@clear-capabilities/agentic-security-scanner 0.137.1 → 0.139.0

package/src/sast/convention-deviation.js

@@ -0,0 +1,235 @@
+// PRD Theme 6 — repo-internal convention deviation.
+//
+// THE IDEA, AND WHY IT IS DIFFERENT FROM EVERY OTHER DETECTOR HERE.
+// Every other rule in this directory asks "does this match a known-bad
+// pattern?" — which requires someone to have enumerated the pattern first.
+// This one asks the inverse: "does this site deviate from what THIS codebase
+// has already established as its own correct handling?"
+//
+// That inversion matters because 10 of the 96 real-world misses root-caused in
+// docs/INDEPENDENT_POPULATION_ROOT_CAUSE.md share exactly one shape: the
+// correct guard already exists elsewhere in the same file, and one site forgot
+// it. No catalog can express that — the guard is the project's own invention.
+//
+// Worked example (GHSA-9rj7-rf2p-w77r, GitPython CVE, argument injection):
+//   Repo.blame / blame_incremental / _clone / archive   →  call
+//        Git.check_unsafe_options(...) before forwarding **kwargs to git.*
+//   Repo.init                                            →  forwards **kwargs
+//        straight to git.init(**kwargs) with no such call
+// A `--template=<path>` kwarg becomes a git CLI flag that installs an
+// attacker-controlled hook. The fix added exactly the missing guard call.
+//
+// WHAT THIS DOES NOT CLAIM. A deviation is not a proof of exploitability — it
+// is evidence that this site is inconsistent with its own neighbours, which is
+// why findings carry the supporting siblings and sit at medium severity. That
+// is the honest strength of the signal, and it is deliberately not inflated.
+//
+// PRECISION CONTROLS (all required before anything is reported):
+//   - a real population: at least MIN_GUARDED_SIBLINGS guarded neighbours
+//   - a real majority:   guarded / (guarded + unguarded) >= MIN_GUARDED_RATIO
+//   - structural similarity: siblings are only compared when they forward
+//     caller-controlled options into the SAME primitive receiver, so
+//     `TagReference.create(**kwargs)` is never weighed against `git.init(...)`
+import { blankComments } from './_comment-strip.js';
+
+const PY_RE = /\.py$/i;
+const JS_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i;
+
+/** Guard-shaped callee: an action verb applied to a checkable concern. */
+// The dotted qualifier is an OPTIONAL single-quantifier group rather than a
+// repeated one: `(?:\w+\.)*` is a nested quantifier, which this project's own
+// redos-nfa.js flags — correctly, since this scanner runs over untrusted code.
+// Accepts both snake_case (`check_unsafe_options`) and camelCase
+// (`assertWorkspaceAccess`) so the same comparator works across Python and
+// JS/TS. The verb must be followed by `_` or an uppercase letter, so a bare
+// `check(x)` or an unrelated `requirement(x)` does not qualify.
+const GUARD_CALL_RE = /\b((?:[\w.]{0,120}\.)?(?:check|verify|validate|assert|require|ensure|guard|sanitiz[e]?|authoriz[e]?)(?:_\w{1,64}|[A-Z]\w{0,63}))\s{0,8}\(/;
+
+/** A call that forwards caller-controlled options onward: f(..., **kwargs). */
+const FORWARD_INTO_RE = /\b(\w{1,64})\s{0,8}\.\s{0,8}(\w{1,64})\s{0,8}\([^)]{0,400}(?:\*\*|\.{3})\w{1,64}/g;
+
+/** At least this many neighbours must already guard before absence means anything. */
+export const MIN_GUARDED_SIBLINGS = 3;
+/** And they must be the majority, not a vocal minority. */
+export const MIN_GUARDED_RATIO = 0.5;
+
+/**
+ * Split Python source into function units: name, signature, body, line.
+ * Indentation-based, matching the language; a unit ends at the next `def` at
+ * any indent, which is sufficient for the sibling comparison this makes.
+ */
+export function pythonUnits(code) {
+  const lines = code.split('\n');
+  const units = [];
+  let cur = null;
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^(\s{0,200})(?:async\s{1,8})?def\s{1,8}(\w{1,80})\s{0,8}\(/);
+    if (m) {
+      if (cur) units.push(cur);
+      // Capture the signature across continuation lines by paren balance.
+      let j = i, depth = 0, sig = '';
+      do {
+        sig += lines[j];
+        depth += (lines[j].match(/\(/g) || []).length - (lines[j].match(/\)/g) || []).length;
+        j++;
+      } while (depth > 0 && j < lines.length && j < i + 40);
+      cur = { name: m[2], indent: m[1].length, line: i + 1, sig, body: [] };
+    } else if (cur) {
+      cur.body.push(lines[i]);
+    }
+  }
+  if (cur) units.push(cur);
+  return units.map(u => ({ ...u, body: u.body.join('\n') }));
+}
+
+/**
+ * Split brace-language source into function units.
+ *
+ * Recognises the four shapes that carry a guard-then-forward convention in
+ * JS/TS: `function name(...)`, `name(...) {` class methods, `name = (...) =>`,
+ * and `async` variants of each. The body is taken by brace matching from the
+ * opening `{`, which is sufficient for the sibling comparison this makes —
+ * this is a convention comparator, not a parser.
+ *
+ * 6 of the 10 known sibling-omission entries are TypeScript, and were
+ * unreachable while this module was Python-only.
+ */
+export function jsUnits(code) {
+  const units = [];
+  const lines = code.split('\n');
+  const DECL = /(?:^|\s)(?:(?:async\s{1,4})?function\s{1,4}(\w{1,80})\s{0,4}\(|(?:public|private|protected|static|async)\s{1,4}(\w{1,80})\s{0,4}\(|(?:const|let|var)\s{1,4}(\w{1,80})\s{0,4}=\s{0,4}(?:async\s{1,4})?\(|^\s{0,80}(\w{1,80})\s{0,4}\([^)]{0,400}\)\s{0,4}\{)/;
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(DECL);
+    if (!m) continue;
+    const name = m[1] || m[2] || m[3] || m[4];
+    if (!name || /^(?:if|for|while|switch|catch|return|typeof|new)$/.test(name)) continue;
+    // Signature: from the decl to the first `{` (may span lines).
+    let sig = '', j = i, open = -1;
+    for (; j < lines.length && j < i + 20; j++) {
+      sig += lines[j];
+      const k = lines[j].indexOf('{', j === i ? m.index : 0);
+      if (k !== -1) { open = j; break; }
+    }
+    if (open === -1) continue;
