 
+  return findings;
+}
+
+function _parsePackagesFromDockerfile(raw) {
   // Pass 2: apt/apk packages — surface as components hint for the SCA pipeline.
   // We do NOT query OSV here (the engine's SCA pass owns that). Just collect names.
   const packages = [];
+  let m;
   _APT_INSTALL_RE.lastIndex = 0;
   while ((m = _APT_INSTALL_RE.exec(raw))) {
     for (const tok of m[1].split(/\s+/)) {
@@ -101,7 +106,34 @@ export function scanContainer(fp, raw) {
       if (/^[a-z0-9][\w.+-]*$/.test(name)) packages.push({ ecosystem: 'alpine', name, version: ver || '' });
     }
   }
-  // Stash packages on the first finding so the engine can consume them downstream
-  if (packages.length && findings.length) findings[0]._containerPackages = packages;
-  return findings;
+  return packages;
+}
+
+// Extract Dockerfile-declared apt/apk packages across every Dockerfile in
+// fileContents, as full SCA component entries — mirrors image-packages.js's
+// extractImagePackages(fileContents) signature/shape so both plug into the
+// engine's components merge the same way. Deliberately independent of
+// scanContainer's return value: piggybacking package data on a *finding*
+// meant no packages were ever surfaced for a Dockerfile whose FROM line
+// wasn't itself flagged (the common case — most Dockerfiles pin a
+// non-EOL base image), even though apt/apk lines were still present and
+// parseable.
+export function extractContainerPackages(fileContents) {
+  const comps = [];
+  const seen = new Set();
+  for (const [file, content] of Object.entries(fileContents || {})) {
+    if (!_DOCKERFILE_RE.test(file.replace(/\\/g, '/'))) continue;
+    if (!content || content.length > 200_000) continue;
+    for (const p of _parsePackagesFromDockerfile(content)) {
+      const key = `${p.ecosystem}:${p.name}:${p.version}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      comps.push({
+        name: p.name, version: p.version, group: '', scope: 'required',
+        purl: `pkg:${p.ecosystem === 'debian' ? 'deb/debian' : 'apk/alpine'}/${encodeURIComponent(p.name)}${p.version ? '@' + encodeURIComponent(p.version) : ''}`,
+        ecosystem: p.ecosystem, filePath: file, isUnpinned: !p.version, isOsPackage: true, reachable: true,
+      });
+    }
+  }
+  return comps;
 }

package/src/sca/dep-confusion.js

@@ -97,6 +97,12 @@ export function detectDepConfusion(components, scanRoot) {
             id, kind: 'sca', severity: bestDist === 1 ? 'critical' : 'high',
             vuln: `Possible typosquat: "${c.name}" (1–2 chars from "${bestMatch}")`,
             cwe: 'CWE-1357', stride: 'Tampering',
+            // CMP-1 (Stage 6 follow-up): neither finding here set `family`,
+            // so both fell through to the generic `vulnerable-dep` default
+            // every unset supplyChain finding gets — invisible to any
+            // compliance control mapped to the more specific
+            // family:dependency-confusion (ccpa.json).
+            family: 'dependency-confusion',
             file: c.filePath || 'package.json', line: 0,
             snippet: `${c.ecosystem}:${c.name}@${c.version}`,
             fix: `Verify "${c.name}" is the package you actually meant. The popular package "${bestMatch}" is ${bestDist} edit(s) away — typosquat malware commonly registers names like this. Double-check the publisher, weekly downloads, and recent changes before keeping this dep.`,
@@ -122,6 +128,7 @@ export function detectDepConfusion(components, scanRoot) {
             id, kind: 'sca', severity: 'high',
             vuln: `Internal-scoped package on public registry: "${c.name}"`,
             cwe: 'CWE-1357', stride: 'Tampering',
+            family: 'dependency-confusion',
             file: c.filePath || 'package.json', line: 0,
             snippet: `${c.ecosystem}:${c.name}@${c.version}`,
             fix: `"${c.name}" matches your internal scope "${scope}", but is being resolved from the public registry. Confirm whether your private registry is configured (e.g. .npmrc / .pypirc) — if a public copy exists with the same name an attacker could publish malicious updates and your installs would silently switch.`,

package/src/sca/sarif-ingest.js

@@ -1,187 +0,0 @@
-// 0.7.0 Feat-7: SARIF 2.1.0 ingest — normalizes and merges external scanner findings into unified report.
-//
-// Reads SARIF 2.1.0 from gitleaks / Semgrep / Bandit / Trivy / Checkov / SonarQube
-// and merges into our scan. Findings are normalised + deduplicated against our
-// own findings via a fingerprint of (CWE/CVE, file, line ±2, rule), and a
-// `sources[]` array is added to the merged finding so attribution is preserved.
