@clear-capabilities/agentic-security-scanner 0.195.11 → 0.195.13

package/src/posture/api-contract.js

@@ -185,9 +185,47 @@ export function runApiContractScan(scanRoot, codeRoutes) {
     if (c.kind === 'openapi') contractRoutes = parseOpenAPI(c.doc);
     else if (c.kind === 'graphql') contractRoutes = parseGraphQL(c.doc);
     contractRoutes.forEach(r => { r.contractFile = c.path; });
-    findings.push(...diffRoutes(contractRoutes, codeRoutes || []));
+    findings.push(...diffRoutes(contractRoutes, routesGovernedBy(c.path, scanRoot, codeRoutes || [])));
   }
   return findings;
 }
 
+// A manifest that makes a directory a package of its own: the contract found inside such a package describes that package's API.
+const PACKAGE_MANIFEST = /^(?:package\.json|pyproject\.toml|setup\.py|setup\.cfg|go\.mod|pom\.xml|build\.gradle(?:\.kts)?|Cargo\.toml|composer\.json|Gemfile|mix\.exs|package\.yaml|[^/]+\.cabal|[^/]+\.csproj|[^/]+\.fsproj)$/i;
+
+function hasPackageManifest(dir) {
+  try { return fs.readdirSync(dir).some((n) => PACKAGE_MANIFEST.test(n)); } catch { return false; }
+}
+
+/**
+ * The directory a contract file governs: the nearest ancestor of the file (up to the scan root) that holds a package manifest. A contract at
+ * the scan root's own package, or in a directory with no package above it, governs every route as before.
+ *
+ * Why: a monorepo's packages each carry their own API; an example `swagger.json` three packages away does not declare the routes of the
+ * others. Scanned over a servant monorepo, two example contracts in `servant-swagger/example` and `servant-openapi3/example` produced 78
+ * "implemented but not declared" routes across every other package, each twice. Scoping by package keeps the single-package case unchanged.
+ */
+export function contractScope(contractPath, scanRoot) {
+  const top = path.resolve(scanRoot);
+  let dir = path.dirname(path.resolve(contractPath));
+  while (true) {
+    if (dir === top) return top;
+    if (!dir.startsWith(top + path.sep)) return top;   // outside the scan root: no narrower scope can be claimed
+    if (hasPackageManifest(dir)) return dir;
+    const up = path.dirname(dir);
+    if (up === dir) return top;
+    dir = up;
+  }
+}
+
+function routesGovernedBy(contractPath, scanRoot, codeRoutes) {
+  const scope = contractScope(contractPath, scanRoot);
+  if (scope === path.resolve(scanRoot)) return codeRoutes;
+  return codeRoutes.filter((r) => {
+    if (!r || typeof r.file !== 'string') return false;
+    const abs = path.resolve(scanRoot, r.file);
+    return abs === scope || abs.startsWith(scope + path.sep);
+  });
+}
+
 export const _internals = { CONTRACT_FILE_PATTERNS, parseOpenAPI, parseGraphQL };

package/src/posture/corpus-match.js

@@ -47,9 +47,21 @@ function _any(scan, predicate) {
   return false;
 }
 
+// A finding the scanner itself has PROVED clean (`proof.verdict` `proven-*`: the sink is reached only through a sanitizer that covers the
+// finding's class, or only through a parameterizer) is a refuted report, not a detection: the fix lifecycle already drops it and the report
+// marks it refuted. It scores on neither side, so a fix that sanitises through a recognised escaper reads as `post:TN` and a vulnerable
+// shape the engine wrongly proves clean reads as `pre:FN`, both the honest direction. Added for the first real-advisory Haskell entry (keter,
+// HSEC-2024-0001, whose fix is an HTML escaper); the full baseline was re-run and no synthetic entry's verdict moved.
+function _refuted(f) { return !!(f && f.proof && typeof f.proof.verdict === 'string' && f.proof.verdict.startsWith('proven-')); }
+// A finding at `info` with a guard note is one the engine lowered on evidence it read (a non-HTML content type, a redirect body, a fixed
+// host): kept in the report so the lowering is visible, not a vulnerability it reports. It scores on neither side either. An `info`
+// finding WITHOUT such a note (a rule that is informational by design) still scores, so no synthetic entry's verdict moves.
+function _loweredOnEvidence(f) { return !!(f && f.severity === 'info' && f.guardNote && typeof f.guardNote === 'object'); }
+
 // One predicate, both sides. See the header for why the symmetric form is the
 // LOOSE one.
 function _matches(f, manifest, matcher) {
+  if (_refuted(f) || _loweredOnEvidence(f)) return false;
   return (matcher.test(f.vuln || '') || matcher.test(f.family || '')) &&
     (manifest?.cwe ? f.cwe === manifest.cwe || matcher.test(f.cwe || '') : true);
 }