@clear-capabilities/agentic-security-scanner 0.139.1 → 0.141.0

package/src/sast/k8s-admission.js

@@ -38,6 +38,33 @@
 
 import { blankComments } from './_comment-strip.js';
 
+// The finding families this module can emit (F10.2 producer registry).
+//
+// Declared HERE, next to the rules, because no external method enumerates them:
+// this module passes `family` POSITIONALLY (`_shape(file, line, ruleId, vuln,
+// fam, ...)`), so a textual search for `family:` finds nothing, and a corpus
+// sweep only ever reports a LOWER BOUND -- it sees whichever families a fixture
+// happened to trigger. This list is the union of both, and
+// `test/family-registry.test.js` fails if a scan produces a family from this
+// module that is not listed.
+//
+// Add the family here in the same edit that adds the rule.
+export const EMITS = [
+  'k8s-pod-security-allow-privesc',
+  'k8s-pod-security-capabilities-broad',
+  'k8s-pod-security-hostnetwork',
+  'k8s-pod-security-hostpath',
+  'k8s-pod-security-hostpid',
+  'k8s-pod-security-privileged',
+  'k8s-pod-security-run-as-root',
+  'k8s-rbac-anonymous',
+  'k8s-rbac-cluster-admin',
+  'k8s-rbac-overbroad-binding',
+  'k8s-rbac-wildcard',
+  'k8s-webhook-bypass',
+  'k8s-webhook-sideeffects',
+];
+
 const _IS_K8S_FILE = /\.(?:yaml|yml)$/i;
 
 function _line(raw, idx) { return raw.slice(0, idx).split('\n').length; }

package/src/sast/ml-supply-chain.js

@@ -30,6 +30,28 @@
 
 import { blankComments } from './_comment-strip.js';
 
+// The finding families this module can emit (F10.2 producer registry).
+//
+// Declared HERE, next to the rules, because no external method enumerates them:
+// this module passes `family` POSITIONALLY (`_shape(file, line, ruleId, vuln,
+// fam, ...)`), so a textual search for `family:` finds nothing, and a corpus
+// sweep only ever reports a LOWER BOUND -- it sees whichever families a fixture
+// happened to trigger. This list is the union of both, and
+// `test/family-registry.test.js` fails if a scan produces a family from this
+// module that is not listed.
+//
+// Add the family here in the same edit that adds the rule.
+export const EMITS = [
+  'gradio-auth',
+  'hf-datasets-rce',
+  'hf-endpoint-override',
+  'mlflow-untrusted-uri',
+  'model-format',
+  'onnx-providers',
+  'prompt-integrity',
+  'streaming-dataset-url',
+];
+
 const _SCAN_EXT_RE = /\.(?:py|ipynb)$/i;
 const _NONPROD_PATH_RE = /(?:^|\/)(?:tests?|__tests__|spec|fixtures?|examples?|docs?|stories|codefixes|node_modules)\//i;
 

