@clear-capabilities/agentic-security-scanner 0.186.2 → 0.187.0

package/src/language/haskell-web.js

@@ -267,6 +267,7 @@ function kidsIr(e) {
   for (const k of ['left', 'right', 'object', 'value']) if (e[k] && typeof e[k] === 'object') out.push(e[k]);
   for (const k of ['args', 'elements', 'branches', 'parts']) if (Array.isArray(e[k])) out.push(...e[k]);
   if (Array.isArray(e.props)) for (const p of e.props) if (p && p.value) out.push(p.value);
+  if (e.hs && e.hs.inner && typeof e.hs.inner === 'object') out.push(e.hs.inner);   // `oid :: Int`: a number to the taint engine, still the id it names here
   return out;
 }
 function* walkIr(e, depth = 0) { if (!e || typeof e !== 'object' || depth > 80) return; yield e; for (const c of kidsIr(e)) yield* walkIr(c, depth + 1); }
@@ -295,6 +296,8 @@ function handlerFacts(ctx, fn, opts = {}) {
     if (n.kind === 'if' && n.cond) conds.push(n.cond);
     for (const root of exprsOfNode(n)) for (const e of walkIr(root)) {
       if (e.kind === 'call' && typeof e.callee === 'string') ordered.push({ call: e, line: e.line || n.line, node: n });
+      // `when (owner /= principal) notFound`, `unless (owner == principal) (permissionDenied ..)`: the condition is the first argument of the call
+      if (e.kind === 'call' && /(?:^|\.)(?:when|unless)$/.test(e.callee || '') && e.args && e.args[0]) conds.push(e.args[0]);
       if (e.kind === 'union' && e.hs && e.hs.branchConds) for (const bc of e.hs.branchConds) conds.push(bc.cond);
     }
   }
@@ -349,6 +352,9 @@ function handlerFacts(ctx, fn, opts = {}) {
     const hard = allCalls.findIndex((r) => r !== rd.call && isRejection(r) && !SCOTTY_STATUS.test(r.callee) && stopsHandler(r, allCalls));
     if (hard >= 0) { inlineIdx = hard; inlineKind = rd.kind; inlineLine = allCalls[hard].line; inlineCallee = rd.callee; inlineRejectCallee = allCalls[hard].callee; break; }
   }
+  // A credential read and a rejection that ends the handler exist, but the rejection is not before the first sensitive operation BY LINE (a `case`
+  // lists the success branch first and the rejecting branch last). Their order is then a question about control flow, answered from the syntax tree.
+  const inlineCandidate = reads.length > 0 && allCalls.some((r) => isRejection(r) && stopsHandler(r, allCalls));
   const principals = new Set();
   for (const a of assigns) if (a.source.kind === 'call' && isGuardCall(a.source)) principals.add(a.target);
   // ids read from the request
@@ -360,7 +366,7 @@ function handlerFacts(ctx, fn, opts = {}) {
       if (nm && /id$/i.test(nm)) idVars.add(a.target);
     }
   }
-  return { ordered, guardIdx, inlineIdx, inlineKind, inlineLine, inlineCallee, inlineRejectCallee, sensIdx, principals, idVars, conds, assigns, isGuardCall, isSensitive, fn };
+  return { ordered, guardIdx, inlineIdx, inlineCandidate, inlineKind, inlineLine, inlineCallee, inlineRejectCallee, sensIdx, principals, idVars, conds, assigns, isGuardCall, isSensitive, fn };
 }
 
