@clear-capabilities/agentic-security-scanner 0.195.15 → 0.195.17

package/CHANGELOG.md

@@ -9,6 +9,39 @@
 > make the history less accurate, not more.
 
 
+## 0.195.17 - Data Flow Explorer: Haskell and Nix coverage tiers, a corrected guide, and the graph and SCA items the plan found false or contract-changing
+
+**Measured, 0.195.16:** `TIMINGS preflight=3s push=6s pr=1s checks=182s merge=5s verify=5s tag=2s release=223s npm=328s total=755s release-clock=235s`, shipped in 17 min 29 s over four attempts: two hosted test-shard failures (fixed in that release, see its entry) and one transient GitHub 503 while polling checks, each resumed. The release clock (merge to published release) was 235 s.
+
+Why: plan Phase 5. Each item was checked against the code before any change, and three of five turned out to rest on a false premise, so this release is small on purpose.
+
+- **Coverage tiers** (`lineage/language-coverage-tiers.js`): Haskell and Nix are tier `partial` instead of `unknown`, because both are wired into the lineage graph. **No recall number is attached.** The only measured Haskell figure, `docs/METRICS.md`'s 9 of 9 by IR-TAINT, is nine self-authored entries; the impact report prints a number as "measured recall", and 100% would read as a measurement of real code (the real-code figure is precision, 21 of 51 flagged sites true, `bench/dag/dev-haskell`). The pinning test now asserts the null number, and the captured coverage ledger shows the change.
+- **Guide corrected** (`docs/guides/haskell.md`): the capability table said privacy lineage needs nothing. Checked on the Haskell example: without `AGENTIC_SECURITY_LINEAGE_DEEP=1` no graph is written and `dataflow export` answers "No lineage graph found"; with it, a program handling no personal data yields an empty graph.
+- **Dangling reference removed** (`lineage/sink-registry.js`): a comment named a Haskell AI overlay file that never existed; model-provider destinations are decided by the technical provider catalog in `recipient-registry.js`, by destination host.
+- **Examined and not built, with the reason recorded in `scanner/src/language/CLAUDE.md`:** CWE-78/88/94 sink categories (the categories are FR-201's egress taxonomy, and a new one is a signed cross-language contract change); finding references on sink nodes (sink nodes carry no location by design, and the Haskell rule findings are produced after the graph is built); SCA reachability from `plan.json` (it carries no module names, and the package database lives outside the project); moving the ledger entries off `proposed` (the checker requires `proposed`; implemented status lives in the support registry).
+
+Gates, from the runs recorded for this entry: `test:lineage` 1554/1554, `bench:self-scan:check` no drift, `docs:check-language` current.
+
+## 0.195.16 - Haskell remediation for the refused true positives: entropy for three generator shapes, Text commands, path containment, OpenSSL verification, XML entities, and the log-redact literal bug
+
+**Measured, 0.195.15:** `TIMINGS preflight=3s push=7s pr=4s checks=394s merge=5s verify=6s tag=2s release=192s npm=145s total=758s release-clock=205s`, shipped in 14 min 13 s with the npm listing verified on a resume. The release clock (merge to published release) was 205 s.
+
+Why: plan Phase 4. Before this release 11 of the 27 labelled true positives in `bench/dag/dev-haskell` had a verified patch; the rest were refused by class. Each fixer below was written for a real refused site, pinned on a synthetic equivalent type-checked under GHC 9.4.8 against stubs of the documented API (versions recorded in the fixer's comment), then run on the real clone through the same gates the CLI uses. No rule, label or baseline moved: the fixers change no finding.
+
+- **`hs-random-os-entropy` v2** (`haskell-fix.js` `fixRandomLine`): `replicateM n (randomRIO (c1, c2))` becomes n entropy bytes mapped into the character range; `randomRIO (lo, hi)` over integer literals becomes 8 bytes decoded big-endian and reduced into the range; `(take n . map f . randomRs (lo, hi)) <$> newStdGen` becomes n bytes reduced and mapped. The reduction is a modulus and the consequences state its bias. `System.Entropy` is imported when missing (the patch is then a MITIGATION until `entropy` is declared); the `System.Random` names the file no longer uses leave the import; effective kind `random-line`. The older `name = randomIO` shape gets the same import relaxation.