+    // Body by brace matching from `open`.
+    let depth = 0, body = [], done = false;
+    for (let b = open; b < lines.length && !done; b++) {
+      const text = lines[b];
+      for (const ch of text) { if (ch === '{') depth++; else if (ch === '}') { depth--; if (depth === 0) { done = true; break; } } }
+      body.push(text);
+    }
+    units.push({ name, line: i + 1, sig, body: body.join('\n') });
+    i = open;
+  }
+  return units;
+}
+
+/**
+ * The core, pure analysis. Takes units from the WHOLE PROJECT — each tagged
+ * with its file — and reports sites that skip the guard their peers apply.
+ *
+ * WHY PROJECT-SCOPED, NOT PER-FILE. The first version analysed one file at a
+ * time and measured 1 of 10 against its own exit gate. Diagnosis: the
+ * convention is a property of the CODEBASE, not of a file.
+ * `Git.check_unsafe_options` is called from git/repo/base.py (5 sites),
+ * git/index/base.py (2) and git/objects/commit.py (1) — project-wide an
+ * unambiguous 8-site convention, but per-file it fragments into populations of
+ * 5, 2 and 1, and only the first clears MIN_GUARDED_SIBLINGS. Lowering the
+ * threshold would have been the wrong fix: it weakens the precision control
+ * everywhere instead of restoring the population that genuinely exists.
+ */
+export function analyseUnits(units) {
+  // receiver -> { guarded: [...], unguarded: [...] }
+  const groups = new Map();
+  for (const u of units) {
+    // Python `**kwargs` / JS `...opts` — the option bag this compares on.
+    if (!/\*\*\w+|\.{3}\w/.test(u.sig)) continue;
+    const forwards = [...u.body.matchAll(FORWARD_INTO_RE)];
+    if (!forwards.length) continue;                          // never forwards it on
+    const guard = u.body.match(GUARD_CALL_RE);
+    for (const f of forwards) {
+      const receiver = f[1];
+      // `self.<method>` delegates to a sibling; the guard, if any, belongs to
+      // that sibling. Grouping on it would compare a method against itself
+      // one hop away.
+      if (receiver === 'self' || receiver === 'cls' || receiver === 'this') continue;
+      if (!groups.has(receiver)) groups.set(receiver, { guarded: [], unguarded: [] });
+      const g = groups.get(receiver);
+      const key = `${u.file}::${u.name}`;
+      const row = { name: u.name, line: u.line, file: u.file, into: `${f[1]}.${f[2]}` };
+      if (guard) { if (!g.guarded.some(x => `${x.file}::${x.name}` === key)) g.guarded.push({ ...row, guard: guard[1] }); }
+      else if (!g.unguarded.some(x => `${x.file}::${x.name}` === key)) g.unguarded.push(row);
+    }
+  }
+
+  const out = [];
+  for (const [receiver, g] of groups) {
+    if (g.guarded.length < MIN_GUARDED_SIBLINGS) continue;
+    const total = g.guarded.length + g.unguarded.length;
+    if (g.guarded.length / total < MIN_GUARDED_RATIO) continue;
+    const tally = new Map();
+    for (const x of g.guarded) tally.set(x.guard, (tally.get(x.guard) || 0) + 1);
+    const consensusGuard = [...tally.entries()].sort((a, b) => b[1] - a[1])[0][0];
+    for (const u of g.unguarded) {
+      out.push({
+        ...u, receiver, consensusGuard,
+        guardedSiblings: g.guarded.map(x => (x.file === u.file ? x.name : `${x.file}:${x.name}`)),
+        ratio: g.guarded.length / total,
+      });
+    }
+  }
+  return out;
+}
+
+function _finding(d) {
+  return {
+    id: `convention-deviation:guard-omitted:${d.file}:${d.line}:${d.name}`,
+    file: d.file, line: d.line,
+    vuln: `Convention deviation — ${d.name}() forwards caller-controlled options to ${d.into} without the ${d.consensusGuard}() guard its peers apply`,
+    severity: 'medium',
+    cwe: 'CWE-88',
+    family: 'convention-deviation',
+    parser: 'CONVENTION',
+    confidence: 0.55,
+    description:
+      `${d.guardedSiblings.length} other method(s) in this project — ${d.guardedSiblings.slice(0, 6).join(', ')} — call ` +
+      `${d.consensusGuard}() before forwarding an option bag to ${d.receiver}.*, and ${d.name}() does not. ` +
+      'Where those options become command-line flags, an unvalidated option bag lets a caller inject flags the ' +
+      'author never intended (arbitrary file read/write, or code execution via a hook-installing flag).',
+    remediation:
+      `Apply the same guard the neighbouring methods use — ${d.consensusGuard}() — to ${d.name}()'s options before ` +
+      'forwarding them, or document why this call site is exempt.',
+    checkedFor: `${d.consensusGuard}() call in ${d.name}(); compared against ${d.guardedSiblings.length} peer(s) forwarding into ${d.receiver}.*`,
+    evidenceSiblings: d.guardedSiblings,
+  };
+}
+
+/**
+ * Project-level entry point. `fileContents` is the engine's `fc` map
+ * (path -> source), so the convention population spans the whole codebase.
+ */
+export function scanConventionDeviationProject(fileContents) {
+  if (!fileContents || typeof fileContents !== 'object') return [];
+  const units = [];
+  for (const [file, raw] of Object.entries(fileContents)) {
+    if (!raw || typeof raw !== 'string' || raw.length > 500_000) continue;
+    const isPy = PY_RE.test(file), isJs = JS_RE.test(file);
+    if (!isPy && !isJs) continue;
+    // Cheap relevance gate: the option-bag spread this detector compares on.
+    if (isPy && !/\*\*\w+/.test(raw)) continue;
+    if (isJs && !/\.{3}\w/.test(raw)) continue;
+    try {
+      const us = isPy ? pythonUnits(blankComments(raw, 'py')) : jsUnits(blankComments(raw));
+      for (const u of us) units.push({ ...u, file, lang: isPy ? 'py' : 'js' });
+    } catch { /* per-file best-effort, same as every other detector here */ }
+  }
+  if (!units.length) return [];
+  try { return analyseUnits(units).map(_finding); } catch { return []; }
+}
+
+/** Single-file convenience wrapper — the project view of one file. */
+export function scanConventionDeviation(file, raw) {
+  return scanConventionDeviationProject({ [file]: raw });
+}
+
+export const _internals = { GUARD_CALL_RE, FORWARD_INTO_RE, pythonUnits, jsUnits, analyseUnits };

