@oculum/scanner 1.0.12 → 1.0.13

package/src/__tests__/score/confidence.test.ts

@@ -0,0 +1,283 @@
+/**
+ * Unit tests for computeConfidence()
+ */
+
+import { computeConfidence } from '../../score/confidence'
+import type { Vulnerability } from '../../shared/types'
+import type { AdjustmentRule, AdjustmentContext, DepthConfig } from '../../score/types'
+
+// Helper to create a minimal finding
+function makeFinding(overrides: Partial<Vulnerability> = {}): Vulnerability {
+  return {
+    id: 'test-1',
+    filePath: 'src/app.ts',
+    lineNumber: 10,
+    lineContent: 'const secret = "sk-abc123"',
+    severity: 'medium',
+    category: 'hardcoded_secret',
+    title: 'Hardcoded secret',
+    description: 'Found a hardcoded secret',
+    confidence: 'medium',
+    layer: 1,
+    baseConfidence: 0.70,
+    ...overrides,
+  }
+}
+
+// Helper to create a minimal context
+function makeContext(overrides: Partial<AdjustmentContext> = {}): AdjustmentContext {
+  return {
+    file: {
+      isTestFile: false,
+      isExampleFile: false,
+      isDocFile: false,
+      isScannerCode: false,
+      isToolingDir: false,
+      isServerOnly: false,
+      isClientBundled: false,
+    },
+    project: {
+      hasAuthMiddleware: false,
+      hasTypeScript: true,
+      orm: null,
+      validationLib: null,
+    },
+    lineContent: 'const secret = "sk-abc123"',
+    filePath: 'src/app.ts',
+    ...overrides,
+  }
+}
+
+// Standard depth configs for testing
+const DEPTH_VERIFIED: DepthConfig = {
+  surfaceThreshold: 0.70,
+  validateThreshold: 0.30,
+  aiEnabled: true,
+}
+
+const DEPTH_LOCAL: DepthConfig = {
+  surfaceThreshold: 0.70,
+  validateThreshold: 1.0,
+  aiEnabled: false,
+}
+
+const DEPTH_DEEP: DepthConfig = {
+  surfaceThreshold: 0.70,
+  validateThreshold: 0.10,
+  aiEnabled: true,
+}
+
+describe('computeConfidence', () => {
+  describe('basic score computation', () => {
+    it('returns base confidence when no rules match', () => {
+      const finding = makeFinding({ baseConfidence: 0.70 })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
+
+      expect(result.score).toBe(0.70)
+      expect(result.base).toBe(0.70)
+      expect(result.adjustments).toEqual([])
+    })
+
+    it('applies a single negative adjustment', () => {
+      const finding = makeFinding({ baseConfidence: 0.70 })
+      const context = makeContext()
+      const rules: AdjustmentRule[] = [{
+        name: 'test_file',
+        source: 'file_context',
+        applies: () => true,
+        delta: -0.35,
+        reason: 'Test file',
+      }]
+
+      const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
+      expect(result.score).toBe(0.35)
+      expect(result.adjustments).toHaveLength(1)
+      expect(result.adjustments[0].delta).toBe(-0.35)
+    })
+
+    it('applies multiple adjustments', () => {
+      const finding = makeFinding({ baseConfidence: 0.50 })
+      const context = makeContext()
+      const rules: AdjustmentRule[] = [
+        { name: 'a', source: 'file_context', applies: () => true, delta: -0.10, reason: 'A' },
+        { name: 'b', source: 'auto_dismiss', applies: () => true, delta: -0.20, reason: 'B' },
+      ]
+
+      const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
+      expect(result.score).toBeCloseTo(0.20, 10)
+      expect(result.adjustments).toHaveLength(2)
+    })
+
+    it('skips rules that do not apply', () => {
+      const finding = makeFinding({ baseConfidence: 0.50 })
+      const context = makeContext()
+      const rules: AdjustmentRule[] = [
+        { name: 'matches', source: 'file_context', applies: () => true, delta: -0.10, reason: 'yes' },
+        { name: 'no_match', source: 'file_context', applies: () => false, delta: -0.30, reason: 'no' },
+      ]
+
+      const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
+      expect(result.score).toBe(0.40)
+      expect(result.adjustments).toHaveLength(1)
+    })
+  })
+
+  describe('score clamping', () => {
+    it('clamps score at 0.0 when adjustments drive it negative', () => {
+      const finding = makeFinding({ baseConfidence: 0.20 })
+      const context = makeContext()
+      const rules: AdjustmentRule[] = [
+        { name: 'big_negative', source: 'file_context', applies: () => true, delta: -0.50, reason: 'large penalty' },
+      ]
+
+      const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
+      expect(result.score).toBe(0.0)
+    })
+
+    it('clamps score at 1.0 when adjustments exceed maximum', () => {
+      const finding = makeFinding({ baseConfidence: 0.80 })
+      const context = makeContext()
+      const rules: AdjustmentRule[] = [
+        { name: 'big_positive', source: 'detector', applies: () => true, delta: 0.50, reason: 'boost' },
+      ]
+
+      const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
+      expect(result.score).toBe(1.0)
+    })
+  })
+
+  describe('default base confidence', () => {
+    it('uses 0.35 when baseConfidence is undefined', () => {
