@clear-capabilities/agentic-security-scanner 0.147.5 → 0.148.1

package/src/posture/threat-model.js

@@ -32,7 +32,13 @@ const ASSET_PATTERNS = [
   // [regex, category, exposure]
   [/(?:stripe|paddle|braintree)\.\w+\.create/g, 'payment-method', 'public-api'],
   [/(?:User|users?)\.create\(|prisma\.user\.create/g, 'identity', 'public-api'],
-  [/(?:session|token|jwt)\s*=\s*/g, 'session', 'internal'],
+  // Real customer false positive: `session = requests.Session()` matched —
+  // the pattern only checked the LHS identifier, so an HTTP CLIENT object
+  // (requests.Session / aiohttp.ClientSession / httpx.Client) got reported
+  // as an "authenticated user session" asset. The negative lookahead
+  // excludes the specific RHS constructor shapes that mean "this is an
+  // outbound HTTP client", not "this holds a logged-in user's session".
+  [/(?:session|token|jwt)\s*=\s*(?!\s*(?:requests\.Session|aiohttp\.ClientSession|httpx\.(?:Client|AsyncClient))\s*\()/g, 'session', 'internal'],
   [/process\.env\.([A-Z_]+(?:KEY|SECRET|TOKEN))/g, 'secret', 'internal'],
   [/(?:aws-sdk|@aws-sdk).*\.upload|s3\.put/g, 'object-storage', 'public-api'],
   [/(?:openai|anthropic|together|groq)\.(?:chat|messages|completions)/g, 'llm-egress', 'external-api'],
@@ -43,8 +49,19 @@ const TRUST_BOUNDARY_PATTERNS = [
   [/router\.(?:get|post|put|patch|delete)\s*\(\s*['"`]([^'"`]+)['"`]/g, 'http-route'],
   [/@(?:Get|Post|Put|Patch|Delete)Mapping\s*\(/g, 'http-route-java'],
   [/@(?:app|router)\.(?:get|post|put|patch|delete)\s*\(\s*['"`]([^'"`]+)['"`]/g, 'http-route-py'],
-  [/(?:kafka|pubsub|sqs|sns)\.consume|\.subscribe|\.receiveMessage/gi, 'queue-consumer'],
-  [/(?:kafka|pubsub|sqs|sns)\.produce|\.publish|\.sendMessage/gi, 'queue-producer'],
+  // Real customer false positive: alternation without a shared group scopes
+  // ONLY the first branch to a queue library — `(?:kafka|pubsub|sqs|sns)\.produce
+  // |\.publish|\.sendMessage` is three TOP-LEVEL alternatives, and the last
+  // two are bare, unscoped substrings. `bundle.publisher_domain` and
+  // `bundle.published_at` both contain the literal substring ".publish" (the
+  // first 8 characters of "publisher"/"published"), so plain field access
+  // with no queue library, and no method call at all, was read as a
+  // queue-producer trust boundary. Moving the method-name alternation
+  // INSIDE the shared `(?:kafka|pubsub|sqs|sns)\.` prefix scopes every
+  // branch to an actual queue client, and requiring a trailing `(` excludes
+  // attribute access from matching a call-shaped rule.
+  [/(?:kafka|pubsub|sqs|sns)\.(?:consume|subscribe|receiveMessage)\s*\(/gi, 'queue-consumer'],
+  [/(?:kafka|pubsub|sqs|sns)\.(?:produce|publish|sendMessage)\s*\(/gi, 'queue-producer'],
   [/grpc\.Server|new\s+Server\s*\(\s*\)/g, 'grpc-server'],
   [/(?:db|pool|client)\.(?:query|execute|raw)\s*\(/g, 'db-edge'],
 ];

package/src/sast/python-sinks.js

@@ -41,7 +41,30 @@ const SQLA_RAW_EXEC_CONCAT_RE = /\b(?:cursor|conn|connection|session)\s*\.\s*exe
 // quotes (single quotes inside double-quoted f-string and vice versa) so we
 // use two parallel patterns rather than a single character class that excludes
 // both quote kinds.
-const SQLA_FSTRING_SQL_ASSIGN_RE = /(?:f"[^"]*(?:SELECT|INSERT|UPDATE|DELETE)[^"]*\{[^}]*\}|f'[^']*(?:SELECT|INSERT|UPDATE|DELETE)[^']*\{[^}]*\})/gi;
+//
+// Two real-world false positives, both from the same underlying defect —
+// this regex checked for a co-occurring keyword-shaped substring and a `{}`
+// interpolation, not an actual SQL statement being assigned:
+//
+//   query = f"SELECT * FROM users WHERE id = {user_id}"   -> should fire
+//   print(f"[{position}] {len(selected)} readable pages")  -> was firing
+//   raise RuntimeError(f"Selected TAR members exceed {N} bytes")  -> was firing
+//
+// Case-insensitive matching with no word boundary let the SQL keyword
+// alternation match inside ordinary English/identifier text — "Select" is
+// the first six letters of "Selected", and "select" is the first six of the
+// variable name "selected". `\b...\b` fixes that: a word boundary requires a
+// non-word/word transition, which does not exist between "Select" and the
+// trailing "ed" (both are word characters), so "Selected"/"selected" no
+// longer match while "SELECT"/"select" as complete tokens still do.
+//
+// The vuln title claims "f-string SQL ASSIGNED TO VARIABLE", but the regex
+// never actually checked for an assignment — it fired on any f-string
+// anywhere, including a bare argument to print()/raise. Requiring
+// `IDENT = ` (optionally through an opening paren, for a wrapped assignment)
+// immediately before the f-string makes the check match what its own name
+// promises, and excludes the print()/raise-message shape entirely.
+const SQLA_FSTRING_SQL_ASSIGN_RE = /\b[A-Za-z_]\w*\s*=\s*\(?\s*(?:f"[^"]*\b(?:SELECT|INSERT|UPDATE|DELETE)\b[^"]*\{[^}]*\}|f'[^']*\b(?:SELECT|INSERT|UPDATE|DELETE)\b[^']*\{[^}]*\})/gi;
 
 // ─── Command injection ────────────────────────────────────────────────────
 //