package/src/sast/fastapi-hardening.js

@@ -9,6 +9,8 @@
 //   6. HTTPBearer used without auto_error checks
 //   7. app.add_middleware(TrustedHostMiddleware, allowed_hosts=["*"])
 
+import { routeAuthEvidence } from './_auth-signals.js';
+
 const _PY_RE = /\.py$/i;
 
 function _line(raw, idx) {
@@ -76,12 +78,46 @@ export function scanFastapiHardening(file, raw) {
   }
 
   // 3. Mutating endpoint without Depends() injecting security
-  const mutatingRouteRe = /@\s*(?:app|router)\.(?:post|put|patch|delete)\s*\(\s*['"][^'"]+['"][^)]*\)\s*(?:async\s+)?def\s+(\w+)\s*\(([^)]*)\)/g;
+  //
+  // PRD T1.2 — this rule previously keyed on a CLOSED list of blessed
+  // dependency names (get_current_user|require_auth|verify_jwt|require_admin|
+  // oauth2_scheme) and never looked at the handler BODY at all. Measured
+  // consequence (independent-population entry GHSA-3cg5-48j3-v4gv): it
+  // asserted that a handler declaring `user=Depends(get_verified_user)` and
+  // calling `await check_folders_permission(request, user, db=db)` had no auth
+  // dependency. Both halves now go through the shared resolver in
+  // _auth-signals.js, which recognises the SHAPE rather than an enumeration.
+  // The parameter list is captured by BALANCED paren matching, not `[^)]*`.
+  //
+  // T2.1 audit finding, against this rule's own earlier fix: FastAPI
+  // signatures routinely contain nested parens as parameter DEFAULTS —
+  // `delete_file: bool = Query(True)` — and `[^)]*` stops at the first `)`,
+  // truncating the capture BEFORE the auth dependency that usually follows.
+  // Measured: all 8 surviving missing-auth findings across the cached
+  // independent population were on handlers that visibly declare
+  // `user=Depends(get_verified_user)`, which the truncated capture never saw.
+  const mutatingRouteRe = /@\s*(?:app|router)\.(?:post|put|patch|delete)\s*\([^\n]{0,300}\n?[^\n]{0,300}?\)\s*(?:async\s+)?def\s+(\w+)\s*\(/g;
   for (const m of raw.matchAll(mutatingRouteRe)) {
-    const params = m[2];
-    // Look for Security(...) or Depends(...) pointing at an auth dep, or a current_user param.
-    if (/\b(?:Security\s*\(|Depends\s*\(\s*(?:get_current_user|require_auth|verify_jwt|require_admin|oauth2_scheme))/.test(params)) continue;
-    if (/\b(?:current_user|user\s*:\s*User|token\s*:\s*str\s*=\s*Depends)/.test(params)) continue;
+    // Walk from the '(' that opened the signature to its true partner.
+    const sigOpen = m.index + m[0].length - 1;
+    let depth = 0, sigClose = -1;
+    for (let i = sigOpen; i < raw.length && i < sigOpen + 4000; i++) {
+      const ch = raw[i];
+      if (ch === '(') depth++;
+      else if (ch === ')') { depth--; if (depth === 0) { sigClose = i; break; } }
+    }
+    if (sigClose === -1) continue;
+    const params = raw.slice(sigOpen + 1, sigClose);
+    // The handler body: from the end of the signature to the next top-level
+    // decorator/def, so an authorization call inside THIS handler counts and
+    // one in the next handler does not.
+    const rest = raw.slice(sigClose + 1);
+    const nextHandler = rest.search(/\n@\s{0,8}(?:app|router)\.|\n(?:async\s{1,8})?def\s{1,8}/);
+    const body = nextHandler === -1 ? rest : rest.slice(0, nextHandler);
+
+    const evidence = routeAuthEvidence({ params, body });
+    if (evidence) continue;
+
     findings.push({
       id: `fastapi:no-auth-dep:${file}:${_line(raw, m.index)}:${m[1]}`,
       file, line: _line(raw, m.index),
@@ -90,8 +126,11 @@ export function scanFastapiHardening(file, raw) {
       family: 'fastapi-missing-auth',
       cwe: 'CWE-862',
       confidence: 0.7,
-      description: 'A POST/PUT/PATCH/DELETE handler is declared without a Security(...) or Depends(get_current_user) parameter. Unless a global middleware enforces auth (rare), this endpoint is callable anonymously.',
+      description: 'A POST/PUT/PATCH/DELETE handler is declared without a Security(...) or Depends(get_current_user) parameter, and its body performs no recognisable authorization check. Unless a global middleware enforces auth (rare), this endpoint is callable anonymously.',
       remediation: 'Add: current_user: User = Depends(get_current_user) — or Security(oauth2_scheme, scopes=["admin"]) — as a parameter to the route handler.',
+      // T2.2 — an absence-claim must record what it looked for, so a reviewer
+      // (or a refutation lens) can falsify it.
+      checkedFor: 'Depends()/Security() auth dependency in the signature; authorization call or explicit 401/403 in the body',
     });
   }
 

package/src/sast/file-upload.js

@@ -14,6 +14,16 @@
 //     sanitizer (basename / uuid / randomUUID / sanitize / whitelist) nearby.
 // A validated upload (fileFilter+limits, or a generated/sanitized name) does
 // NOT match.
+//
+// Content-type spoofing subfamily (client-mimetype-trusted): the client-
+// supplied `.mimetype` (multer/Express) is trusted as the stored/served
+// Content-Type with no derivation from the actual file extension — an
+// attacker who names a file `shell.php` but sets its multipart Content-Type
+// to `image/png` gets that lie stored and later served back as truth. This
+// is a distinct CWE-434 subtype from the filename-as-path-traversal one
+// above (found via CVE-2026-70490, GHSA-944x-pm95-3jpr: Ghost's file-serving
+// endpoint stored `type: frame.file.mimetype` verbatim instead of deriving
+// it from the on-disk filename via `mime.lookup()`).
 import { blankComments } from './_comment-strip.js';
 
 const JS_EXT = /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i;
@@ -23,6 +33,10 @@ const _lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
 const _snip = (raw, line) => (raw.split('\n')[line - 1] || '').trim().slice(0, 200);
 // A sanitizer for the destination filename anywhere in the ±6-line window.
 const NAME_SANITIZER = /\b(?:basename|randomUUID|uuidv4|uuid4|uuid\.v4|nanoid|sanitize[-_]?filename|sanitizeFilename|slugify|crypto\.random|secure_filename|werkzeug)\b/i;
+// A client-supplied `.mimetype` assigned straight to a `type:`-ish stored/
+// served field, with no extension-derived lookup nearby.
+const MIMETYPE_TO_TYPE_FIELD = /\btype\s*:\s*\S*\.mimetype\b/;
+const MIMETYPE_DERIVED = /\b(?:mime\.lookup|mime\.getType|mimeTypes\.lookup|mimetypes\.guess_type)\s*\(/i;
 
