@clear-capabilities/agentic-security-scanner 0.153.1 → 0.154.0

package/src/pr-delta.js

@@ -26,8 +26,9 @@
 import { spawnSync } from 'node:child_process';
 import { hardenGitArgs, hardenGitEnv } from './util/git-hardening.js';
 import { runFullScan } from './engine.js';
+import { isLanguageManifest, isLanguageExcludedPath } from './language/discovery.js';
 
-const FILE_EXT_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs|py|java|cs|kt|go|rb|php|sol|swift|rs|tf|yml|yaml|json|toml|md)$/i;
+const FILE_EXT_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs|py|java|cs|kt|go|rb|php|sol|swift|rs|tf|yml|yaml|json|toml|md|hs|lhs|hsc|hs-boot|nix|cabal)$/i;
 const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
 
 // `root` is the PR's repository — a scan target, not this project's own
@@ -54,23 +55,27 @@ function _listFilesAtRef(root, ref) {
   return r.stdout.trim().split('\n').filter(p => {
     if (!p) return false;
     if (p.includes('/node_modules/') || p.includes('/.venv/')) return false;
-    return FILE_EXT_RE.test(p);
+    if (isLanguageExcludedPath(p)) return false;
+    return FILE_EXT_RE.test(p) || isLanguageManifest(p);
   });
 }
 
 async function _scanAtRef(root, ref) {
   const files = _listFilesAtRef(root, ref);
   const fileContents = {};
+  const depFileContents = {};
   for (const f of files) {
     const c = _readFileAtRef(root, ref, f);
-    if (c != null) fileContents[f] = c;
+    if (c == null) continue;
+    // Haskell/Nix manifests and lock files are dependency inputs, not code (the same split a working-tree scan makes).
+    if (isLanguageManifest(f)) depFileContents[f] = c; else fileContents[f] = c;
   }
   // `provenance:false` — a base-ref snapshot, not the current working state.
   // Beyond the wasted git walks, updateLifecycle marks every open stableId
   // absent from the finding set it is handed as `remediated`; running the PR
   // delta gate would silently rewrite the project's lifecycle store from the
   // base ref's findings.
-  return runFullScan({ fileContents, scanRoot: root, provenance: false }, () => {});
+  return runFullScan({ fileContents, depFileContents, scanRoot: root, provenance: false }, () => {});
 }
 