+      const finding = makeFinding({ baseConfidence: undefined })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
+
+      expect(result.score).toBe(0.35)
+      expect(result.base).toBe(0.35)
+    })
+  })
+
+  describe('routing thresholds', () => {
+    it('routes to surface when score >= surfaceThreshold', () => {
+      const finding = makeFinding({ baseConfidence: 0.70 })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
+
+      expect(result.routing).toBe('surface')
+    })
+
+    it('routes to validate when score >= validateThreshold and AI enabled', () => {
+      const finding = makeFinding({ baseConfidence: 0.50 })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
+
+      expect(result.routing).toBe('validate')
+    })
+
+    it('routes to suppress when score < validateThreshold', () => {
+      const finding = makeFinding({ baseConfidence: 0.20 })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
+
+      expect(result.routing).toBe('suppress')
+    })
+
+    it('routes to suppress in local mode even when score could validate', () => {
+      const finding = makeFinding({ baseConfidence: 0.50 })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_LOCAL)
+
+      // 0.50 < surfaceThreshold(0.70), validateThreshold(1.0) unreachable, aiEnabled=false
+      expect(result.routing).toBe('suppress')
+    })
+
+    it('routes to validate in deep mode with very low threshold', () => {
+      const finding = makeFinding({ baseConfidence: 0.15 })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_DEEP)
+
+      // 0.15 >= validateThreshold(0.10) and aiEnabled=true
+      expect(result.routing).toBe('validate')
+    })
+  })
+
+  describe('worked examples', () => {
+    // Example 1: Known API key in production code (high confidence, surfaces directly)
+    it('surfaces a known API key in production code', () => {
+      const finding = makeFinding({ baseConfidence: 0.70, category: 'hardcoded_secret' })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
+
+      expect(result.score).toBe(0.70)
+      expect(result.routing).toBe('surface')
+    })
+
+    // Example 2: Known API key in test file (adjusted down, validate or suppress)
+    it('adjusts down a known API key in test file', () => {
+      const finding = makeFinding({ baseConfidence: 0.70, category: 'hardcoded_secret' })
+      const context = makeContext()
+      const rules: AdjustmentRule[] = [{
+        name: 'test_file',
+        source: 'file_context',
+        applies: () => true,
+        delta: -0.35,
+        reason: 'Test file',
+      }]
+
+      const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
+      // 0.70 - 0.35 = 0.35 → validate
+      expect(result.score).toBe(0.35)
+      expect(result.routing).toBe('validate')
+    })
+
+    // Example 3: Entropy finding in scanner code (suppressed)
+    it('suppresses entropy finding in scanner code', () => {
+      const finding = makeFinding({ baseConfidence: 0.30, category: 'high_entropy_string' })
+      const context = makeContext()
+      const rules: AdjustmentRule[] = [{
+        name: 'scanner_code',
+        source: 'file_context',
+        applies: () => true,
+        delta: -0.30,
+        reason: 'Scanner code',
+      }]
+
+      const result = computeConfidence(finding, context, rules, DEPTH_VERIFIED)
+      // 0.30 - 0.30 = 0.00 → suppress
+      expect(result.score).toBe(0.00)
+      expect(result.routing).toBe('suppress')
+    })
+
+    // Example 4: Comment finding (experimental equivalent, suppressed)
+    it('suppresses a comment finding (low base confidence)', () => {
+      const finding = makeFinding({ baseConfidence: 0.15, category: 'ai_pattern' })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
+
+      // 0.15 < validateThreshold(0.30) → suppress
+      expect(result.routing).toBe('suppress')
+    })
+
+    // Example 5: SSRF detection surfaces at verified depth
+    it('routes SSRF detection to validate at verified depth', () => {
+      const finding = makeFinding({ baseConfidence: 0.40, category: 'ssrf' })
+      const context = makeContext()
+      const result = computeConfidence(finding, context, [], DEPTH_VERIFIED)
+
+      // 0.40 >= validateThreshold(0.30) → validate
+      expect(result.routing).toBe('validate')
+    })
+
+    // Example 6: XXE detection surfaces directly
+    it('routes XXE detection to surface when base is high enough', () => {
+      const finding = makeFinding({ baseConfidence: 0.55, category: 'xxe' })
+      const context = makeContext()
+      // With a surface threshold of 0.55:
+      const customDepth: DepthConfig = { surfaceThreshold: 0.55, validateThreshold: 0.30, aiEnabled: true }
+      const result = computeConfidence(finding, context, [], customDepth)
+
+      expect(result.routing).toBe('surface')
+    })
+  })
+})

package/src/__tests__/score/framework-scoring.test.ts

@@ -0,0 +1,275 @@
+/**
+ * Tests for framework adjustment rules in the confidence scoring system.