 function _window(raw, line, half = 6) {
   const lines = raw.split('\n');
@@ -82,6 +96,20 @@ function scanJs(file, raw, code, out, seen) {
       'The uploaded file is written using its client-controlled name. An attacker can choose the extension (upload `shell.php`) or embed path traversal (`../../etc/x`) to escape the upload directory.',
       'Never trust the uploaded filename. Generate a server-side name (uuid/nanoid) and validate the extension against an allow-list; write with path.basename() into a fixed directory outside the web root.'));
   }
+
+  // 3) Client-supplied `.mimetype` trusted as the stored/served Content-Type,
+  //    with no derivation from the actual file extension (content-type
+  //    spoofing — an attacker can name a file `shell.php` but set its
+  //    multipart Content-Type to `image/png`).
+  for (let i = 0; i < lines.length; i++) {
+    if (!MIMETYPE_TO_TYPE_FIELD.test(lines[i])) continue;
+    const line = i + 1;
+    if (MIMETYPE_DERIVED.test(_window(raw, line))) continue; // derived from extension → safe
+    push(line, mk(file, raw, line, 'client-mimetype-trusted', 'medium',
+      'Unrestricted file upload — client-supplied mimetype trusted as the stored Content-Type',
+      'The uploaded file\'s Content-Type is taken directly from the client-supplied `.mimetype` and stored/served as-is. An attacker can upload a malicious file (e.g. `shell.php`) while claiming an innocuous Content-Type (`image/png`), and later requests will trust that lie.',
+      'Derive the served Content-Type from the actual file extension (e.g. `mime.lookup(filename)`), never from the client-supplied multipart Content-Type header.'));
+  }
 }
 
 function scanPy(file, raw, code, out, seen) {
@@ -108,7 +136,7 @@ export function scanFileUpload(fp, raw) {
   const isJs = JS_EXT.test(fp), isPy = PY_EXT.test(fp);
   if (!isJs && !isPy) return [];
   // Cheap relevance gate — skip files with no upload surface.
-  if (!/\b(?:multer|originalname|req\.files|UploadFile|\.filename|createWriteStream|\.mv\s*\()/i.test(raw)) return [];
+  if (!/\b(?:multer|originalname|req\.files|UploadFile|\.filename|\.mimetype|createWriteStream|\.mv\s*\()/i.test(raw)) return [];
   const code = blankComments(raw, isPy ? 'py' : null);
   const out = [];
   const seen = new Set();

