@clear-capabilities/agentic-security-scanner 0.84.1 → 0.118.2

package/src/ir/.agentic-security/threat-model.json

@@ -0,0 +1,143 @@
+{
+  "entities": [],
+  "boundaries": [],
+  "assets": [],
+  "threats": [
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-915",
+      "family": "mass-assignment",
+      "severity": "high",
+      "file": "parser-cs.js",
+      "vuln": "Mass Assignment (req.body Direct to Model)",
+      "finding_id": "struct:parser-cs.js:208:Mass_Assignment_(req.body_Direct_to_Model)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-915",
+      "family": "mass-assignment",
+      "severity": "high",
+      "file": "parser-go.js",
+      "vuln": "Mass Assignment (req.body Direct to Model)",
+      "finding_id": "struct:parser-go.js:253:Mass_Assignment_(req.body_Direct_to_Model)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-915",
+      "family": "mass-assignment",
+      "severity": "high",
+      "file": "parser-kt.js",
+      "vuln": "Mass Assignment (req.body Direct to Model)",
+      "finding_id": "struct:parser-kt.js:207:Mass_Assignment_(req.body_Direct_to_Model)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-915",
+      "family": "mass-assignment",
+      "severity": "high",
+      "file": "parser-php.js",
+      "vuln": "Mass Assignment (req.body Direct to Model)",
+      "finding_id": "struct:parser-php.js:209:Mass_Assignment_(req.body_Direct_to_Model)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-915",
+      "family": "mass-assignment",
+      "severity": "high",
+      "file": "parser-rb.js",
+      "vuln": "Mass Assignment (req.body Direct to Model)",
+      "finding_id": "struct:parser-rb.js:201:Mass_Assignment_(req.body_Direct_to_Model)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "medium",
+      "file": "cpp-preprocessor.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:cpp-preprocessor.js:94:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "medium",
+      "file": "type-stubs.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:type-stubs.js:48:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "medium",
+      "file": "parser-py-cst.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:parser-py-cst.js:91:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "crypto-weak-hash",
+      "severity": "medium",
+      "file": "parser-py.helper.py",
+      "line": 68,
+      "vuln": "Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used",
+      "finding_id": "crypto-weak-hash:parser-py.helper.py:68",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "medium",
+      "file": "type-stubs.js",
+      "line": 48,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:type-stubs.js:48",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-176",
+      "family": "path-normalization",
+      "severity": "medium",
+      "file": "universal-ir.js",
+      "line": 93,
+      "vuln": "Path Normalization Gap — extension extraction without null-byte/traversal sanitization",
+      "finding_id": "path-norm:universal-ir.js:93",
+      "affectsAsset": null,
+      "atEntity": null
+    }
+  ],
+  "attackTrees": []
+}

package/src/ir/.agentic-security/threat-model.md

@@ -0,0 +1,39 @@
+# Threat Model (auto-generated)
+
+Generated by agentic-security on 2026-05-31.
+
+This threat model is derived from static analysis of the current codebase and is regenerated on every scan. It is intended as a working artifact, not a finished compliance document.
+
+## Entities + boundaries
+
+```mermaid
+flowchart TB
+  subgraph External
+  end
+  subgraph Application
+  end
+```
+
+## Assets
+
+
+## STRIDE threats
+
+### Tampering (10)
+
+- [high] **mass-assignment** (CWE-915) at `parser-cs.js:undefined` — Mass Assignment (req.body Direct to Model)
+- [high] **mass-assignment** (CWE-915) at `parser-go.js:undefined` — Mass Assignment (req.body Direct to Model)
+- [high] **mass-assignment** (CWE-915) at `parser-kt.js:undefined` — Mass Assignment (req.body Direct to Model)
+- [high] **mass-assignment** (CWE-915) at `parser-php.js:undefined` — Mass Assignment (req.body Direct to Model)
+- [high] **mass-assignment** (CWE-915) at `parser-rb.js:undefined` — Mass Assignment (req.body Direct to Model)
+- [medium] **dos-sync-io** (CWE-400) at `cpp-preprocessor.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [medium] **dos-sync-io** (CWE-400) at `type-stubs.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [medium] **dos-sync-io** (CWE-400) at `parser-py-cst.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
+- [medium] **toctou-file-existence-permission-check-b** (CWE-367) at `type-stubs.js:48` — TOCTOU: file existence/permission check before open
+- [medium] **path-normalization** (CWE-176) at `universal-ir.js:93` — Path Normalization Gap — extension extraction without null-byte/traversal sanitization
+
+### Information Disclosure (1)
+
+- [medium] **crypto-weak-hash** (CWE-327) at `parser-py.helper.py:68` — Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used
+
+## Attack trees