-//
-// Pure ESM, no external deps. Reads JSON only — no schema validation library.
-
-import * as fs from 'node:fs';
-import * as crypto from 'node:crypto';
-
-// Tool-name → (kind, defaultSeverityIfUnset)
-const TOOL_PROFILE = {
-  'semgrep':       { kind: 'sast',   defSev: 'medium' },
-  'opengrep':      { kind: 'sast',   defSev: 'medium' },
-  'bandit':        { kind: 'sast',   defSev: 'medium' },
-  'eslint':        { kind: 'sast',   defSev: 'low' },
-  'sonarqube':     { kind: 'sast',   defSev: 'medium' },
-  'codeql':        { kind: 'sast',   defSev: 'high' },
-  'gitleaks':      { kind: 'secret', defSev: 'high' },
-  'trufflehog':    { kind: 'secret', defSev: 'high' },
-  'detect-secrets':{ kind: 'secret', defSev: 'high' },
-  'trivy':         { kind: 'sca',    defSev: 'high' },
-  'grype':         { kind: 'sca',    defSev: 'high' },
-  'osv-scanner':   { kind: 'sca',    defSev: 'high' },
-  'checkov':       { kind: 'iac',    defSev: 'medium' },
-  'tfsec':         { kind: 'iac',    defSev: 'medium' },
-  'kics':          { kind: 'iac',    defSev: 'medium' },
-};
-
-// SARIF level → our severity tier
-const LEVEL_MAP = { error: 'critical', warning: 'high', note: 'medium', none: 'low' };
-
-// Normalize a tool name into a TOOL_PROFILE key (case + version-agnostic)
-function _toolKey(rawName) {
-  if (!rawName) return null;
-  const n = String(rawName).toLowerCase().replace(/[^a-z0-9-]/g, '');
-  for (const k of Object.keys(TOOL_PROFILE)) if (n.includes(k)) return k;
-  return null;
-}
-
-function _fingerprint(file, line, vuln, cwe) {
-  // Bucketed line (±2) so that off-by-one rule reports merge correctly.
-  const bucket = Math.floor((line || 0) / 2) * 2;
-  const key = `${file}:${bucket}:${(cwe || '').toUpperCase()}:${(vuln || '').replace(/\W+/g, '_').toLowerCase()}`;
-  return crypto.createHash('sha256').update(key).digest('hex').slice(0, 16);
-}
-
-function _extractCWE(rule) {
-  // SARIF rules can carry CWE in `properties.tags`, `properties.cwe`, or `helpUri`.
-  const tags = rule?.properties?.tags || [];
-  for (const t of tags) {
-    const m = String(t).match(/CWE-?(\d+)/i);
-    if (m) return `CWE-${m[1]}`;
-  }
-  if (rule?.properties?.cwe) {
-    const m = String(rule.properties.cwe).match(/(\d+)/);
-    if (m) return `CWE-${m[1]}`;
-  }
-  if (rule?.helpUri) {
-    const m = rule.helpUri.match(/cwe\.mitre\.org\/data\/definitions\/(\d+)/i);
-    if (m) return `CWE-${m[1]}`;
-  }
-  return null;
-}
-
-function _extractCVE(result) {
-  // Trivy / Grype / osv-scanner put CVE in ruleId or properties.
-  const id = result?.ruleId || '';
-  const m = id.match(/(CVE-\d{4}-\d{4,7})/i);
-  if (m) return m[1].toUpperCase();
-  const tags = result?.properties?.tags || [];
-  for (const t of tags) {
-    const tm = String(t).match(/(CVE-\d{4}-\d{4,7})/i);
-    if (tm) return tm[1].toUpperCase();
-  }
-  return null;
-}
-
-// Convert a single SARIF result + its run context into our normalized finding.
-function _resultToFinding(result, run, toolKey, defSev) {
-  const loc = result.locations?.[0]?.physicalLocation;
-  const file = loc?.artifactLocation?.uri || result?.fingerprints?.path || '(unknown)';
-  const line = loc?.region?.startLine || 0;
-  const ruleId = result.ruleId || '';
-  const rule = (run.tool?.driver?.rules || []).find(r => r.id === ruleId);
-  const message = result.message?.text || rule?.fullDescription?.text || rule?.shortDescription?.text || ruleId;
-  const sev = LEVEL_MAP[result.level] || defSev;
-  const cwe = _extractCWE(rule || result);
-  const cve = _extractCVE(result);
-  const profile = TOOL_PROFILE[toolKey] || { kind: 'sast', defSev: 'medium' };
-  return {
-    file: file.replace(/^file:\/\//, ''),
-    line,
-    severity: sev,
-    vuln: cve ? `${cve}: ${message}`.slice(0, 240) : message.slice(0, 240),
-    cwe,
-    cve,
-    kind: profile.kind,
-    ruleId,
-    snippet: result.locations?.[0]?.physicalLocation?.contextRegion?.snippet?.text
-          || result.locations?.[0]?.physicalLocation?.region?.snippet?.text
-          || '',
-    sources: [run.tool?.driver?.name || toolKey],
-  };
-}
-
-// Load and parse a SARIF file. Returns an array of normalized findings.