package/src/sast/ownership-authz.js

@@ -0,0 +1,245 @@
+// PRD Theme 5 (T5.1–T5.4) — business-logic authorization.
+//
+// The largest single family in the evidence table: 19 of the 96 root-caused
+// real-world misses. Not injection, not missing authentication — the caller IS
+// authenticated, and the handler simply never checks that the object it is
+// about to read or mutate belongs to them.
+//
+// Why the existing rules miss these (each verified against the real entries):
+//   - api-authz.js works at ROUTE-INVENTORY granularity, comparing which
+//     routes carry auth middleware. These handlers all have auth.
+//   - authz.js's multi-tenant rule requires a literal ORM `where: {...}`
+//     clause in the same file. The real code forwards the id to a service
+//     layer (`identityManager.getCustomer(customerId)`), or uses TypeORM's
+//     `findOneBy`, neither of which matches.
+//   - business-logic.js's id heuristic recognises only `id`/`userId`; the real
+//     parameters are `credentialId`, `subscriptionId`, `chatflowId`.
+//
+// Four sub-rules, one per shape found in the evidence:
+//   T5.1 ownership-missing  — a request-supplied object id reaches a lookup or
+//        mutation and nothing in the handler compares the result (or the
+//        query) against an identity derived from the authenticated principal.
+//   T5.2 tenant-scope-missing — a lookup by primary key in a codebase that
+//        elsewhere always scopes by workspace/org/tenant.
+//   T5.3 branch-inconsistent-authz — one branch of a handler checks
+//        permission and a sibling branch performs the same action without it.
+//   T5.4 lifecycle-gate-missing — a state-changing action on a resource that
+//        carries a status/archived/deleted field, with no check of it.
+//
+// Every sub-rule names the control its advisory's fix added, and goes silent
+// when that control is present.
+import { blankComments } from './_comment-strip.js';
+
+const SRC_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs|py)$/i;
+
+/** A handler that receives a request. */
+const HANDLER_RE =
+  /\b(?:async\s{1,4})?(?:function\s{1,4})?(\w{1,60})\s{0,4}\([^)]{0,300}\b(?:req|request|ctx|event)\b[^)]{0,300}\)\s{0,4}(?:=>\s{0,4})?\{/g;
+
+/**
+ * An object identifier read off the request — ANY *Id name, not just `id`.
+ *
+ * Three surface forms, all seen in the real entries. The DESTRUCTURING form is
+ * what the code this rule was designed from actually uses
+ * (`const { customerId } = req.query`), and the first version of this rule
+ * matched only member access — which is why it returned zero findings on its
+ * own target entry.
+ */
+const REQ_ID_RE =
+  /\b(?:req|request|ctx)\s{0,2}\.\s{0,2}(?:params|query|body|args)\s{0,2}(?:\.\s{0,2}(\w{0,40}[iI]d)\b|\[\s*['"](\w{0,40}[iI]d)['"]\s*\])/g;
+const REQ_ID_DESTRUCTURE_RE =
+  /(?:const|let|var)\s{1,4}\{([^}]{0,200})\}\s{0,4}=\s{0,4}(?:await\s{1,4})?(?:req|request|ctx)\s{0,2}\.\s{0,2}(?:params|query|body|args)\b/g;
+
+/**
+ * The id is HANDED TO something that acts on it.
+ *
+ * A fixed ORM verb list was the second reason this rule missed its own target:
+ * the real sink is `identityManager.getCustomerWithDefaultSource(customerId)`,
+ * a domain method that matches no generic vocabulary. Any receiver-qualified
+ * call taking the id counts, EXCEPT the response/logging/control shapes below —
+ * echoing an id back to the caller is not acting on the object it names.
+ */
+const NON_ACTING_RECEIVER_RE = /^(?:res|response|reply|ctx|console|logger|log|next|JSON|Number|String|Boolean|parseInt|Array|Object)$/i;
+/** Index of the acting call within `body`, or -1. Line attribution needs the
+ * SINK, not the handler's opening brace — GHSA-2364's fix lands 8 lines into
+ * the body, well outside the ±3 localization window a handler-line finding
+ * would need to land in. */
+function _usesIdAt(body, id) {
+  const esc = id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const re = new RegExp(`\\b(\\w{1,60})\\s{0,4}\\.\\s{0,4}\\w{1,60}\\s{0,4}\\([^)]{0,200}\\b${esc}\\b`, 'g');
+  let m;
+  while ((m = re.exec(body))) if (!NON_ACTING_RECEIVER_RE.test(m[1])) return m.index;
+  return -1;
+}
+function _usesId(body, id) { return _usesIdAt(body, id) !== -1; }
+
+/** Evidence the caller's identity constrains the operation. */
+const OWNERSHIP_RE = new RegExp([
+  // Compared against the principal.
+  '\\b(?:req|request|ctx)\\s{0,2}\\.\\s{0,2}(?:user|auth|principal|session)\\b',
+  '\\b(?:current_?user|currentUser|authUser|viewer|me)\\b',
+  // Or the query itself is scoped.
