@clear-capabilities/agentic-security-scanner 0.157.1 → 0.158.0

package/CHANGELOG.md

@@ -9,6 +9,30 @@
 > make the history less accurate, not more.
 
 
+## 0.158.0 - live Hackage advisories (opt in), and the detection gaps the second unseen set found
+
+Two things, both in the Haskell and Nix/NixOS work.
+
+**A live Hackage advisory feed.** Until now Haskell dependency scanning matched correctly but only against a snapshot you supplied. Set `AGENTIC_SECURITY_HACKAGE_ADVISORIES_LIVE=1` and a scan looks up the packages it is about to evaluate in the OSV `Hackage` ecosystem, keeping the result in the operator configuration directory (mode 0600), never the scanned project.
+- **Off by default.** It needs the network, `AGENTIC_SECURITY_OFFLINE=1` / `--no-network` always wins, and a snapshot you name with `AGENTIC_SECURITY_HACKAGE_ADVISORIES` is used as given and never refreshed over.
+- **It records what it covered.** A package it could not fully look up is reported `feed-incomplete` (unknown), never as having no advisories, and coverage older than the age limit reads `feed-stale`. This holds for the Nix matcher too: a Haskell package wrapped in a Nix closure that the feed did not cover is now `unknown`. Before this release that path would have said "no advisory in the supplied feed matches this version" for a package the feed never looked at; the closure's Haskell package names are now also fed to the lookup.
+- **Failure degrades.** An unreachable feed keeps the previous snapshot and states its age; with none the scan is `partial` and says why.
+- **Untrusted input is bounded.** Package names and advisory ids are validated before they reach a URL, a record that is not the one asked for is dropped, responses are size-bounded, and a cache whose records no longer match their hashes is discarded.
+- It has been tested against a stand-in server that serves the real pinned HSEC records. It has not been measured against the live service on real projects.
+
+**Detection gaps, fixed as general capabilities** (none of the fixtures used to prove them is a corpus case; each fix is pinned in both directions):
+- `Network.Wreq.getWith opts url` and the other `*With`, custom-method and `Session` forms were checked at the options argument, so the URL was never examined and tainted options were treated as SSRF. The URL position is now modelled per function (the sink list grew from 8 to 32 entries).
+- A credential check written inside a route handler (reads `Authorization`, rejects with a 401 and stops the handler, before the first sensitive operation) is recognised as a guard. A check that does not stop the handler, reads a non-credential header, or runs after the write is still reported.
+- One flaw reached through nested sinks (`readCreateProcess (shell cmd)`) is reported once; the outer sink is recorded on the finding. Independent sinks on one line stay separate.
+- Reading a request body whole with no size limit is CWE-770, like the sibling unbounded-read rules (it was CWE-400).
+- NixOS `allowedTCPPortRanges` / `allowedUDPPortRanges` are evaluated: a range that opens every port is a high finding (`firewall-wide-port-range`), ten thousand or more ports medium, a sensitive port inside a smaller range is still caught, an interface-scoped range is not global, and a range that cannot be evaluated is disclosed instead of read as closed. A service port inside a global range is reported open in the firewall. The option evaluator now reads a list or attribute set when every element is statically known.
+
+This entry makes no claim about how many requirements are verified, or about precision on the fixes above: the unseen set they came from is consumed, so a new number needs a fresh one.
+
+## 0.157.2 - the npm package description names Haskell and Nix/NixOS
+
+npm cuts a package description at 255 characters, and in 0.157.1 the Haskell and Nix/NixOS sentence sat past the cut, so the registry never showed it. The description is now 234 characters with both languages inside the limit. No scanner behaviour changed.
+
 ## 0.157.1 - `ci` summary adds up; Haskell and Nix/NixOS shown in the language table, the npm README and the manifests
 
 One scanner fix, otherwise documentation and metadata.

package/dist/3531.index.js

@@ -14,7 +14,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   purlFromGitHost: () => (/* binding */ purlFromGitHost),
 /* harmony export */   purlFromUpstreamUrl: () => (/* binding */ purlFromUpstreamUrl)
 /* harmony export */ });
-/* harmony import */ var _haskell_supply_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(86349);
+/* harmony import */ var _haskell_supply_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(43436);
 /* harmony import */ var _haskell_sca_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(2437);
 /* harmony import */ var _haskell_resolved_graph_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(86359);
 /* harmony import */ var _nix_inventory_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(81303);

package/dist/4171.index.js

@@ -20,8 +20,8 @@ var resolved_pass = __webpack_require__(38551);
 var nix_build_trust = __webpack_require__(36668);
 // EXTERNAL MODULE: ./src/language/discovery.js
 var discovery = __webpack_require__(30951);
-// EXTERNAL MODULE: ./src/language/haskell-supply.js
-var haskell_supply = __webpack_require__(86349);
+// EXTERNAL MODULE: ./src/language/haskell-supply.js + 1 modules
+var haskell_supply = __webpack_require__(43436);
 // EXTERNAL MODULE: ./src/language/nix-script-taint.js
 var nix_script_taint = __webpack_require__(11793);
 // EXTERNAL MODULE: ./src/language/nix-secrets.js