 function hasOwnership(ctx, facts) {
@@ -368,7 +374,7 @@ function hasOwnership(ctx, facts) {
   const mentionsPrincipal = (e) => { for (const n of identsIr(e)) if (principals.has(n)) return true; return false; };
   // 1. a comparison involving the principal
   for (const c of facts.conds) for (const x of walkIr(c)) {
-    if (x.kind === 'binary' && ['==', '===', '!='].includes(x.op) && (mentionsPrincipal(x.left) || mentionsPrincipal(x.right))) return { kind: 'principal-comparison' };
+    if (x.kind === 'binary' && ['==', '===', '!=', '/='].includes(x.op) && (mentionsPrincipal(x.left) || mentionsPrincipal(x.right))) return { kind: 'principal-comparison' };
     if (x.kind === 'call' && /(?:^|\.)(?:elem|notElem)$/.test(x.callee || '') && (x.args || []).some(mentionsPrincipal)) return { kind: 'principal-membership' };
   }
   for (const o of facts.ordered) {
@@ -396,7 +402,7 @@ function hasOwnership(ctx, facts) {
 //     source, a sensitive call the walk did not find) makes the order UNKNOWN, and unknown is reported as late, never as authenticated.
 // Leaf expressions are classified by lowering them alone and reusing the classifiers above (credentialReadsOf, isRejection, stopsHandler,
 // isSensitiveCall), so this adds ordering and no second definition of what a credential, a rejection or a sensitive call is.
-const HARD_REJECT_HEAD = /^(?:throwError|permissionDenied|notAuthenticated)$/;
+const HARD_REJECT_HEAD = /^(?:throwError|permissionDenied|notAuthenticated|raiseStatus)$/;
 const SOFT_REJECT_HEAD = /^(?:respond|return|pure)$/;
 