 function _summary(findings) {

package/src/report/index.js

@@ -110,6 +110,20 @@ function explainParts(f, { verbose = false } = {}) {
 // <confidence>". Nothing here throws on a partially-populated object; every
 // field access is optional-chained or defaulted, because a provenance record
 // that survived a failure path is exactly the input this has to render.
+// Additive Haskell/Nix finding metadata (src/language/contracts.js). Only keys the finding actually carries.
+const _LANGUAGE_KEYS = ['language', 'capability', 'analysisKind', 'evidenceKind', 'originalLocation', 'generatedLocation', 'scope', 'uncertainty', 'resolutionStatus', 'modelVersion', 'trustBoundary', 'route', 'modelNote', 'controls', 'guardNote', 'rule', 'exposure', 'destination', 'source', 'origins', 'sink', 'protection', 'attrPath', 'bridge', 'applicationFlow', 'secretValue', 'environmentVariable', 'provider', 'rotation', 'llmRole', 'llmContext', 'owaspLlm', 'end2endProof', 'chainNote', 'declaredCapability', 'exercised', 'service', 'subject', 'option', 'optionEvidence', 'locationKind', 'entry', 'ignorePragmaIgnored'];
+// Keys that other detectors already use with a different meaning; passed through only for Haskell/Nix findings.
+const _LANGUAGE_ONLY_KEYS = new Set(['rule', 'source', 'sink', 'destination', 'origins', 'protection', 'exposure', 'service']);
+function languageFields(f) {
+  const out = {};
+  const lang = f.language === 'haskell' || f.language === 'nix';
+  for (const k of _LANGUAGE_KEYS) {
+    if (_LANGUAGE_ONLY_KEYS.has(k) && !lang) continue;
+    if (f[k] !== undefined && f[k] !== null) out[k] = f[k];
+  }
+  return out;
+}
+
 export function explainProvenance(f) {
   const fp = f && f.findingProvenance;
   if (!fp) return null;
@@ -274,6 +288,8 @@ export function normalizeFindings(scan){
       unvalidated: f.unvalidated === true,
       cross_language: f.cross_language === true,
       family: f.family || null,
+      // Haskell/Nix language contract (additive; absent for every other finding, so existing output is unchanged).
+      ...languageFields(f),
       // Premortem #8: surface the parser field so downstream consumers
       // (UI, SARIF, calibration) see the value the engine backfilled.
       parser: f.parser || null,
@@ -527,7 +543,8 @@ export function normalizeFindings(scan){
       cveAliases: sc.cveAliases || [],
       osvId: sc.osvId || null,
       advisory: sc.advisory || sc.description || '',
-      fixedIn: sc.range || null,
+      fixedIn: sc.range || (Array.isArray(sc.fixedIn) && sc.fixedIn.length ? sc.fixedIn : null),
+      ...(Number.isInteger(sc.line) && sc.line > 0 ? { declaringLine: sc.line, declaringFile: sc.file || null } : {}),
       // Feat-9: real-world risk signals
       epssScore: sc.epssScore ?? null,
       epssPercentile: sc.epssPercentile ?? null,
@@ -1034,15 +1051,24 @@ export function toSARIF(scan, meta={}){
         const chain = Array.isArray(f.chain) ? f.chain : [];
         const codeFlows = chain.length >= 2 ? [{
           threadFlows: [{
-            locations: chain.map((hop, idx) => ({
-              location: {
-                physicalLocation: {
-                  artifactLocation: { uri: hop.file || f.file },
-                  region: { startLine: Math.max(1, hop.line || 1) },
+            locations: chain.map((hop, idx) => {
+              // A hop inside a GENERATED script (a shell script a Nix string builds) has coordinates in the script
+              // text, not in the file. It is reported at the nearest ORIGINAL span (the interpolation that feeds it)
+              // and carries its generated position and origin in properties, so no reader mistakes script line 1 for
+              // line 1 of the Nix file.
+              const generated = hop.generated === true;
+              const orig = generated && f.originalLocation && Number.isInteger(f.originalLocation.startLine) ? f.originalLocation : null;
+              const region = orig
+                ? { startLine: Math.max(1, orig.startLine), ...(Number.isInteger(orig.startColumn) ? { startColumn: orig.startColumn + 1 } : {}), ...(Number.isInteger(orig.endLine) ? { endLine: orig.endLine } : {}), ...(Number.isInteger(orig.endColumn) ? { endColumn: orig.endColumn + 1 } : {}) }
+                : { startLine: Math.max(1, hop.line || 1), ...(Number.isInteger(hop.column) ? { startColumn: hop.column + 1 } : {}), ...(Number.isInteger(hop.endLine) ? { endLine: hop.endLine } : {}), ...(Number.isInteger(hop.endColumn) ? { endColumn: hop.endColumn + 1 } : {}) };
+              return {
+                location: {
+                  physicalLocation: { artifactLocation: { uri: hop.file || f.file }, region },
+                  message: { text: `${hop.label || (idx === 0 ? 'source' : idx === chain.length - 1 ? 'sink' : 'propagation')}${generated ? ' [generated script]' : ''}` },
                 },
-                message: { text: hop.label || (idx === 0 ? 'source' : idx === chain.length - 1 ? 'sink' : 'propagation') },
-              },
-            })),
+                ...(generated ? { kinds: ['generated'], properties: { generated: true, generatedLocation: { line: hop.line, ...(Number.isInteger(hop.column) ? { startColumn: hop.column } : {}), ...(Number.isInteger(hop.endLine) ? { endLine: hop.endLine } : {}), ...(Number.isInteger(hop.endColumn) ? { endColumn: hop.endColumn } : {}) }, ...(f.attrPath ? { generatedBy: f.attrPath } : {}) } } : {}),
+              };
+            }),
           }],
         }] : undefined;
         const fixes = f.remediation ? [{