+  '\\b(?:user_?id|owner_?id|userId|ownerId|createdBy|author_?id)\\s{0,4}[:=]',
+].join('|'), 'i');
+
+/** Tenant dimension — the T5.2 control. */
+const TENANT_RE = /\b(?:workspace_?id|workspaceId|org_?id|orgId|organization_?id|tenant_?id|tenantId|account_?id|accountId)\b/i;
+
+/** An explicit authorization call — T5.3's control. */
+const PERMISSION_CALL_RE =
+  /\b(?:has_?permission|hasPermission|check_?permission|checkPermission|checkAnyPermission|require_?permission|can\w{0,20}|authorize\w{0,10}|assert\w{0,20}(?:Access|Permission)|verify\w{0,20}Access)\s{0,4}\(/i;
+
+/** Lifecycle fields whose state should gate a mutation — T5.4. */
+const LIFECYCLE_FIELD_RE = /\b(?:status|state|archived|is_?archived|deleted|is_?deleted|active|is_?active|expired|published|revoked)\b/i;
+const STATE_CHANGE_RE = /\.(?:update|delete|remove|destroy|save|redeem|activate|apply|execute|publish)\s{0,4}\(/;
+
+const _lineOf = (raw, i) => raw.slice(0, i).split('\n').length;
+
+/** Body of a handler, by brace matching from its opening `{`. */
+function _bodyFrom(code, openIdx) {
+  let depth = 0;
+  for (let i = openIdx; i < code.length && i < openIdx + 20000; i++) {
+    const ch = code[i];
+    if (ch === '{') depth++;
+    else if (ch === '}') { depth--; if (depth === 0) return code.slice(openIdx, i + 1); }
+  }
+  return code.slice(openIdx, openIdx + 4000);
+}
+
+function mk(file, line, sub, cwe, vuln, description, remediation, checkedFor) {
+  return {
+    id: `ownership-authz:${sub}:${file}:${line}`,
+    file, line, vuln,
+    severity: 'high',
+    cwe,
+    family: 'broken-access-control',
+    subfamily: sub,
+    parser: 'OWNERSHIP-AUTHZ',
+    confidence: 0.5,
+    description, remediation, checkedFor,
+  };
+}
+
+export function scanOwnershipAuthz(file, raw) {
+  if (!raw || typeof raw !== 'string' || raw.length > 500_000) return [];
+  if (!SRC_RE.test(file)) return [];
+  if (!/\b(?:req|request|ctx)\b/.test(raw)) return [];          // cheap relevance gate
+  const code = blankComments(raw, /\.py$/i.test(file) ? 'py' : null);
+
+  // Does this FILE establish a tenant convention at all? T5.2 only means
+  // something where the codebase demonstrably scopes by tenant elsewhere.
+  const fileUsesTenant = TENANT_RE.test(code);
+
+  const out = [];
+  const seen = new Set();
+  const push = (f) => { const k = `${f.subfamily}:${f.line}`; if (!seen.has(k)) { seen.add(k); out.push(f); } };
+
+  HANDLER_RE.lastIndex = 0;
+  let h;
+  while ((h = HANDLER_RE.exec(code))) {
+    const name = h[1];
+    const openIdx = code.indexOf('{', h.index + h[0].length - 1);
+    if (openIdx === -1) continue;
+    const body = _bodyFrom(code, openIdx);
+    const line = _lineOf(code, h.index);
+
+    REQ_ID_RE.lastIndex = 0;
+    REQ_ID_DESTRUCTURE_RE.lastIndex = 0;
+    const ids = [...body.matchAll(REQ_ID_RE)].map(m => m[1] || m[2]).filter(Boolean);
+    for (const d of body.matchAll(REQ_ID_DESTRUCTURE_RE)) {
+      for (const part of String(d[1]).split(',')) {
+        const nm = part.split(':').pop().trim();
+        if (/^\w{0,40}[iI]d$/.test(nm)) ids.push(nm);
+      }
+    }
+    // Aliases: `const x = req.params.credentialId` then `repo.findOneBy({id: x})`.
+    // The rewrite keyed on the id NAME appearing at the call, which the old
+    // verb-list check handled implicitly; without this an aliased id is missed.
+    const names = [...ids];
+    for (const id of ids) {
+      const esc = id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+      for (const a of body.matchAll(new RegExp(`(?:const|let|var)\\s{1,4}(\\w{1,60})\\s{0,4}=[^\\n]{0,80}\\b${esc}\\b`, 'g'))) names.push(a[1]);
+    }
+    // Attribute the finding to where the id is actually USED, not the handler
+    // declaration — a fix inserted mid-body would otherwise sit well outside
+    // any localization window keyed to the finding's line.
+    let sinkIdx = -1;
+    for (const n of names) {
+      const idx = _usesIdAt(body, n);
+      if (idx !== -1) { sinkIdx = idx; break; }
+    }
+    const touchesObject = sinkIdx !== -1;
+    const sinkLine = touchesObject ? _lineOf(code, openIdx + sinkIdx) : line;
+
+    // T5.1 — an object id from the request reaches a lookup/mutation and
+    // nothing ties the operation to the authenticated principal. TENANT_RE is
+    // checked too, not just OWNERSHIP_RE: GHSA-r745-8hwv-h473's /authorize
+    // handler scopes its lookup by `workspaceId` (from
+    // getActiveWorkspaceIdForRequest(req)) with no per-user ownership
+    // predicate at all — workspace/tenant scoping IS an ownership check at a