 function rhsBranches(rhs) {
@@ -425,7 +431,7 @@ function inlineOrder(ctx, fn, facts, opts) {
   const mentions = (e, names) => { for (const x of walkAst(e)) if (x.t === 'var' && !x.qual && names.has(x.name)) return x.name; return null; };
   const classify = (e) => {
     if (memo.has(e)) return memo.get(e);
-    let out = { reads: false, rej: false, sensN: 0 };
+    let out = { reads: false, rej: false, sensN: 0, stat: false, halt: false };
     try {
       const f2 = lowerHandlerExpr(ctx.project, src.mod, e, `order${seq++}`, Number.isFinite(e.line) ? e.line : 1);
       const calls = [...callsOf(f2), ...nullaryRejectionsOf(f2)].filter((c) => typeof c.callee === 'string');
@@ -434,6 +440,10 @@ function inlineOrder(ctx, fn, facts, opts) {
         reads: credentialReadsOf(f2).size > 0 || Object.values(f2.cfg.nodes).some((n) => exprsOfNode(n).some((r) => [...walkIr(r)].some((x) => x.kind === 'ident' && typeof x.name === 'string' && !!credentialKind({ callee: x.name, args: [] })))),
         rej: calls.some((c) => isRejection(c) && !SCOTTY_STATUS.test(c.callee) && stopsHandler(c, calls)),
         sensN: callsOf(f2).filter((c) => typeof c.callee === 'string' && isSensitiveCall(ctx, c)).length,
+        // Scotty: `status 40x` only sets the code; a halting call (`finish`, `raise`, `redirect`) ends the handler. Both are tracked so the PAIR counts
+        // as a rejection wherever the two sit in sequence (`status status401 >> finish`), in either order of statements within one branch.
+        stat: calls.some((c) => SCOTTY_STATUS.test(c.callee) && isRejection(c)),
+        halt: haltLinesOf(f2).length > 0,
       };
     } catch { T.failed = true; }
     // A lambda inside the expression is lifted out by the lowering, so the calls in its body are not among the expression's own: classify
@@ -441,7 +451,7 @@ function inlineOrder(ctx, fn, facts, opts) {
     memo.set(e, out);
     for (const x of walkAst(e)) {
       const bodies = x.t === 'lam' ? [x.body] : x.t === 'lamcase' ? (x.alts || []).flatMap((a) => rhsBranches(a.rhs).map((b) => b.body)) : [];
-      for (const b of bodies) { const sub = classify(b); out = { reads: out.reads || sub.reads, rej: out.rej || sub.rej, sensN: out.sensN + sub.sensN }; }
+      for (const b of bodies) { const sub = classify(b); out = { reads: out.reads || sub.reads, rej: out.rej || sub.rej, sensN: out.sensN + sub.sensN, stat: out.stat || sub.stat, halt: out.halt || sub.halt }; }
     }
     T.astSens += out.sensN;
     memo.set(e, out);
@@ -459,6 +469,9 @@ function inlineOrder(ctx, fn, facts, opts) {
     for (let i = 0; i < n; i++) acc.sens.push({ guarded: s.guarded, readMay: s.readMay });
     const sp = spine(e);
     const hn = sp && sp.head ? sp.head.name : null;
+    if (c.stat) s = { ...s, statusRej: true };
+    // a Scotty halting call after a rejecting status on this path, once a credential has been read
+    if (c.halt && n === 0 && s.statusRej && s.read) { acc.guards++; return { st: s, term: true }; }
     if (c.rej && n === 0 && hn && (HARD_REJECT_HEAD.test(hn) || (tail && SOFT_REJECT_HEAD.test(hn))) && s.read) { acc.guards++; return { st: s, term: true }; }
     if (c.rej && n > 0) T.unordered = true;
     return { st: s, term: false };
@@ -586,6 +599,9 @@ function analyzeRoute(ctx, route, handlerFn, opts) {
     const ord = R.framework === 'scotty' ? { verdict: 'before' } : inlineOrder(ctx, handlerFn, facts, opts);
     if (ord.verdict === 'before') R.auth = { status: 'authenticated', kind: facts.inlineKind, evidence: [{ kind: 'inline-guard', callee: facts.inlineCallee, line: facts.inlineLine }] };
     else R.auth = { status: 'late', kind: null, evidence: [{ kind: 'late-guard', callee: facts.inlineRejectCallee || facts.inlineCallee, line: facts.inlineLine, order: ord.verdict, reason: ord.reason }] };
+  } else if (facts.inlineCandidate && inlineOrder(ctx, handlerFn, facts, opts).verdict === 'before') {
+    // by line the rejection looked late or absent; the handler's structure proves every sensitive operation sits on the non-rejecting side of it
+    R.auth = { status: 'authenticated', kind: facts.inlineKind || 'token', evidence: [{ kind: 'inline-guard', callee: 'structure', line: R.line }] };
   } else R.auth = { status: 'none', kind: null, evidence: [] };
   // role
   const roleCall = facts.ordered.find((o) => ROLE_CALL.test(o.call.callee || ''));
@@ -765,7 +781,10 @@ function servantHandlers(ctx, mod, apiName) {
     const flat = [];
     const go = (e) => { e = unparen(e); if (e && e.t === 'op' && e.op === ':<|>') { go(e.l); go(e.r); } else flat.push(e); };
     if (body) go(body);
-    if (flat.length > 0) return { fnName: fun.name, handlers: flat, fun };
+    // `server _account rowId = do ...`: a single endpoint written as a function, whose parameters ARE the endpoint's auth, capture and query values
+    const clause = fun.clauses[0];
+    const params = flat.length === 1 && clause && (clause.pats || []).length ? clause.pats.map((x) => (x && x.t === 'pvar' ? x.name : null)) : null;
+    if (flat.length > 0) return { fnName: fun.name, handlers: flat, fun, params };
   }
   return null;
 }
@@ -874,7 +893,7 @@ export function analyzeHaskellWeb(files, opts = {}) {
     list.forEach((e, i) => {
       const hAst = h && h.handlers.length === list.length ? h.handlers[i] : null;
       if (h && h.handlers.length !== list.length) ctx.gaps.push({ kind: 'servant-handler-arity', detail: `${apiName} has ${list.length} endpoints but ${h.fnName} lists ${h.handlers.length} handlers; handlers are not paired`, file: mod.file, line: e.line });
-      add({ framework: 'servant', method: e.method, path: e.path, file: mod.file, line: e.line, mod, handlerAst: hAst, servant: e, owner: apiName, whereDecls: h && h.fun && h.fun.clauses[0] && h.fun.clauses[0].rhs.where });
+      add({ framework: 'servant', method: e.method, path: e.path, file: mod.file, line: e.line, mod, handlerAst: hAst, handlerParams: h && h.handlers.length === list.length ? h.params : null, servant: e, owner: apiName, whereDecls: h && h.fun && h.fun.clauses[0] && h.fun.clauses[0].rhs.where });
     });
   }
 