package/src/runScan.js

@@ -9,6 +9,7 @@ import { runFullScan, shouldScan, isKubernetesManifest, isCloudFormationTemplate
 import { appendScanSnapshot } from './posture/security-trend.js';
 import { recover as recoverFixHistory } from './posture/fix-history.js';
 import { stampScan } from './posture/ruleset-version.js';
+import { isLanguageManifest, isLanguageExcludedPath, isLanguageSource, readExplicitExports, WALK_IGNORE_GLOBS, impactedFiles, buildImportGraph, importClosure } from './language/discovery.js';
 
 const DEP_FILE_NAMES = new Set([
   'package.json','package-lock.json','yarn.lock','pnpm-lock.yaml',
@@ -40,6 +41,9 @@ export function isDepFile(rel) {
   if (DEP_FILE_NAMES.has(base)) return true;
   if (REQUIREMENTS_FILE.test(base)) return true;
   if (REQUIREMENTS_DIR_FILE.test(rel.split(path.sep).join('/'))) return true;
+  // Haskell/Nix project manifests (cabal, stack, flake, lockfiles): a change to
+  // any of them moves the global checkpoint key via depFileContents.
+  if (isLanguageManifest(rel) && !isLanguageExcludedPath(rel)) return true;
   return false;
 }
 
@@ -68,18 +72,27 @@ const DEFAULT_IGNORE = [
   '**/dist/**','**/build/**','**/.next/**','**/venv/**','**/env/**','**/.venv/**',
   '**/target/**','**/bin/**','**/obj/**','**/.cache/**','**/coverage/**',
   '**/bower_components/**','**/tests/**','**/test/**','**/__tests__/**','**/spec/**','**/mocks/**',
+  // Haskell/Nix build output and store closures; explicit exports inside them
+  // are read by exact path below, never by walking.
+  ...WALK_IGNORE_GLOBS,
 ];
 
 export async function readTree(root, { ignore = [] } = {}) {
   const entries = await listFiles(root, { ignore: [...DEFAULT_IGNORE, ...ignore] });
   const fileContents = {};
   const depFileContents = {};
+  const oversize = [];
   for (const rel of entries) {
     const abs = path.join(root, rel);
     let stat;
     try { stat = await fs.stat(abs); } catch { continue; }
     const dep = isDepFile(rel);
-    if (stat.size > (dep ? MAX_DEP_BYTES : MAX_CODE_BYTES)) continue;
+    if (stat.size > (dep ? MAX_DEP_BYTES : MAX_CODE_BYTES)) {
+      // A Haskell/Nix source or manifest over the read cap is not analysed. That is a coverage gap a reader must be told about,
+      // not a quiet omission: it is listed (path, size, cap) and reaches scan health as a condition.
+      if (isLanguageSource(rel) || isLanguageManifest(rel)) oversize.push({ file: rel, bytes: stat.size, cap: dep ? MAX_DEP_BYTES : MAX_CODE_BYTES });
+      continue;
+    }
     let content;
     try { content = await fs.readFile(abs, 'utf8'); } catch { continue; }
     const base = path.basename(rel);
@@ -107,7 +120,14 @@ export async function readTree(root, { ignore = [] } = {}) {
     // project index parses key=value lines for cross-file lookup.
     else if (/\.properties$/i.test(rel)) fileContents[rel] = content;
   }
-  return { fileContents, depFileContents };
+  // Explicit Cabal plan / Stack / Nix exports live inside directories the walk
+  // prunes. Read them by exact path next to each project manifest.
+  try {
+    const manifests = Object.keys(depFileContents).concat(Object.keys(fileContents)).filter(isLanguageManifest);
+    const { contents } = readExplicitExports(root, manifests);
+    for (const [rel, text] of Object.entries(contents)) depFileContents[rel] = text;
+  } catch { /* exports are best-effort evidence */ }
+  return { fileContents, depFileContents, oversize };
 }
 
 // Feat-10: incremental scan via `--changed-since <git-ref>`. Returns the set of
@@ -146,6 +166,14 @@ export function changedSince(root, gitRef) {
   }
 }
 