+    // coarser grain, and a rule that can't see that flags well-guarded
+    // multi-tenant code as vulnerable. The sibling /refresh handler in the
+    // same file, which has neither, still fires correctly.
+    if (ids.length && touchesObject && !OWNERSHIP_RE.test(body) && !TENANT_RE.test(body)) {
+      push(mk(file, sinkLine, 'ownership-missing', 'CWE-639',
+        `${name}() looks up or mutates by request-supplied '${ids[0]}' with no ownership check`,
+        `The object identifier '${ids[0]}' comes straight from the request and is used to read or change a record, `
+        + 'but nothing in this handler compares that record — or constrains the query — against the authenticated '
+        + 'caller. Authentication alone does not help here: any logged-in user can substitute another user\'s id. '
+        + 'This is the shape route-level authz rules cannot see, because the route IS authenticated.',
+        'Scope the lookup by the caller (add the principal\'s id to the query), or fetch first and compare the '
+        + 'record\'s owner against the authenticated user before acting on it.',
+        'a comparison against req.user/current_user, or an owner/tenant predicate in the query'));
+    }
+
+    // T5.2 — tenant-scoped codebase, unscoped lookup.
+    // An explicit ownership assertion IS scoping. Without this, T5.2 simply
+    // takes over from T5.1 the moment the maintainer's fix lands, and the
+    // entry never discriminates — observed on GHSA-2364's post/ revision,
+    // where assertStripeIdMatchesSession(id, req.user...) silenced T5.1 and
+    // T5.2 immediately fired in its place.
+    if (fileUsesTenant && ids.length && touchesObject && !TENANT_RE.test(body) && !OWNERSHIP_RE.test(body)) {
+      push(mk(file, sinkLine, 'tenant-scope-missing', 'CWE-863',
+        `${name}() queries by id without the workspace/tenant scope this file uses elsewhere`,
+        'Other code in this file constrains queries by a workspace/organization/tenant dimension; this handler '
+        + 'looks up by primary key alone. In a multi-tenant system that returns records belonging to other '
+        + 'tenants whenever an id can be guessed or enumerated.',
+        'Add the tenant dimension to the query, the same way the neighbouring handlers do.',
+        'a workspace/org/tenant predicate inside this handler, given the file uses one elsewhere'));
+    }
+
+    // T5.3 — one branch authorizes, a sibling performs the same action bare.
+    if (PERMISSION_CALL_RE.test(body)) {
+      const branches = body.split(/\belse\b|\belif\b/);
+      if (branches.length > 1) {
+        const guarded = branches.filter(b => PERMISSION_CALL_RE.test(b)).length;
+        const acting = branches.filter(b => STATE_CHANGE_RE.test(b)).length;
+        if (guarded < acting) {
+          push(mk(file, line, 'branch-inconsistent-authz', 'CWE-862',
+            `${name}() checks permission on one branch but acts without it on another`,
+            'This handler performs an authorization check in one branch and performs the same class of '
+            + 'state-changing action in a sibling branch that has no such check. Whichever path skips the check '
+            + 'is reachable by choosing the input that selects it.',
+            'Hoist the authorization check above the branch so every path is covered, or repeat it on each '
+            + 'acting branch.',
+            'a permission call on every branch that performs a state-changing action'));
+        }
+      }
+    }
+
+    // T5.4 — mutate a resource whose lifecycle state is never consulted.
+    if (STATE_CHANGE_RE.test(body) && LIFECYCLE_FIELD_RE.test(code) && !LIFECYCLE_FIELD_RE.test(body)) {
+      push(mk(file, line, 'lifecycle-gate-missing', 'CWE-863',
+        `${name}() acts on a resource without checking its lifecycle state`,
+        'This handler performs a state-changing action on a record whose type carries a lifecycle field '
+        + '(status/archived/deleted/expired — used elsewhere in this file) without consulting it. An archived, '
+        + 'revoked or already-consumed record can therefore still be acted on.',
+        'Check the resource\'s lifecycle state before acting, and reject the request when it is not in a state '
+        + 'that permits the action.',
+        'a status/archived/deleted check inside this handler, given the file uses one elsewhere'));
+    }
+  }
+  return out;
+}
+
+export const _internals = { REQ_ID_RE, REQ_ID_DESTRUCTURE_RE, _usesId, _usesIdAt, OWNERSHIP_RE, TENANT_RE, PERMISSION_CALL_RE, LIFECYCLE_FIELD_RE };