@@ -890,6 +909,23 @@ export function analyzeHaskellWeb(files, opts = {}) {
     }
   }
 
+  // Yesod handlers named by the framework's convention (`getInvoiceR`, `postPurgeR`, `handleHomeR`) whose route table is not in an analysed
+  // file (it usually lives in `config/routes`, read by a Template Haskell splice): the name and the `Handler` result type identify the entry point.
+  // A handler a route table already names is not added twice.
+  if (fw.has('yesod')) {
+    const named = new Set(pending.filter((p) => p.framework === 'yesod').map((p) => p.handlerName));
+    for (const mod of ctx.modules) {
+      if (!mod.imports.some((i) => /^Yesod(?:\.|$)/.test(i.module))) continue;
+      for (const fun of mod.groups.funs) {
+        const m = /^(get|post|put|delete|patch|options|head|handle)([A-Z][A-Za-z0-9_']*R)$/.exec(fun.name);
+        const sig = mod.sigs.get(fun.name);
+        if (!m || named.has(fun.name) || !sig || !/\bHandler(?:For|T)?\b/.test(sig.text)) continue;
+        const method = m[1] === 'handle' ? 'ANY' : m[1].toUpperCase();
+        add({ framework: 'yesod', method, path: `/${m[2].replace(/R$/, '').replace(/([a-z0-9])([A-Z])/g, '$1-$2').toLowerCase()}`, file: mod.file, line: fun.line, mod, handlerName: fun.name, resource: m[2], owner: m[2], conventional: true });
+      }
+    }
+  }
+
   // ── resolve handlers and analyse ─────────────────────────────────────────
   for (const p of pending) {
     const R = newRoute({ framework: p.framework, method: p.method, path: p.path, file: p.file, line: p.line, owner: p.owner });
@@ -919,7 +955,7 @@ export function analyzeHaskellWeb(files, opts = {}) {
           else if (q) handlerName = q.name;
         }
       } else {
-        try { handlerFn = lowerHandlerExpr(ctx.project, p.mod, p.handlerAst, `${p.framework}-${p.line}`, p.line); ctx.handlerAst.set(handlerFn, { mod: p.mod, rhss: [{ guards: null, body: p.handlerAst, where: [] }] }); handlerName = '<inline>'; } catch { handlerFn = null; }
+        try { handlerFn = lowerHandlerExpr(ctx.project, p.mod, p.handlerAst, `${p.framework}-${p.line}`, p.line); ctx.handlerAst.set(handlerFn, { mod: p.mod, rhss: [{ guards: null, body: p.handlerAst, where: [] }] }); handlerName = '<inline>'; if (p.handlerParams) paramNames = p.handlerParams; } catch { handlerFn = null; }
       }
     }
     R.handler = handlerFn ? { kind: handlerName === '<inline>' ? 'inline' : 'named', name: handlerName } : { kind: 'unknown', name: handlerName };