package/src/sast/ruby.js

@@ -144,3 +144,135 @@ export function scanRuby(fp, raw) {
   }
   return findings;
 }
+
+// ── PRD F1.3 — `File.join(<root>, …, <untrusted>)` ──────────────────────────
+//
+// The dominant Ruby CWE-22 shape on real code, and the one
+// `pathTraversalStructural` above cannot reach: that rule needs a STRING
+// LITERAL as the first component (`File.read("/data/" + name)`), and the real
+// advisories join variables.
+//
+//   File.join(adapter.document_root, request.path_info.sub(/\.html$/,'') + '.html')
+//     — lsegal/yard, GHSA-pxcc-8665-phx8; the fix rejects `..` segments
+//   File.join(root, tenant, folder_for(key), key)
+//     — basecamp/activerecord-tenanted, GHSA-pmwx-rm49-xv39; the fix raises on
+//       `key.split("/").intersect?(%w[. ..])`
+//
+// Measured baseline before this rule: 23 cached Ruby CWE-22/CWE-79 entries,
+// 0 localized hits, 18 of them producing no finding of any kind.
+//
+// PRECISION IS THE WHOLE DESIGN. The F1.2 attempt at Ruby resource-exhaustion
+// was reverted because it fired on `File.read(File.join(__dir__, "…/data.json"))`
+// — a path built entirely from constants. So:
+//
+//   · the LAST component must be a variable-ish expression, never a literal;
+//   · a join rooted at `__dir__` / `Rails.root` / `File.dirname(__FILE__)` /
+//     `Dir.pwd` is a project-relative constant path and is skipped outright;
+//   · the join must actually reach a filesystem operation, either wrapped
+//     directly or through a variable used by one nearby;
+//   · any containment guard in the enclosing window silences it — that is the
+//     whole vulnerability, so a guard means there is nothing to report.
+//
+// A single `if path.include?("..")` silences this, which is exactly the fix
+// each of these advisories shipped.
+
+// Trailing (?!\w) rather than \b: Ruby predicate methods end in \, and a
+// word boundary after a non-word character never matches, so \
+// silently failed to count as a filesystem operation — the miss that made this
+// rule silent on lsegal/yard's static_caching.rb, one of the two advisories it
+// was written from.
+// Trailing (?!\w) rather than \b. Ruby predicate methods end in `?`, and a word
+// boundary after a non-word character can never match — so `File.file?(x)` did
+// not count as a filesystem operation, and this rule was silent on
+// lsegal/yard's static_caching.rb, one of the two advisories it was written
+// from. The rule looked correct in isolation and found nothing; the bug was one
+// character of regex.
+const RB_FS_OP = /\b(?:File|IO|FileUtils|Dir)\s*\.\s*(?:read|open|new|readlines|binread|binwrite|write|foreach|delete|unlink|mkdir_p|rm_rf|cp|mv|file\?|exist\?|directory\?|entries|glob)(?!\w)/;
+// Constant roots: a path assembled from these is not attacker-reachable.
+const RB_CONST_ROOT = /\b(?:__dir__|__FILE__|Rails\.root|Dir\.pwd|Gem\.dir|File\.dirname\s*\(\s*__FILE__)/;
+// Any of these in the enclosing window means containment was considered.
+const RB_PATH_GUARD = /\b(?:expand_path[\s\S]{0,200}?start_with\?|start_with\?[\s\S]{0,200}?expand_path|include\?\s*\(\s*['"]\.\.|\.\.\s*['"]\s*\)|intersect\?\s*\(\s*%w\[|cleanpath|realpath|File\s*\.\s*basename|sanitize_filename|secure_filename|ValidPath|absolute_path\?)/;
+// A literal argument — the thing that must NOT be the last component.
+const RB_LITERAL_ARG = /^\s*(?:['"][^'"]*['"]|:[A-Za-z_]\w*)\s*$/;
+
+function _splitArgs(s) {
+  const out = [];
+  let depth = 0, cur = '';
+  for (const ch of s) {
+    if (ch === '(' || ch === '[' || ch === '{') depth++;
+    else if (ch === ')' || ch === ']' || ch === '}') depth--;
+    if (ch === ',' && depth === 0) { out.push(cur); cur = ''; continue; }
+    cur += ch;
+  }
+  if (cur.trim()) out.push(cur);
+  return out;
+}
+
+/** File.join(...) whose last component is variable and which reaches the filesystem. */
+export function scanRubyPathJoin(fp, raw) {
+  if (!/\.rb$/i.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw, 'py');
+  const lines = code.split('\n');
+  const out = [];
+  const seen = new Set();
+
+  const JOIN = /\bFile\s*\.\s*join\s*\(/g;
+  let m;
+  while ((m = JOIN.exec(code))) {
+    // Balanced scan for the closing paren of this call.
+    let i = m.index + m[0].length, depth = 1;
+    for (; i < code.length && depth > 0; i++) {
+      if (code[i] === '(') depth++;
+      else if (code[i] === ')') depth--;
+    }
+    if (depth !== 0) continue;
+    const inner = code.slice(m.index + m[0].length, i - 1);
+    const args = _splitArgs(inner);
+    if (args.length < 2) continue;
+    const last = args[args.length - 1];
+    if (RB_LITERAL_ARG.test(last)) continue;                 // File.join(root, "index.html")
+    if (RB_CONST_ROOT.test(inner)) continue;                 // project-relative constant path
+
+    const line = code.slice(0, m.index).split('\n').length;
+
+    // The join must reach the filesystem: wrapped directly, or assigned to a
+    // variable that a nearby filesystem call uses.
+    const before = code.slice(Math.max(0, m.index - 120), m.index);
+    let reaches = RB_FS_OP.test(before);
+    let assigned = null;
+    if (!reaches) {
+      const am = before.match(/([A-Za-z_@][\w]*)\s*=\s*$/);
+      if (am) {
+        assigned = am[1];
+        const after = lines.slice(line, line + 12).join('\n');
+        const use = new RegExp(`${assigned.replace('@', '@')}\\b`);
+        reaches = RB_FS_OP.test(after) && use.test(after);
+      }
+    }
+    if (!reaches) continue;
+
+    // Containment guard anywhere in the enclosing window — that IS the fix.
+    const windowText = lines.slice(Math.max(0, line - 15), line + 15).join('\n');
+    if (RB_PATH_GUARD.test(windowText)) continue;
+
+    const id = `ruby-pathJoinUnguarded:${fp}:${line}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push({
+      id, file: fp, line,
+      vuln: 'Path Traversal: File.join builds a filesystem path from a variable component with no containment check',
+      severity: 'high', cwe: 'CWE-22', family: 'path-traversal',
+      parser: 'RUBY', confidence: 0.7,
+      description:
+        `The last component of this File.join is a variable, the result reaches a filesystem operation, and nothing in ` +
+        `the surrounding code rejects \`..\` segments or asserts the resolved path stays under the base. A value ` +
+        `containing \`../\` walks out of the intended directory.`,
+      remediation:
+        'Reject traversal segments before joining — `raise if key.split("/").intersect?(%w[. ..])` — or canonicalize ' +
+        'and assert containment: `path = File.expand_path(File.join(base, name)); raise unless path.start_with?(base)`.',
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+    });
+  }
+  return out;
+}