+const POLICY_ONLY_HEAVY = ['**/node_modules/**', '**/.git/**', '**/venv/**', '**/.venv/**', '**/__pycache__/**', ...WALK_IGNORE_GLOBS];
+/** Haskell/Nix sources the default ignore list kept out of the scan (relative paths, sorted, capped). */
+export async function languageFilesIgnoredByPolicy(root, fileContents, depFileContents) {
+  const all = await listFiles(root, { ignore: POLICY_ONLY_HEAVY });
+  const seen = new Set([...Object.keys(fileContents), ...Object.keys(depFileContents)]);
+  return all.filter((rel) => (isLanguageSource(rel) || isLanguageManifest(rel)) && !isLanguageExcludedPath(rel) && !seen.has(rel)).sort().slice(0, 500);
+}
+
 export async function runScan(rootDir, opts = {}) {
   const root = path.resolve(rootDir);
   const startedAt = new Date().toISOString();
@@ -173,6 +201,7 @@ export async function runScan(rootDir, opts = {}) {
   // path added later must opt OUT explicitly rather than silently inherit a
   // false claim of coverage.
   let completeScan = true;
+  let sizeSkipped = [];
   if (opts.fileContents) {
     // Caller-supplied file list (MCP `scan_diff`, the LSP's on-save scan): by
     // construction a subset of the tree, not a scan of it.
@@ -180,16 +209,38 @@ export async function runScan(rootDir, opts = {}) {
     depFileContents = opts.depFileContents || {};
     completeScan = false;
   } else {
-    ({ fileContents, depFileContents } = await readTree(root, opts));
+    ({ fileContents, depFileContents, oversize: sizeSkipped } = await readTree(root, opts));
+  }
+
+  // Haskell/Nix sources under a default-ignored directory (tests, specs, mocks, bin, build, dist, vendor) are not
+  // scanned, exactly as for every other language. That policy is kept, but it is never silent: the files it kept
+  // out are listed and reach scan health as a stated limitation.
+  let policyExcluded = [];
+  if (!opts.fileContents && Object.keys(fileContents).some(isLanguageSource)) {
+    try { policyExcluded = await languageFilesIgnoredByPolicy(root, fileContents, depFileContents); } catch { policyExcluded = []; }
   }
 
   // Feat-10: incremental mode — restrict the scan to files changed since a git ref
   if (opts.changedSince) {
     const changed = changedSince(root, opts.changedSince);
     if (changed) {
+      const keep = new Set(changed);
+      // Haskell and Nix results depend on more than the file that changed: a module that imports a changed module
+      // may now be (or stop being) vulnerable, an effective NixOS value is decided by the modules it imports, and a
+      // lock file, Cabal flags or an explicit export can change every file's verdict. So the scan set is the changed
+      // files, everything that transitively imports one (all language sources for a manifest change), and the import
+      // closure of those as context. A deleted language file or manifest widens to every language source, because
+      // its importers can no longer be found from the tree on disk.
+      const langSources = Object.keys(fileContents).filter(isLanguageSource);
+      if (langSources.length) {
+        const deletedLang = [...changed].some((c) => (isLanguageSource(c) || isLanguageManifest(c)) && !(c in fileContents) && !(c in depFileContents));
+        const impacted = deletedLang ? langSources : impactedFiles(fileContents, depFileContents, [...changed]);
+        const { graph } = buildImportGraph(fileContents);
+        for (const f of impacted) { keep.add(f); for (const d of importClosure(graph, f).files) keep.add(d); }
+      }
       const filtered = {};
       for (const f of Object.keys(fileContents)) {
-        if (changed.has(f)) filtered[f] = fileContents[f];
+        if (keep.has(f)) filtered[f] = fileContents[f];
       }
       fileContents = filtered;
       // Only when the filter actually applied. A `changedSince` that resolved
@@ -203,7 +254,7 @@ export async function runScan(rootDir, opts = {}) {
 