package/src/ir/CLAUDE.md

@@ -11,6 +11,7 @@ consumed by `scanner/src/dataflow/` for taint analysis.
 | Python   | `parser-py-cst.js`    | Python 3.8+ stdlib `ast` via subprocess (default when available) |
 | Python   | `parser-py.js`        | Hand-rolled regex parser (fallback when python3 missing) |
 | Java     | `parser-java.js`      | `java-parser` npm package (async)                |
+| Long-tail (rust/solidity/cpp/c/go/swift/dart) | `tree-sitter-loader.js` | **Optional** `web-tree-sitter` + `tree-sitter-wasms` (ABI-pinned 0.20.8 ↔ 0.1.13), lazy + degrades when absent. Powers `sast/tree-sitter-sinks.js` (opt-in via `AGENTIC_SECURITY_TREE_SITTER=1`). Marked `--external` in the build so the committed bundle never embeds WASM. |
 
 ## Python parser — dual-path with auto fallback
 

package/src/ir/callgraph.js

@@ -67,8 +67,19 @@ export function buildCallGraph(perFileIR, fileContents) {
   // the call graph for the callee's qid at the assign-from-call site.
   // Same precedence as the edge resolution above (same-file ident wins,
   // ClassName.method falls back).
-  function resolve(name) {
+  function resolve(name, callerFile) {
     if (!name || typeof name !== 'string') return null;
+    // Roadmap #3: same-file preference. A bare name (`handler`, `save`,
+    // `query`) defined in several files would otherwise resolve to whichever
+    // file Map is iterated first, mis-targeting interprocedural taint to a
+    // same-named function in an unrelated file. When the caller's own file
+    // defines the name, that is overwhelmingly the intended callee — prefer
+    // it. Backward-compatible: with no callerFile (or no local match) the
+    // original resolution order is unchanged, so no edge is ever dropped.
+    if (callerFile) {
+      const local = byNameInFile.get(callerFile);
+      if (local && local.has(name)) return local.get(name);
+    }
     for (const m of byNameInFile.values()) {
       if (m.has(name)) return m.get(name);
     }