+ */
+
+import { FRAMEWORK_RULES } from '../../score/adjustments'
+import type { AdjustmentContext } from '../../score/types'
+import type { Vulnerability } from '../../shared/types'
+
+function makeFinding(overrides: Partial<Vulnerability> = {}): Vulnerability {
+  return {
+    id: 'test-1',
+    filePath: 'src/app.tsx',
+    lineNumber: 10,
+    lineContent: '<div>{userData}</div>',
+    severity: 'medium',
+    category: 'xss',
+    title: 'Test finding',
+    description: 'Test',
+    confidence: 'medium',
+    layer: 2,
+    baseConfidence: 0.50,
+    ...overrides,
+  }
+}
+
+function makeContext(overrides: Partial<AdjustmentContext> = {}): AdjustmentContext {
+  return {
+    file: {
+      isTestFile: false,
+      isExampleFile: false,
+      isDocFile: false,
+      isScannerCode: false,
+      isToolingDir: false,
+      isServerOnly: false,
+      isClientBundled: false,
+    },
+    project: {
+      hasAuthMiddleware: false,
+      hasTypeScript: true,
+      orm: null,
+      validationLib: null,
+    },
+    lineContent: '<div>{userData}</div>',
+    filePath: 'src/app.tsx',
+    ...overrides,
+  }
+}
+
+function findRule(name: string) {
+  return FRAMEWORK_RULES.find(r => r.name === name)
+}
+
+describe('Framework Adjustment Rules', () => {
+  it('has exactly 3 rules', () => {
+    expect(FRAMEWORK_RULES).toHaveLength(3)
+  })
+
+  describe('framework_auto_protects', () => {
+    const rule = findRule('framework_auto_protects')!
+
+    it('fires when safePatternMatch is present (non-ORM)', () => {
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'react_jsx_auto_escape', reason: 'JSX auto-escapes' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['react'],
+          orm: null,
+        },
+      })
+      expect(rule.applies(makeFinding(), ctx)).toBe(true)
+    })
+
+    it('does not fire when no framework context', () => {
+      const ctx = makeContext()
+      expect(rule.applies(makeFinding(), ctx)).toBe(false)
+    })
+
+    it('does not fire when safePatternMatch is null', () => {
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: null,
+          unsafePatternMatch: null,
+          activeFrameworks: ['react'],
+          orm: null,
+        },
+      })
+      expect(rule.applies(makeFinding(), ctx)).toBe(false)
+    })
+
+    it('does not fire when safePatternMatch starts with orm_', () => {
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'orm_sequelize_parameterised', reason: 'ORM parameterises' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['express'],
+          orm: 'sequelize',
+        },
+      })
+      expect(rule.applies(makeFinding(), ctx)).toBe(false)
+    })
+
+    it('fires for non-ORM patterns like nextjs_server_component', () => {
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'nextjs_server_component_no_dom', reason: 'Server Component' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['nextjs'],
+          orm: null,
+        },
+      })
+      expect(rule.applies(makeFinding(), ctx)).toBe(true)
+    })
+
+    it('has delta -0.30', () => {
+      expect(rule.delta).toBe(-0.30)
+    })
+
+    it('has source "framework"', () => {
+      expect(rule.source).toBe('framework')
+    })
+  })
+
+  describe('framework_unsafe_pattern', () => {
+    const rule = findRule('framework_unsafe_pattern')!