   // R8: `resume` is opt-in. Left undefined here, runFullScan falls back to the
   // AGENTIC_SECURITY_RESUME=1 env var, which is off by default.
-  const scan = await runFullScan({ fileContents, depFileContents, scanRoot: root, resume: opts.resume, deep: opts.deep, deepInCi: opts.deepInCi, completeScan }, opts.onProgress || (()=>{}));
+  const scan = await runFullScan({ fileContents, depFileContents, scanRoot: root, resume: opts.resume, deep: opts.deep, deepInCi: opts.deepInCi, completeScan, policyExcluded, sizeSkipped }, opts.onProgress || (()=>{}));
   // Premortem 2R4.2: stamp ruleset version + source on the scan result, and
   // notify if the operator pinned a different version than what's installed.
   try { stampScan(root, scan); } catch {}

package/src/sast/code-injection-multilang.js

@@ -123,6 +123,20 @@ function _lang(fp) {
   return null;
 }
 
+// True when `idx` sits inside a '…' or "…" literal on its own line. A sink name
+// quoted in a string (a rule library's `fix:`/`example:` text, a log message) is
+// prose, not a call. Backticks are deliberately not tracked: a template literal's
+// `${…}` holds real code, and erring toward "this is code" is the safe direction.
+function _insideQuote(code, idx) {
+  let q = null;
+  for (let i = code.lastIndexOf('\n', idx - 1) + 1; i < idx; i++) {
+    const c = code[i];
+    if (q) { if (c === '\\') i++; else if (c === q) q = null; }
+    else if (c === '\'' || c === '"') q = c;
+  }
+  return q !== null;
+}
+
 export function scanCodeInjectionMultilang(fp, raw) {
   if (!raw || raw.length > 500_000) return [];
   const lang = _lang(fp);
@@ -137,6 +151,7 @@ export function scanCodeInjectionMultilang(fp, raw) {
     const r = new RegExp(re.source, re.flags);
     let m;
     while ((m = r.exec(code))) {
+      if (_insideQuote(code, m.index + Math.max(0, m[0].search(/\w/)))) continue;
       const line = lineOf(code, m.index);
       const id = `code-injection-ml:${fp}:${line}:${key}`;
       if (seen.has(id)) continue;

package/src/sast/go-extended.js

@@ -5,6 +5,9 @@
 //   - exec.Command shell-form        exec.Command("sh", "-c", <var>) vs argv-form
 //   - http.Client custom-transport   http.Get(<var>) or http.NewRequest with
 //                                    user-controlled URL and no allowlist
+//   - package-level http.Get/Post    runs on http.DefaultClient, which has no
+//                                    timeout (DoS: one stalled upstream pins
+//                                    the goroutine and its connection forever)
 //
 // These patterns are narrow and complement the existing regex-based Go rules
 // (GORM raw SQL, source patterns for net/http, Echo, Chi, Gin).
@@ -38,6 +41,14 @@ const FINDINGS = [
     vuln: 'SSRF — http.Get/Post with variable URL',
     remediation: 'Allowlist the destination host before any net/http call. Use `net/url.Parse(target)` then check `parsed.Host` against an explicit allowlist. Reject RFC1918 (10/8, 172.16/12, 192.168/16) and the cloud metadata addresses (169.254.169.254, fd00:ec2::254).',
   },
+  {
+    id: 'go-http-no-timeout', severity: 'medium', cwe: 'CWE-400', family: 'dos-no-timeout',
+    // Only the package-level helpers. `client.Get(...)` is the caller's own
+    // client, which may well set Timeout, so it is deliberately not matched.
+    re: /\bhttp\.(?:Get|Post|Head|PostForm)\s*\(/g,
+    vuln: 'Missing Timeout on Outbound HTTP Request (DoS)',
+    remediation: 'http.Get/Post/Head/PostForm use http.DefaultClient, which never times out. Build a client instead: `c := &http.Client{Timeout: 10 * time.Second}` and call `c.Get(...)`, or pass a context with a deadline to http.NewRequestWithContext.',
+  },
   {
     id: 'go-newrequest-user-url', severity: 'high', cwe: 'CWE-918', family: 'ssrf',
     re: /\bhttp\.NewRequest(?:WithContext)?\s*\(\s*[^,]+,\s*(?!"[^"]*"\s*[,)])[a-zA-Z_]\w*/g,

package/src/sast/pipeline.js

@@ -14,6 +14,38 @@ const _GH_WORKFLOW_RE = /(?:^|\/)\.github\/workflows\/.*\.ya?ml$/i;
 const _NONPROD_RE = /(?:^|\/)(?:tests?|examples?|fixtures?)\//i;
 