package/src/language/support-registry.js

@@ -221,7 +221,8 @@ export function evaluateSupport(language, input) {
     const strict = r.evidence.metric === 'sast-holdout' || r.evidence.metric === 'taint-holdout' ? (detection.layers || {})[key] && (detection.layers[key].strict || null) : null;
     r.evidence = withInterval({ ...r.evidence, ...(strict && Number.isFinite(strict.precision) ? { strictPrecision: strict.precision } : {}) });
   }
-  // Generalisation: the SAME layers measured on shapes absent from train, validation and holdout. It never changes a row's status (the
+  // Generalisation: the SAME layers measured on shapes absent from train, validation and holdout. When that split has become a DEVELOPMENT set (its
+  // failures were read and the engine was changed for them) the result is a regression number and is labelled so (`role`). It never changes a row's status (the
   // PRD's gates are defined on the frozen holdout); it is stated beside it, with the shortfalls named, so "supported" is not read as more.
   const un = input.unseen && input.unseen.ecosystems && input.unseen.ecosystems[language] && input.unseen.ecosystems[language].detection;
   out.generalizationGaps = [];
@@ -234,7 +235,7 @@ export function evaluateSupport(language, input) {
     if (!(u.precision >= TARGETS.precision)) shortfalls.push(`precision ${pct(u.precision)} < ${pct(TARGETS.precision)}`);
     if (!(u.recall >= TARGETS.recall)) shortfalls.push(`recall ${pct(u.recall)} < ${pct(TARGETS.recall)}`);
     if (!(u.f1 >= TARGETS.f1)) shortfalls.push(`F1 ${pct(u.f1)} < ${pct(TARGETS.f1)}`);
-    r.generalization = { status: shortfalls.length ? 'below-target' : 'meets-targets', shortfalls, cases: u.cases, tp: u.tp, fp: u.fp, fn: u.fn, tn: u.tn, precision: u.precision, recall: u.recall, f1: u.f1, strictPrecision: u.strict && u.strict.precision, ci: { precision: ciShapes(u.tp, u.tp + u.fp), recall: ciShapes(u.tp, u.tp + u.fn), level: 0.95, method: `Clopper-Pearson over shapes (${SHAPE_CLUSTER} near-identical cases per shape)` } };
+    r.generalization = { status: shortfalls.length ? 'below-target' : 'meets-targets', role: (input.unseen && input.unseen.splitRole) || 'generalisation', shortfalls, cases: u.cases, tp: u.tp, fp: u.fp, fn: u.fn, tn: u.tn, precision: u.precision, recall: u.recall, f1: u.f1, strictPrecision: u.strict && u.strict.precision, ci: { precision: ciShapes(u.tp, u.tp + u.fp), recall: ciShapes(u.tp, u.tp + u.fn), level: 0.95, method: `Clopper-Pearson over shapes (${SHAPE_CLUSTER} near-identical cases per shape)` } };
     if (shortfalls.length) out.generalizationGaps.push(`${r.capability}: ${shortfalls.join(', ')}`);
   }
   // a capability whose tool is absent is blocked, not passed and not skipped

package/src/mcp/tools.js

@@ -475,6 +475,22 @@ export const scan_diff = {
   },
 };
 