+
+    it('fires when unsafePatternMatch is present', () => {
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: null,
+          unsafePatternMatch: { id: 'react_dangerous_inner_html', reason: 'bypasses escaping' },
+          activeFrameworks: ['react'],
+          orm: null,
+        },
+      })
+      expect(rule.applies(makeFinding(), ctx)).toBe(true)
+    })
+
+    it('does not fire when unsafePatternMatch is null', () => {
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: null,
+          unsafePatternMatch: null,
+          activeFrameworks: ['react'],
+          orm: null,
+        },
+      })
+      expect(rule.applies(makeFinding(), ctx)).toBe(false)
+    })
+
+    it('has delta +0.10', () => {
+      expect(rule.delta).toBe(+0.10)
+    })
+  })
+
+  describe('orm_safe_query', () => {
+    const rule = findRule('orm_safe_query')!
+
+    it('fires for sql_injection with ORM safe pattern', () => {
+      const finding = makeFinding({ category: 'sql_injection' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'orm_sequelize_parameterised', reason: 'ORM parameterises' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['express'],
+          orm: 'sequelize',
+        },
+      })
+      expect(rule.applies(finding, ctx)).toBe(true)
+    })
+
+    it('fires for dangerous_function with ORM safe pattern', () => {
+      const finding = makeFinding({ category: 'dangerous_function' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'orm_django_parameterised', reason: 'Django ORM parameterises' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['django'],
+          orm: 'django',
+        },
+      })
+      expect(rule.applies(finding, ctx)).toBe(true)
+    })
+
+    it('does not fire for non-SQL categories', () => {
+      const finding = makeFinding({ category: 'xss' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'orm_sequelize_parameterised', reason: 'ORM parameterises' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['express'],
+          orm: 'sequelize',
+        },
+      })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+
+    it('does not fire without ORM', () => {
+      const finding = makeFinding({ category: 'sql_injection' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'orm_sequelize_parameterised', reason: 'ORM parameterises' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['express'],
+          orm: null,
+        },
+      })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+
+    it('does not fire when safe pattern is not ORM-prefixed', () => {
+      const finding = makeFinding({ category: 'sql_injection' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'react_jsx_auto_escape', reason: 'JSX escapes' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['react'],
+          orm: 'sequelize',
+        },
+      })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+
+    it('has delta -0.25', () => {
+      expect(rule.delta).toBe(-0.25)
+    })
+  })
+
+  describe('rule interactions', () => {
+    it('ORM patterns: only orm_safe_query fires (not framework_auto_protects)', () => {
+      const finding = makeFinding({ category: 'sql_injection' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'orm_sequelize_parameterised', reason: 'ORM parameterises' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['express'],
+          orm: 'sequelize',
+        },
+      })
+      const autoProtects = findRule('framework_auto_protects')!
+      const ormSafe = findRule('orm_safe_query')!
+      // framework_auto_protects should NOT fire for ORM patterns
+      expect(autoProtects.applies(finding, ctx)).toBe(false)
+      // orm_safe_query should fire
+      expect(ormSafe.applies(finding, ctx)).toBe(true)
+      // Only -0.25, not -0.55
+      expect(ormSafe.delta).toBe(-0.25)
+    })
+
+    it('non-ORM patterns: framework_auto_protects fires normally', () => {
+      const finding = makeFinding({ category: 'xss' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'react_jsx_auto_escape', reason: 'JSX escapes' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['react'],
+          orm: null,
+        },
+      })
+      const autoProtects = findRule('framework_auto_protects')!
+      const ormSafe = findRule('orm_safe_query')!
+      // framework_auto_protects fires for non-ORM safe patterns
+      expect(autoProtects.applies(finding, ctx)).toBe(true)
+      // orm_safe_query does NOT fire (wrong category and not ORM-prefixed)
+      expect(ormSafe.applies(finding, ctx)).toBe(false)
+    })
+
+    it('no framework rules fire without framework context', () => {
+      const finding = makeFinding()
+      const ctx = makeContext()
+      for (const rule of FRAMEWORK_RULES) {
+        expect(rule.applies(finding, ctx)).toBe(false)
+      }
+    })
+  })
+})