package/src/sast/web3-advanced.js

@@ -39,6 +39,32 @@
 
 import { blankComments } from './_comment-strip.js';
 
+// The finding families this module can emit (F10.2 producer registry).
+//
+// Declared HERE, next to the rules, because no external method enumerates them:
+// this module passes `family` POSITIONALLY (`_shape(file, line, ruleId, vuln,
+// fam, ...)`), so a textual search for `family:` finds nothing, and a corpus
+// sweep only ever reports a LOWER BOUND -- it sees whichever families a fixture
+// happened to trigger. This list is the union of both, and
+// `test/family-registry.test.js` fails if a scan produces a family from this
+// module that is not listed.
+//
+// Add the family here in the same edit that adds the rule.
+export const EMITS = [
+  'ecdsa-malleability',
+  'erc4337-validation',
+  'fee-on-transfer-vault',
+  'multicall-delegatecall',
+  'nft-receiver-reentrancy',
+  'oracle-staleness',
+  'read-only-reentrancy',
+  'signature-replay',
+  'solana-anchor-no-owner',
+  'upgradeable-init',
+  'upgradeable-storage',
+  'vyper-raw-call',
+];
+
 function _line(raw, idx) { return raw.slice(0, idx).split('\n').length; }
 function _snip(raw, line) { return (raw.split('\n')[line - 1] || '').trim().slice(0, 200); }
 