+// The ordered source-to-sink steps of a finding: its `trace` when the detector wrote one, else the `chain` the IR taint
+// engine records (file, line, label, kind, provenance). Null when the finding carries neither.
+function _flowSteps(f) {
+  if (Array.isArray(f.trace) && f.trace.length) return f.trace;
+  if (f.trace && !Array.isArray(f.trace)) return f.trace;
+  if (Array.isArray(f.chain) && f.chain.length) {
+    return f.chain.map((s) => ({ file: s.file ?? null, line: s.line ?? null, label: s.label ?? null, kind: s.kind || (s.provenance ? 'source' : 'step'), provenance: s.provenance ?? null }));
+  }
+  return null;
+}
+// Labels of the structured source, sink and rule, for matching only.
+function _flowEnds(f) {
+  const lab = (x) => (x && typeof x === 'object' ? [x.label, x.family, x.kind].filter((v) => typeof v === 'string').join(' ') : '');
+  return [lab(f.source), lab(f.sink), typeof f.rule === 'string' ? f.rule : ''].join(' ');
+}
+
 // ─── query_taint ─────────────────────────────────────────────────────────────
 export const query_taint = {
   name: 'query_taint',
@@ -505,13 +521,16 @@ export const query_taint = {
     // dilutes its reasoning; the agent receives a bounded slice plus the
     // cursor to fetch the rest if it wants.
     const all = (scan.findings || []).filter(f => {
-      const hay = [f.description, f.title, f.vuln, f.snippet, JSON.stringify(f.trace || '')].join(' ').toLowerCase();
+      // The structured flow counts too: an IR taint finding (Haskell included) records its path as `source`, `sink`, `rule`
+      // and `chain`, and carries no free-text description or `trace`, so matching only the text fields would answer
+      // "no path" for a path the scan did find.
+      const hay = [f.description, f.title, f.vuln, f.snippet, JSON.stringify(_flowSteps(f) || ''), _flowEnds(f)].join(' ').toLowerCase();
       return hay.includes(srcL) && hay.includes(sinkL);
     });
     const page = all.slice(off, off + lim).map(f => redactFinding({
       id: f.id, severity: f.severity, file: f.file, line: f.line,
       title: f.title || f.vuln, description: f.description,
-      trace: f.trace || null,
+      trace: _flowSteps(f),
     }));
     return {
       _meta: META,
@@ -551,7 +570,7 @@ export const explain_finding = {
       title: f.title || f.vuln, cwe: f.cwe,
       description: f.description, remediation: f.remediation,
       snippet: f.snippet || null,
-      trace: f.trace || null,
+      trace: _flowSteps(f),
     });
     // Harness-anatomy #1: explain_finding's trace is the most-likely-large
     // field on a single finding. Offload when it crosses the threshold so
@@ -1211,6 +1230,9 @@ export const synthesize_fix = {
               languageFix.applyWith = { finding_id: f.id, confirm: true, plan_digest: languageFix.planDigest };
             }
             else if (prev.ok) autofix = { deterministic: true, ruleId: f.rule || f.family || null, patch: prev.after, file: prev.file, label: prev.label || null, verified: true };
+          } else if (lc.isLanguageDependencyFinding(f)) {
+            // Named, not silent: a Hackage or flake dependency is fixed by raising a constraint, which has its own tool.
+            languageFix = { status: 'use-sca-upgrade', ok: false, label: null, tier: null, reason: 'this is a dependency finding: use synthesize_sca_upgrade for the constraint edit (apply_sca_upgrade writes it)', diff: null, explanation: null, consequences: [] };
           }
         } catch { /* best-effort: the preview is advisory */ }
       }
@@ -1625,6 +1647,22 @@ export const query_cache_telemetry = {
   },
 };
 
+async function _languageUpgrade(lc, f, ctx, apply) {
+  const proj = lc.loadLanguageProject(ctx.sessionRoot);
+  return lc.languageUpgradePreview(f, { ...proj.files, ...proj.manifests }, { apply, root: ctx.sessionRoot });
+}
+// The result shape both SCA upgrade tools return for a Hackage or flake dependency. `verified` is never true: the edit
+// changes a declared constraint or a ref, not the resolved version.
+function _languageUpgradeResult(f, r) {
+  return {
+    ok: true, mode: r.ok ? 'source-edit' : 'blocked', ecosystem: f.ecosystem, package: f.package || null,
+    currentVersion: f.version || null, targetVersion: null, command: null,
+    reason: r.ok ? null : (r.reason || 'no upgrade could be planned'),
+    languageUpgrade: { status: r.status || null, tier: r.tier || null, label: r.label || null, file: r.file || null, diff: r.diff || null, explanation: r.explanation || null, consequences: r.consequences || [], backup: r.backup ? r.backup.id || null : null },
+    verified: false,
+  };
+}
+
 // ─── synthesize_sca_upgrade ───────────────────────────────────────────────
 // Phase 3 / Item 5 of the SCA improvement plan. Read-only counterpart to
 // apply_sca_upgrade — produces a structured upgrade plan via the
@@ -1653,6 +1691,10 @@ export const synthesize_sca_upgrade = {
     if (f.type !== 'vulnerable_dep') {
       return { _meta: META, ok: false, reason: 'finding is not an SCA vulnerable_dep — use synthesize_fix for SAST findings' };
     }
+    // Hackage constraints and flake inputs are source edits the language planner owns; without this the generic planner
+    // answers "no automated upgrade" for a dependency the CLI can fix. Read-only: nothing is written or run.
+    const lc = await import('../language/context.js');
+    if (lc.isLanguageDependencyFinding(f)) return { _meta: META, ..._languageUpgradeResult(f, await _languageUpgrade(lc, f, ctx, false)) };
     const { planScaUpgrade } = await _getScaUpgrade();
     const plan = await planScaUpgrade({ scanRoot: ctx.sessionRoot, finding: f });
     return { _meta: META, ...plan };
@@ -1693,6 +1735,15 @@ export const apply_sca_upgrade = {
     if (f.type !== 'vulnerable_dep') {
       return { _meta: META, applied: false, reason: 'finding is not an SCA vulnerable_dep — use apply_fix for SAST findings' };
     }
+    const lc = await import('../language/context.js');
+    if (lc.isLanguageDependencyFinding(f)) {
+      // Plan first, confine the one file it names, then write it with a backup and a history entry (`undo` reverts it).
+      const plan = await _languageUpgrade(lc, f, ctx, false);
+      if (!plan.ok) return { _meta: META, applied: false, ..._languageUpgradeResult(f, plan) };
+      try { _confine(ctx.sessionRoot, plan.file, 'upgrade.file'); } catch (e) { return { _meta: META, applied: false, reason: String((e && e.message) || e) }; }
+      const done = await _languageUpgrade(lc, f, ctx, true);
+      return { _meta: META, applied: done.applied === true, ..._languageUpgradeResult(f, done), testsRun: false, testsNote: 'a constraint edit is not re-resolved or re-tested by this tool; resolve (for example `cabal build --dry-run`), rescan and run the project tests before relying on it' };
+    }
     const { applyScaUpgrade } = await _getScaUpgrade();
     const result = await applyScaUpgrade({ scanRoot: ctx.sessionRoot, finding: f, runTests: run_tests });
     return { _meta: META, ...result };