package/src/ir/tree-sitter-loader.js

@@ -0,0 +1,108 @@
+// Tree-sitter parser loader (roadmap #8) — OPTIONAL, runtime-lazy, degrades.
+//
+// web-tree-sitter + tree-sitter-wasms are OPTIONAL dependencies (pinned to an
+// ABI-matched pair: web-tree-sitter 0.20.8 ↔ tree-sitter-wasms 0.1.13). They
+// are NOT bundled into dist (the build marks them `--external`), so the
+// committed bundle stays self-contained and small; this loader requires them
+// lazily at runtime and returns null when they're absent. That keeps the
+// scanner fully bootable offline / without the optional deps — long-tail
+// languages simply fall back to the existing pattern detectors.
+//
+// Long-tail languages this unlocks (no first-class IR parser today):
+// rust, solidity, cpp, c, go, swift, dart. (js/ts/py/java/etc. already have
+// dedicated IR parsers and don't need this.)
+
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+// language → prebuilt grammar wasm shipped by tree-sitter-wasms.
+const GRAMMAR_WASM = {
+  rust: 'tree-sitter-rust.wasm',
+  solidity: 'tree-sitter-solidity.wasm',
+  cpp: 'tree-sitter-cpp.wasm',
+  c: 'tree-sitter-c.wasm',
+  go: 'tree-sitter-go.wasm',
+  swift: 'tree-sitter-swift.wasm',
+  dart: 'tree-sitter-dart.wasm',
+};
+
+const EXT_TO_LANG = {
+  rs: 'rust', sol: 'solidity', cpp: 'cpp', cc: 'cpp', cxx: 'cpp', hpp: 'cpp',
+  c: 'c', h: 'c', go: 'go', swift: 'swift', dart: 'dart',
+};
+
+export function treeSitterLangOf(file) {
+  if (typeof file !== 'string') return null;
+  const ext = file.split('.').pop().toLowerCase();
+  return EXT_TO_LANG[ext] || null;
+}
+
+let _Parser; // undefined = not tried, null = unavailable, fn = the class
+let _initPromise = null;
+const _langCache = new Map(); // language → Language | null
+const _parserCache = new Map(); // language → Parser | null
+
+async function _ensureRuntime() {
+  if (_Parser === null) return null;
+  if (_Parser) return _Parser;
+  try {
+    // 0.20 API: the module's default export IS the Parser class.
+    const mod = require('web-tree-sitter');
+    _Parser = mod && (mod.Parser || mod.default || mod);
+    if (!_initPromise) _initPromise = _Parser.init();
+    await _initPromise;
+    return _Parser;
+  } catch {
+    _Parser = null; // optional dep absent or failed to init → degrade.
+    return null;
+  }
+}
+
+function _grammarPath(language) {
+  const file = GRAMMAR_WASM[language];
+  if (!file) return null;
+  try { return require.resolve('tree-sitter-wasms/out/' + file); } catch { return null; }
+}
+
+// Returns a ready-to-use Parser for `language`, or null if tree-sitter or the
+// grammar isn't available. Cached per language. `parser.parse(src)` is then
+// synchronous, so callers can parse inside a sync loop after awaiting this.
+export async function getParserFor(language) {
+  if (_parserCache.has(language)) return _parserCache.get(language);
+  const Parser = await _ensureRuntime();
+  if (!Parser) { _parserCache.set(language, null); return null; }
+  try {
+    let Lang = _langCache.get(language);
+    if (Lang === undefined) {
+      const wasm = _grammarPath(language);
+      Lang = wasm ? await Parser.Language.load(wasm) : null;
+      _langCache.set(language, Lang);
+    }
+    if (!Lang) { _parserCache.set(language, null); return null; }
+    const p = new Parser();
+    p.setLanguage(Lang);
+    _parserCache.set(language, p);
+    return p;
+  } catch {
+    _parserCache.set(language, null);
+    return null;
+  }
+}
+
+export async function isTreeSitterAvailable() {
+  return (await _ensureRuntime()) != null;
+}
+
+// Walk every named node, invoking cb(node). Iterative to avoid deep recursion.
+export function walkNamed(root, cb) {
+  if (!root) return;
+  const stack = [root];
+  while (stack.length) {
+    const n = stack.pop();
+    cb(n);
+    for (let i = n.namedChildCount - 1; i >= 0; i--) stack.push(n.namedChild(i));
+  }
+}
+
+export const _internals = { GRAMMAR_WASM, EXT_TO_LANG, _grammarPath };

package/src/posture/.agentic-security/dpia.md

@@ -0,0 +1,26 @@
+# Data Protection Impact Assessment (DPIA)
+
+Generated by agentic-security scanner on 2026-05-31.
+
+This is an automated DPIA scaffold derived from static analysis.
+It must be reviewed and completed by a privacy officer before use.
+
+## Data classes identified
+
+## Privacy-related findings
+
+| Severity | File:Line | Class → Sink | Description |
+|---|---|---|---|
+
+## Regulatory framework mapping
+
+- **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
+- **CCPA §1798.130** — Notice + access rights for collected personal information.
+
+## Reviewer checklist
+
+- [ ] Confirm each PII field's collection has a documented lawful basis
+- [ ] Confirm retention period for each class is documented
+- [ ] Confirm DSAR (data subject access request) workflow exists
+- [ ] Confirm encryption at rest + in transit for each class
+- [ ] Confirm logging of PII access for audit (where applicable)