+- **`hs-process-argv` for `Text` commands**: `system (cs t)` / `(T.unpack t)` of a `<>` concatenation, on the line or in a one-line `let` of the same function (removed when it becomes unused), keeps the unpack per argument; `spawnCommand` is recognised. A new `CWE-78` class reason names the decision when the program is a variable: IHP's editor comes from an environment variable and may be `code --goto`, which is not one program name, so that site stays refused, with the reason.
+- **`hs-path-contain`** (new, CWE-22, MITIGATION): a guard equation before the function's first equation rejects a `..` segment or an absolute path with the function's own `Nothing`, falling through otherwise, so no body line moves; only for exactly one `String`/`FilePath` parameter and a `Maybe` result (bare or under one monad). The check is the shape the taint engine's guard recogniser already classifies, so the rescan judges the semantics. Both dhall test-server sites (a read and an existence test under one parameter) verify.
+- **`hs-tls-validate` for HsOpenSSL** (`fixOpenSslVerify`): `contextSetVerificationMode ctx VerifyNone` as a do-block statement becomes `contextSetDefaultVerifyPaths ctx` followed by `VerifyPeer True True Nothing` (HsOpenSSL 0.11.7.11). Every same-shape site in the file is rewritten in one patch, because the rule reports the class once per file (IHP's client has two). A MITIGATION: the host name is not checked, since HsOpenSSL verifies it only through `enableHostnameValidation` on the connection object.
+- **`hs-log-redact`** no longer rewrites inside a string literal: the guide's captured example had shown `" "[REDACTED]"="`, an unparseable line; the recaptured example now reads `" password=" ++ "[REDACTED]"`.
+- **`hs-xml-no-entity-substitution`** (new, CWE-611, FULL): hxt's `withSubstDTDEntities yes` (or `True`) becomes `no` (`False`); an explicit import list that names `yes` but not `no` gains it.
+- **`hs-pbkdf2-low-iterations`** findings are routed to `hs-password-kdf-migrate`, so the old count is kept as the legacy verifier and new hashes use 600000 iterations; raising the literal in place would have invalidated every stored hash.
+
+- **Hosted test flake fixed** (`scanner/scripts/vendor-java-parser.mjs`): the pull request's `test-shard (3/8)` failed twice (once on main) in a Java taint test whose findings came back empty. Cause, reproduced locally (4 failing runs in 6): a test in the same shard runs `npm pack`, whose `prepare` step deleted and recopied `vendor/java-parser` while other tests imported the Java parser. A current copy is now left untouched (package versions compared), and a stale one is rebuilt in a staging directory and swapped in with two renames. Residual limit: for the instant between those renames, a reader can still miss the directory while a STALE copy is replaced; that case does not arise in `npm pack` or `npm ci` after an install. Pinned by `vendor-java-parser-current.test.js`.
+
+**Measured on real code** (`bench/dag/dev-haskell/README.md`, `fix-real.mjs --all` over the five projects with labelled true positives): 17 of 27 labelled true positives now have a verified patch (11 before). The six new ones: scotty `Session.hs:187`, gitit `State.hs:124`, hackage-server `Auth.hs:445` (entropy), dhall `Server.hs:184` and `:205` (containment), IHP `OpenAI.hs:284` (OpenSSL). The compile gate did not run on those clones (their originals do not type-check on this host); the syntax, effective and rescan gates did. Still refused with the decision named: IHP's variable-program command, the open redirect, three request-indexed `!!`, the chain row, gitit's password hashes.
+
+Gates, from the runs recorded for this entry: `test:haskell` 495/495 (four new files: `haskell-remediation-entropy`, `-text-command`, `-path-contain`, `-0195-16`), `test:language` 257/257, `bench:mutation:check` every verdict correct, `bench:self-scan:check` no drift, `bench/haskell-precision --check` PASS with the fresh set unchanged at 21 of 51, `docs:check-language` current, `check-doc-drift --gate` clean.
+
 ## 0.195.15 - Haskell rule precision from semantics: total list shapes, guards written as combinators, length tests, and a weak digest chosen by a type annotation
 
 **Measured, 0.195.14:** `TIMINGS preflight=3s push=7s pr=4s checks=431s merge=5s verify=6s tag=2s release=223s npm=90s total=771s release-clock=236s`, shipped in 12 min 53 s with the npm listing verified on a resume 15 minutes later. The release clock (merge to published release) was 236 s. The push waited for the background gate to pass before starting (670 s), which avoided the bundle-check race that stopped the two previous ships.