package/dist/8551.index.js

@@ -10,6 +10,7 @@ export const modules = {
 __webpack_require__.d(__webpack_exports__, {
   analyzeNixClosure: () => (/* binding */ analyzeNixClosure),
   nixClosureOf: () => (/* binding */ nixClosureOf),
+  nixHaskellPackageNames: () => (/* binding */ nixHaskellPackageNames),
   resolvedHackageComponents: () => (/* binding */ resolvedHackageComponents),
   resolvedHaskellGraph: () => (/* binding */ resolvedHaskellGraph),
   runSelectedNixEval: () => (/* binding */ runSelectedNixEval)
@@ -647,9 +648,14 @@ function matchNixVulnerabilities(opts = {}) {
     if (!data) { push({ status: 'unknown', reason: 'no advisory feed was supplied: absence of a match is not a clean result' }); summary.unmapped++; continue; }
     if (ident.versionRejected && !ident.haskell && !(node.upstream && node.upstream.rev)) { push({ status: 'unknown', reason: `the version cannot be queried: ${ident.versionRejected}` }); summary.unmapped++; continue; }
 
-    let matched = false; let mapped = false;
+    let matched = false; let mapped = false; let hackageGap = null;
     // Hackage (wrapped Haskell packages): reuse the PVP matcher
-    if (ident.haskell && data.hackage && ident.version && (0,haskell_manifests/* parseVersion */.ot)(ident.version)) {
+    if (ident.haskell && data.hackage && ident.version && (0,haskell_manifests/* parseVersion */.ot)(ident.version) && data.hackage.coverage(node.pname) !== 'covered') {
+      // A feed that never looked up this package (or looked too long ago) says nothing about it: that is unknown, not "no advisory matches".
+      hackageGap = data.hackage.coverage(node.pname) === 'stale'
+        ? 'the Hackage advisory feed last covered this package longer ago than its age limit: the absence of a match is not a clean result'
+        : 'the Hackage advisory feed never covered this package: the absence of a match is not a clean result';
+    } else if (ident.haskell && data.hackage && ident.version && (0,haskell_manifests/* parseVersion */.ot)(ident.version)) {
       mapped = true;
       for (const { adv, aff } of data.hackage.forPackage(node.pname)) {
         if (adv.withdrawn) continue;
@@ -683,6 +689,7 @@ function matchNixVulnerabilities(opts = {}) {
       }
     }
     if (matched) summary.matched++;
+    else if (hackageGap) { summary.unmapped++; push({ status: 'unknown', reason: hackageGap }, { identityMapped: false, feedCoverage: 'incomplete' }); }
     else if (mapped) { summary.mappedNoMatch++; push({ status: 'not-affected', reason: 'mapped to an upstream identity and no advisory in the supplied feed matches this version' }, { identityMapped: true }); }
     else { summary.unmapped++; push({ status: 'unknown', reason: ident.ambiguous ? 'the upstream identity is ambiguous: no verdict' : 'the upstream identity could not be mapped to anything an advisory is keyed by' }, { identityMapped: false }); }
   }
@@ -724,8 +731,8 @@ function licenseReport(nodes, meta, policy) {
 
 
 
-// EXTERNAL MODULE: ./src/language/haskell-supply.js
-var haskell_supply = __webpack_require__(86349);
+// EXTERNAL MODULE: ./src/language/haskell-supply.js + 1 modules
+var haskell_supply = __webpack_require__(43436);
 // EXTERNAL MODULE: external "node:child_process"
 var external_node_child_process_ = __webpack_require__(31421);
 // EXTERNAL MODULE: external "node:net"
@@ -1120,6 +1127,14 @@ function loadNixExports(files, env = process.env) {
   return { exports, sources, problems, expected, trust: [...trust] };
 }
 
+/** Names of the Haskell packages inside an imported Nix closure (derivations whose env carries Haskell build attributes). */
+function nixHaskellPackageNames(files, opts = {}) {
+  const c = nixClosureOf(files, opts);
+  if (!c || (c.refused && c.refused.length)) return [];
+  const nodes = (c.closure && c.closure.nodes) || [];
+  return [...new Set(nodes.filter((n) => n.pname && n.deriver && c.drvEnv[n.deriver] && HASKELL_ENV_HINTS.some((k) => k in c.drvEnv[n.deriver])).map((n) => n.pname))];
+}
+
 /** The imported closure (and each derivation's env block) for a file set, or null when there is no export. Cached per file set. */
 function nixClosureOf(files, { now = Date.now() } = {}) {
   return memoized(files, 'nix-closure', () => {