package/src/posture/.agentic-security/pqc-migration-plan.json

@@ -0,0 +1,65 @@
+{
+  "generatedAt": "2026-05-31T14:14:14.017Z",
+  "summary": {
+    "total": 1,
+    "hndlCritical": 0,
+    "standard": 1,
+    "filesAffected": 1,
+    "primitivesNeeded": [
+      "ML-DSA-65"
+    ]
+  },
+  "milestones": [
+    {
+      "id": "M1",
+      "title": "Inventory & policy",
+      "target": "90 days",
+      "owner": "security",
+      "items": [
+        "Confirm scanner findings against design docs",
+        "Adopt PQC migration policy (CNSA 2.0 / NIST IR 8547 alignment)",
+        "Establish KMS support for hybrid keys"
+      ]
+    },
+    {
+      "id": "M2",
+      "title": "HNDL-critical paths to PQ-hybrid",
+      "target": "180 days",
+      "owner": "platform",
+      "items": []
+    },
+    {
+      "id": "M3",
+      "title": "Standard signing/KEX migration",
+      "target": "12 months",
+      "owner": "platform",
+      "items": [
+        {
+          "finding": "pqc-ed25519:rule-pack-signing.js:187",
+          "file": "rule-pack-signing.js",
+          "line": 187,
+          "replacement": "ML-DSA-65"
+        }
+      ]
+    },
+    {
+      "id": "M4",
+      "title": "Deprecate classical primitives",
+      "target": "24 months",
+      "owner": "security",
+      "items": [
+        "Remove dual-stack libraries once peers are PQ-capable",
+        "Rotate root CA / long-lived signing keys to ML-DSA"
+      ]
+    }
+  ],
+  "perFile": {
+    "rule-pack-signing.js": {
+      "count": 1,
+      "subfamilies": [
+        "pqc-ed25519"
+      ],
+      "hndlCritical": false
+    }
+  }
+}

package/src/posture/.agentic-security/pqc-migration-plan.md

@@ -0,0 +1,30 @@
+# Post-quantum cryptography migration plan
+
+Generated 2026-05-31.
+
+**1** pre-quantum primitive sites across **1** files.  
+HNDL-critical: **0** | Standard: **1**
+
+## Recommended PQ primitives
+- ML-DSA-65
+
+## M1 — Inventory & policy (target 90 days, owner security)
+- Confirm scanner findings against design docs
+- Adopt PQC migration policy (CNSA 2.0 / NIST IR 8547 alignment)
+- Establish KMS support for hybrid keys
+
+## M2 — HNDL-critical paths to PQ-hybrid (target 180 days, owner platform)
+
+## M3 — Standard signing/KEX migration (target 12 months, owner platform)
+- `rule-pack-signing.js:187` → ML-DSA-65
+
+## M4 — Deprecate classical primitives (target 24 months, owner security)
+- Remove dual-stack libraries once peers are PQ-capable
+- Rotate root CA / long-lived signing keys to ML-DSA
+
+## References
+- NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA)
+- NIST IR 8547 — Transition to Post-Quantum Cryptographic Standards
+- CNSA 2.0 — Commercial National Security Algorithm Suite, Sept 2022
+- RFC 9794 — X25519MLKEM768 hybrid key exchange for TLS 1.3
+- Open Quantum Safe project (liboqs, oqs-provider for OpenSSL 3)

package/src/posture/.agentic-security/sbom-history/0724c133d2943c87555695b5b2adcfcfc3373a2d.json

@@ -0,0 +1,6 @@
+{
+  "sha": "0724c133d2943c87555695b5b2adcfcfc3373a2d",
+  "ts": "2026-05-30T17:55:31.746Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/posture/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json

@@ -0,0 +1,6 @@
+{
+  "sha": "7d45b5e03804aac084b4a2b4dc8c6f10107d2005",
+  "ts": "2026-05-30T05:08:00.812Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/posture/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json

@@ -0,0 +1,6 @@
+{
+  "sha": "99c372cdc33ecc9dde92960b4ffadf7775860e61",
+  "ts": "2026-05-31T14:14:14.016Z",
+  "componentCount": 0,
+  "components": []
+}

package/src/posture/.agentic-security/sbom-history/b7ac2dada4a9216ccfe8969fc57f988c83f46975.json

@@ -0,0 +1,6 @@
+{
+  "sha": "b7ac2dada4a9216ccfe8969fc57f988c83f46975",
+  "ts": "2026-05-31T05:25:45.025Z",
+  "componentCount": 0,
+  "components": []
+}