package/src/sca/CLAUDE.md

@@ -16,7 +16,7 @@ This directory holds the seven specialized modules called from there.
 | `index.js` | Re-exports six public symbols from `../engine.js` so external consumers can `import { parseManifests, queryOSV, … } from '@…/sca'`. |
 | `binary-metadata.js` | **Opt-in via `AGENTIC_SECURITY_BINARY_SCA=1`.** Reads dependency metadata from compiled artifacts: JAR `META-INF/MANIFEST.MF` + `pom.properties`, Go binary `go.buildinfo`. Never executes the binary. JAR extraction uses `fs.mkdtemp` for an isolated scratch dir (premortem-derived: shared `/tmp` lets a hostile JAR plant a symlinked manifest that escapes the scratch). |
 | `container.js` | Dockerfile parser. Detects EOL `FROM` base images (alpine/debian/ubuntu/node/python) against `base-images.json`, and synthesizes lightweight SCA components from `apt-get install` / `apk add` package lists. No Docker daemon required. |
-| `dep-confusion.js` | Two related detectors. **Typosquat:** Levenshtein distance ≤ 2 against `popular-packages.json` — **188 packages (115 npm + 73 pypi), not "top-1000"** as this row previously said; re-derive the count from the file rather than trusting a hardcoded number here again. **Dependency confusion:** internal-scoped names (declared in `.agentic-security/internal-scopes.yml`) appearing on the public registry. Local-first; **this module does not itself call OSV** — it reads a flag set by an earlier, separate OSV/queryRegistries pass upstream (whether a dep "resolved by OSV"), which is different from "OSV consulted [by this module] to confirm confusion findings" as previously stated. |
+| `dep-confusion.js` | Two related detectors. **Typosquat:** Damerau-Levenshtein distance against `popular-packages.json`, accepted only when `distance / min(nameLen, popularLen) ≤ 0.25` — **188 packages (115 npm + 73 pypi), not "top-1000"** as this row previously said; re-derive the count from the file rather than trusting a hardcoded number here again. **Dependency confusion:** internal-scoped names (declared in `.agentic-security/internal-scopes.yml`) appearing on the public registry. Local-first; **this module does not itself call OSV** — it reads a flag set by an earlier, separate OSV/queryRegistries pass upstream (whether a dep "resolved by OSV"), which is different from "OSV consulted [by this module] to confirm confusion findings" as previously stated. |
 | `llm-function-extract.js` | **Opt-in via `AGENTIC_SECURITY_LLM_SCA=1`.** LLM-assisted extraction of vulnerable function names for CVEs that lack OSV `ecosystem_specific.vulnerable_functions` data. Cached per CVE under `~/.config/agentic-security/llm-sca-cache/`. Endpoint-dependent — degrades to no-op when unreachable. |
 | `py-package-functions.js` | **Opt-in via `AGENTIC_SECURITY_DEEP=1`** (Python only). Locates installed Python packages via `site-packages` and parses them with the CPython `ast` module (subprocess) to *validate* that an OSV-named vulnerable function exists in the installed version. Closes the "OSV says this function is vulnerable, but the version you installed actually removed it" false-positive class. |
 | `vendor-detect.js` | Detects libraries copied into `src/` (lodash, jQuery, Angular, React, etc.) via characteristic version strings and function signatures. Catches the case where a vulnerable library bypasses the lockfile because someone vendored it directly. |
@@ -130,9 +130,26 @@ if a detector forgets to set them.
 - **EOL base-image detection has a hand-curated cutoff.** `base-images.json`
   is updated periodically; an alpine-3.16 today might not appear EOL until
   the file is refreshed. Bias is toward false negatives.
-- **Typosquat threshold is a single distance.** Levenshtein ≤ 2 against
-  the popular-packages.json list (188 entries, not top-1000). Increasing the threshold blows up the FP rate;
-  decreasing it loses real typosquats. This is the calibrated default.
+- **Typosquat similarity is RELATIVE, and that is load-bearing.** The rule is
+  Damerau-Levenshtein ≤ 2 *and* `distance / min(len) ≤ 0.25` against
+  popular-packages.json (188 entries, not top-1000).
+
+  The absolute `Levenshtein ≤ 2` this used to be was measured by
+  `bench/sca-replay` over 13 real repositories and produced **166 findings at
+  critical/high, of which zero were typosquats** — `ms ~ ws`, `acorn ~ cors`,
+  `ajv ~ ava`, `six ~ tox`, `arg ~ yargs`, `bail ~ babel`. All short names: two
+  edits on a four-character name changes half of it, and every two-character
+  package is one edit from every other. The ratio gate is what removes them.
+
+  Damerau rather than plain Levenshtein because a TRANSPOSITION (`lodahs` for
+  `lodash`) is the most common real typo, and plain distance scores it 2 — the
+  same as two unrelated substitutions. Under the ratio gate that would have
+  thrown the genuine cases out along with the noise.
+
+  The FP budget is pinned in `test/dep-confusion.test.js` using the actual
+  names the bench surfaced. Widening the reference list is safe *because* of
+  the ratio gate; widening it under the old rule would have multiplied the
+  noise.
 