 const PIPELINE_PATTERNS = [
+  // ── build hooks common to Haskell (ghcup, Cabal, Stack, Hackage) and Nix pipelines ──
+  {
+    re: /\b(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:ba|z|da)?sh\b/g,
+    vuln: 'Pipeline: remote script piped into a shell (unverified installer)',
+    sev: 'high', cwe: 'CWE-494',
+    fix: 'Download the installer to a file, verify its published checksum or signature, then run it. Installers for ghcup, Nix and similar tools are a common supply-chain target when piped straight into `sh`.',
+  },
+  {
+    re: /\bnix\s+(?:run|shell|develop|build|profile\s+install|eval)\b[^\n]*?\b(?:github|gitlab|sourcehut):[\w.-]+\/[\w.-]+(?!\/[0-9a-f]{40}\b)(?=[\s#?]|$)/g,
+    vuln: 'Pipeline: Nix flake reference executed without a pinned revision',
+    sev: 'high', cwe: 'CWE-829',
+    fix: 'Pin the flake reference to a full commit (`github:owner/repo/<40-hex-rev>`) or run it from this repository\'s own locked flake, so CI cannot execute whatever the branch points to today.',
+  },
+  {
+    re: /\bnix\b[^\n]*(?:--accept-flake-config|--option\s+sandbox\s+false|--option\s+substituters\s+http:|--extra-trusted-public-keys|--impure\b)/g,
+    vuln: 'Pipeline: Nix evaluation or build trust relaxed in CI',
+    sev: 'medium', cwe: 'CWE-693',
+    fix: 'Do not accept a flake\'s own configuration, disable the sandbox, add unauthenticated substituters or evaluate impurely in CI. Put the trust decision in the repository\'s reviewed configuration instead.',
+  },
+  {
+    re: /^env\s*:\s*\n(?:[ \t]+[^\n]*\n)*?[ \t]+[A-Za-z0-9_]+\s*:\s*\$\{\{\s*secrets\.[A-Z0-9_]+\s*\}\}/gm,
+    vuln: 'Pipeline: secret exposed at workflow-wide environment scope',
+    sev: 'medium', cwe: 'CWE-522',
+    fix: 'Set secrets such as a Hackage or Cachix token on the single step that needs them (`env:` under that step), not at the top of the workflow where every step and every third-party action can read them.',
+  },
+  {
+    re: /\bref\s*:\s*\$\{\{\s*github\.(?:event\.pull_request\.head\.(?:sha|ref)|head_ref)\s*\}\}/g,
+    vuln: 'Pipeline: pull_request_target checks out untrusted pull request code',
+    sev: 'high', cwe: 'CWE-829',
+    fix: 'A `pull_request_target` workflow runs with repository secrets. Never check out and build the pull request head in it (a Cabal custom Setup.hs, a Nix flake or a build hook would run attacker code with those secrets); use `pull_request`, or split the privileged step.',
+    contextRe: /\bpull_request_target\b/,
+  },
   {
     re: /\buses\s*:\s*[\w-]+\/[\w-]+@(?:main|master|latest)\b/g,
     vuln: 'Pipeline: GitHub Action pinned to floating tag',
@@ -96,7 +128,7 @@ export function scanPipeline(fp, raw) {
 // `uses:` step with its pin (SHA or tag), every secret reference, every
 // permissions block. The PBOM is meant to be stored alongside the SBOM and
 // produced from the same scan.
-export function toPBOM(fileContents, meta = {}) {
+export function toPBOM(fileContents, meta = {}, extras = {}) {
   const workflows = [];
   for (const [fp, raw] of Object.entries(fileContents || {})) {
     if (!_GH_WORKFLOW_RE.test(fp.replace(/\\/g, '/'))) continue;
@@ -120,6 +152,7 @@ export function toPBOM(fileContents, meta = {}) {
     version: '1',
     generatedAt: meta.startedAt || new Date().toISOString(),
     workflows,
+    ...(extras.languageBuild && (extras.languageBuild.haskell || extras.languageBuild.nix) ? { languageBuild: extras.languageBuild } : {}),
     summary: {
       totalWorkflows: workflows.length,
       totalActions: workflows.reduce((n, w) => n + w.uses.length, 0),