package/src/sast/php.js

@@ -1,3 +1,4 @@
+import { blankComments } from './_comment-strip.js';
 // PHP-specific detectors. Covers the canonical PHP foot-guns:
 //
 //   - $_REQUEST / $_GET / $_POST flowing into eval / system / exec / passthru / shell_exec / `` / popen / proc_open
@@ -37,9 +38,18 @@ const RE = {
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
 
-export function scanPhp(fp, raw) {
+export function scanPhp(fp, rawInput) {
   if (!/\.(?:php|phtml|phar)$/i.test(fp)) return [];
-  if (!raw || raw.length > 500_000) return [];
+  if (!rawInput || rawInput.length > 500_000) return [];
+  // T2.1 audit — this module scanned raw source with NO comment stripping,
+  // which sast/CLAUDE.md names as its first gotcha. Measured cost: the
+  // backtick command-injection rule was the single highest-volume rule across
+  // the independent population (105 findings from 24 entries), and the sampled
+  // ones were PROSE — `// Abort if \`taxonomies\` resource is disabled` — where
+  // backticks quoting a word in English read as PHP's shell-execution
+  // operator. blankComments preserves line numbers, so reported lines are
+  // unaffected.
+  const raw = blankComments(rawInput, 'php');
   const findings = [];
   const seen = new Set();
   const push = (f) => { if (!seen.has(f.id)) { seen.add(f.id); findings.push(f); } };

package/src/sast/rate-limit.js

@@ -93,6 +93,7 @@ function scanRateLimit(file, content) {
       findings.push({
         id: `rate-limit:RATE_LIMIT_${cat.toUpperCase()}:${file}:${lineNum}`,
         title: meta.title,
+        vuln: meta.title,
         severity: meta.severity,
         file, line: lineNum,
         description: meta.description,
@@ -113,6 +114,7 @@ function scanRateLimit(file, content) {
       findings.push({
         id: `rate-limit:RATE_LIMIT_${cat.toUpperCase()}:${file}:${handlerLine}`,
         title: meta.title,
+        vuln: meta.title,
         severity: meta.severity,
         file, line: handlerLine,
         description: meta.description,