 ## Adding a new detector here
 

package/src/sca/container.js

@@ -31,7 +31,16 @@ const _DOCKERFILE_RE = /(?:^|\/)(?:[Dd]ockerfile|[^/]+\.dockerfile)$/i;
 const _FROM_RE = /^\s*FROM\s+(?:--platform=\S+\s+)?([\w./-]+?)(?::([\w.\-]+))?(?:@sha256:[a-f0-9]{64})?(?:\s+AS\s+\S+)?\s*$/im;
 
 // FROM <image>:<tag> covering all FROM lines in the file
-const _ALL_FROM_RE = /^\s*FROM\s+(?:--platform=\S+\s+)?([\w./-]+?)(?::([\w.\-]+))?(?:@sha256:[a-f0-9]{64})?(?:\s+AS\s+\S+)?\s*$/img;
+// The digest is CAPTURED, not merely tolerated. Discarding it made
+// `FROM ubuntu@sha256:…` parse as image=ubuntu with no tag, which `_scoreTag`
+// then treats as `latest` — so the most tightly pinned form a Dockerfile can
+// use was reported as "ubuntu:latest (floating tag)". A false positive on the
+// hardened configuration is worse than a miss: it tells the people who did the
+// right thing that they did the wrong one.
+//
+// Found by bench/iac-coverage, whose verdict-flip scoring exists precisely to
+// catch a rule that fires on both variants of a control.
+const _ALL_FROM_RE = /^\s*FROM\s+(?:--platform=\S+\s+)?([\w./-]+?)(?::([\w.\-]+))?(?:@sha256:([a-f0-9]{64}))?(?:\s+AS\s+\S+)?\s*$/img;
 
 // `apt-get install -y pkg pkg pkg` / `apk add pkg pkg`
 const _APT_INSTALL_RE = /\bapt(?:-get)?\s+install\b[^\n]*?(?:--?[\w-]+\s+)*((?:[a-z0-9][\w.+-]*(?:=[\w.+:-]+)?\s*)+)/gi;
@@ -66,9 +75,17 @@ export function scanContainer(fp, raw) {
   while ((m = _ALL_FROM_RE.exec(raw))) {
     const image = m[1].split('/').pop(); // strip registry / namespace prefixes
     const tag = m[2] || '';
+    const digest = m[3] || '';
     const line = raw.substring(0, m.index).split('\n').length;
+    // Digest-pinned with no tag: there is nothing to score. The reference is
+    // immutable, which is the recommended form, and inventing a `latest` tag
+    // for it produces the exact opposite advice.
+    if (digest && !tag) continue;
     const score = _scoreTag(image, tag);
     if (!score) continue;
+    // `image:22.04@sha256:…` — the tag can still be end-of-life, and that is
+    // worth saying, but it is not a FLOATING tag: the digest pins it.
+    if (digest && !score.eol) continue;
     findings.push({
       id: `container-base:${fp}:${line}:${image}:${tag || 'latest'}`,
       kind: 'container', severity: score.sev,

package/src/sca/dep-confusion.js

@@ -1,6 +1,10 @@
 // 0.9.0 Feat-15: Dependency confusion + typosquat detection (Levenshtein distance against top-1000 npm/PyPI packages).
 //
-// (a) Typosquat: Levenshtein distance 1–2 from a popular package.
+// (a) Typosquat: a small Damerau-Levenshtein distance from a popular package,
+//     where "small" is judged RELATIVE to the name length — see SIMILARITY
+//     below for why the absolute 1–2 this originally used produced 166
+//     critical/high false positives and zero true positives across 13 real
+//     dependency trees.
 // (b) Confusion: internal-scoped names (`@your-org/...`) that also appear on the
 //     public registry — declared via .agentic-security/internal-scopes.yml.
 //
@@ -50,6 +54,64 @@ export function levenshtein(a, b, maxDistance = 2) {
   return prev[b.length];
 }
 