-export function ingestSARIFFile(filePath) {
-  let raw;
-  try { raw = fs.readFileSync(filePath, 'utf8'); }
-  catch (e) { throw new Error(`Cannot read SARIF file ${filePath}: ${e.message}`); }
-  let doc;
-  try { doc = JSON.parse(raw); }
-  catch (e) { throw new Error(`Invalid JSON in SARIF file ${filePath}: ${e.message}`); }
-  if (!doc || !Array.isArray(doc.runs)) {
-    throw new Error(`Not a SARIF document (missing runs[]): ${filePath}`);
-  }
-  const out = [];
-  for (const run of doc.runs) {
-    const toolName = run.tool?.driver?.name;
-    const toolKey = _toolKey(toolName);
-    const profile = TOOL_PROFILE[toolKey] || { kind: 'sast', defSev: 'medium' };
-    for (const result of (run.results || [])) {
-      try { out.push(_resultToFinding(result, run, toolKey || (toolName||'').toLowerCase(), profile.defSev)); }
-      catch (_) {}
-    }
-  }
-  return out;
-}
-
-// Merge an array of external findings into the scan result. Mutates `scan` in place.
-// Behaviour:
-//   - Findings whose fingerprint matches an existing scan.findings entry have their
-//     source tool name appended to scan.findings[i].sources[] and (if the external
-//     finding's severity is higher) the existing severity is bumped.
-//   - New findings (no match) are appended to scan.findings, scan.secrets, or
-//     scan.supplyChain depending on `kind`.
-export function mergeSARIFFindings(scan, externals) {
-  // Index existing findings by fingerprint
-  const existingFP = new Map();
-  for (const f of (scan.findings || [])) {
-    const fp = _fingerprint((f.file||'').split(' -> ').pop(), f.line||f.source?.line||f.sink?.line||0, f.vuln||f.type, f.cwe);
-    existingFP.set(fp, f);
-  }
-  let merged = 0, added = 0;
-  const SEV_RANK = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
-  for (const ext of externals) {
-    const fp = _fingerprint(ext.file, ext.line, ext.vuln, ext.cwe);
-    const existing = existingFP.get(fp);
-    if (existing) {
-      existing.sources = Array.from(new Set([...(existing.sources || ['agentic-security']), ...ext.sources]));
-      // Bump severity if the external tool reported higher
-      if ((SEV_RANK[ext.severity] || 0) > (SEV_RANK[existing.severity] || 0)) {
-        existing.severity = ext.severity;
-      }
-      merged++;
-      continue;
-    }
-    // Append as new finding into the right bucket
-    const id = `sarif-ingest:${fp}`;
-    const newFinding = {
-      id, kind: ext.kind, severity: ext.severity, vuln: ext.vuln,
-      cwe: ext.cwe, file: ext.file, line: ext.line, snippet: ext.snippet || '',
-      sources: ext.sources, parser: 'SARIF',
-    };
-    if (ext.kind === 'secret') (scan.secrets = scan.secrets || []).push(newFinding);
-    else if (ext.kind === 'sca') (scan.supplyChain = scan.supplyChain || []).push({ ...newFinding, type: 'vulnerable_dep' });
-    else if (ext.kind === 'iac' || ext.kind === 'sast' || ext.kind === 'logic') (scan.findings = scan.findings || []).push(newFinding);
-    added++;
-  }
-  return { merged, added };
-}
-
-export function ingestAndMerge(scan, sarifPaths) {
-  let totalMerged = 0, totalAdded = 0;
-  for (const p of sarifPaths) {
-    let externals;
-    try { externals = ingestSARIFFile(p); }
-    catch (e) { /* swallow per-file errors so one bad SARIF doesn't break the run */ continue; }
-    const { merged, added } = mergeSARIFFindings(scan, externals);
-    totalMerged += merged;
-    totalAdded += added;
-  }
-  return { merged: totalMerged, added: totalAdded };
-}