package/src/posture/attack-taxonomy.js

@@ -167,6 +167,16 @@ const FAMILY_ALIAS = {
   'license':                 'license-graph',
   'cloud-iam-overpermissive': 'iam-overpermissive',
   'http-no-tls':             'crypto-tls-version',
+  // Haskell producers (language/haskell-*.js) name the same defects more finely; each maps to the canonical family of
+  // the same kind of defect, and a family with no canonical counterpart stays unmapped and is listed as such.
+  'missing-authentication':  'auth-missing',
+  'weak-randomness':         'crypto-weak-rng',
+  'weak-hash':               'crypto-weak-hash',
+  'password-hashing':        'crypto-kdf-weak',
+  'tls-validation':          'crypto-tls-no-verify',
+  'hardcoded-credentials':   'hardcoded-secret',
+  'broken-object-authorization': 'idor',
+  'broken-function-authorization': 'authz',
 };
 
 function _canonical(family) {

package/src/posture/entrypoint-inventory.js

@@ -140,9 +140,13 @@ export function buildEntrypointInventory(fileContents, opts = {}) {
       const line = Number.isInteger(route.line) ? route.line : 0;
       const method = typeof route.method === 'string' ? route.method : 'GET';
       const path = typeof route.path === 'string' ? route.path : '';
-      const isWebhook = /webhook/i.test(path) || /webhook/i.test(String(route.handler || ''));
+      // A handler is a name for most frameworks and an object ({kind, name}) for Haskell routes; String() of the object
+      // is "[object Object]". An inline handler has no name of its own, so the route stands in for it.
+      const h = route.handler;
+      const handlerName = typeof h === 'string' ? h : (h && typeof h === 'object' && typeof h.name === 'string' && h.name && !/^<.*>$/.test(h.name) ? h.name : '');
+      const isWebhook = /webhook/i.test(path) || /webhook/i.test(handlerName);
       const type = isWebhook ? 'webhook' : 'http';
-      const name = _clip(route.handler || `${method} ${path}`.trim() || type);
+      const name = _clip(handlerName || `${method} ${path}`.trim() || type);
 
       // Trust: an authenticated route (hasAuth) or a nearby auth token wins.
       let trust = route.hasAuth === true ? 'authenticated' : 'unauthenticated';