+// Damerau-Levenshtein (optimal string alignment): a TRANSPOSITION costs 1.
+//
+// Plain Levenshtein charges 2 for a transposition, which is exactly backwards
+// for this problem — swapping two adjacent characters (`lodahs` for `lodash`,
+// `electorn` for `electron`) is the single most common real typo, and it is the
+// one plain distance scores as least similar. `levenshtein` above is kept
+// unchanged and separately tested; this is a second measure for a different
+// question.
+export function damerauLevenshtein(a, b, maxDistance = 2) {
+  if (a === b) return 0;
+  if (Math.abs(a.length - b.length) > maxDistance) return maxDistance + 1;
+  const m = a.length, n = b.length;
+  if (!m) return n;
+  if (!n) return m;
+  const d = Array.from({ length: m + 1 }, (_, i) => {
+    const row = new Array(n + 1).fill(0);
+    row[0] = i;
+    return row;
+  });
+  for (let j = 0; j <= n; j++) d[0][j] = j;
+  for (let i = 1; i <= m; i++) {
+    let rowMin = Infinity;
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      let v = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + cost);
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+        v = Math.min(v, d[i - 2][j - 2] + 1);       // transposition
+      }
+      d[i][j] = v;
+      if (v < rowMin) rowMin = v;
+    }
+    if (rowMin > maxDistance) return maxDistance + 1;
+  }
+  return d[m][n];
+}
+
+// How much of a name may differ before it is a DIFFERENT name rather than a
+// misspelling of this one.
+//
+// Measured, not chosen by taste. At the previous "distance 1–2, any length"
+// rule, bench/sca-replay produced these across 13 real repositories:
+//
+//   ms ~ ws (d1)      acorn ~ cors (d2)   ajv ~ ava (d2)     six ~ tox (d2)
+//   abab ~ ava (d2)   arg ~ yargs (d2)    bail ~ babel (d2)  aws4 ~ ws (d2)
+//
+// Every one is a legitimate, popular package, and `ms` is a top-50 npm
+// package. The common factor is length: two edits on a four-character name
+// changes half of it. A quarter of the shorter name is the ceiling — it keeps
+// every genuine shape (one transposition, one dropped char, one doubled char
+// on a name of ordinary length) and rejects all of the above.
+const MAX_DIVERGENCE = 0.25;
+
+function _isTyposquatCandidate(name, popular, distance) {
+  if (distance <= 0) return false;
+  const shorter = Math.min(name.length, popular.length);
+  return distance / shorter <= MAX_DIVERGENCE;
+}
+
 function _loadInternalScopes(scanRoot) {
   if (!scanRoot) return [];
   for (const name of ['internal-scopes.yml', 'internal-scopes.yaml']) {
@@ -84,10 +146,14 @@ export function detectDepConfusion(components, scanRoot) {
     const lowerName = c.name.toLowerCase();
     // (1) Typosquat — only run if the dep is NOT itself in the popular set
     if (!popularSet.has(lowerName)) {
+      // Compare the BARE name. `@scope/react` is not a typosquat of `react`;
+      // the scope is the thing that identifies the publisher.
+      const bare = lowerName.replace(/^@[^/]+\//, '');
       let bestMatch = null, bestDist = 3;
       for (const popular of popularSet) {
-        const d = levenshtein(lowerName, popular, 2);
-        if (d > 0 && d <= 2 && d < bestDist) { bestMatch = popular; bestDist = d; }
+        const d = damerauLevenshtein(bare, popular, 2);
+        if (!_isTyposquatCandidate(bare, popular, d)) continue;
+        if (d < bestDist) { bestMatch = popular; bestDist = d; }
       }
       if (bestMatch) {
         const id = `dep-confusion:${c.ecosystem}:${c.name}@${c.version}:typosquat`;