agentic-qe 3.15.11 → 3.15.13

package/dist/domains/security-compliance/services/scanners/dast-injection-testing.js

@@ -3,24 +3,25 @@
  * XSS and SQL injection testing utilities
  */
 import { v4 as uuidv4 } from 'uuid';
+import { probe } from './dast-requests.js';
 // ============================================================================
 // Injection Testing
 // ============================================================================
 /**
  * Test for XSS vulnerabilities
  */
-export async function testXSS(targetUrl, parsedUrl, paramName, payloads, vulnerabilities) {
+export async function testXSS(targetUrl, parsedUrl, paramName, payloads, vulnerabilities, failures) {
     for (const xss of payloads) {
         const testParams = new URLSearchParams(parsedUrl.search);
         testParams.set(paramName, xss.payload);
         const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
-        const response = await fetch(testUrl, {
+        const response = await probe(testUrl, {
             method: 'GET',
             headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
             signal: AbortSignal.timeout(5000),
-        });
-        if (response.ok) {
-            const text = await response.text();
+        }, failures);
+        if (response?.ok) {
+            const text = response.text;
             const escapedPayload = xss.payload
                 .replace(/&/g, '&')
                 .replace(/</g, '&lt;')
@@ -48,7 +49,7 @@ export async function testXSS(targetUrl, parsedUrl, paramName, payloads, vulnera
 /**
  * Test for SQL injection vulnerabilities
  */
-export async function testSQLi(targetUrl, parsedUrl, paramName, payloads, vulnerabilities) {
+export async function testSQLi(targetUrl, parsedUrl, paramName, payloads, vulnerabilities, failures) {
     const sqlErrorPatterns = [
         /SQL syntax.*MySQL/i,
         /Warning.*mysql/i,
@@ -63,12 +64,15 @@ export async function testSQLi(targetUrl, parsedUrl, paramName, payloads, vulner
         const testParams = new URLSearchParams(parsedUrl.search);
         testParams.set(paramName, sqli.payload);
         const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
-        const response = await fetch(testUrl, {
+        // SQL errors often come back as HTTP 500: that body is analysed.
+        const response = await probe(testUrl, {
             method: 'GET',
             headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
             signal: AbortSignal.timeout(5000),
-        });
-        const text = await response.text();
+        }, failures, { analyzeServerErrors: true });
+        if (!response)
+            continue;
+        const text = response.text;
         for (const pattern of sqlErrorPatterns) {
             if (pattern.test(text)) {
                 vulnerabilities.push({

package/dist/domains/security-compliance/services/scanners/dast-requests.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Agentic QE v3 - DAST request outcomes (#1092, #1135)
+ * Classifies what a DAST request did not answer, so a failed or partial scan
+ * is reported as such and never as a scan that found nothing.
+ */
+import type { DASTRequestFailure } from './scanner-types.js';
+/** Error carrying a DAST failure code. */
+export type DASTError = Error & {
+    code: string;
+};
+export declare function dastError(message: string, code: string, cause?: unknown): DASTError;
+export declare function isDastError(error: unknown): error is DASTError;
+/**
+ * The scan subject must be an http(s) URL. Anything else is a validation
+ * error, not a completed scan with a synthetic finding (#1135).
+ */
+export declare function parseDastTarget(targetUrl: string): URL;
+/**
+ * A response status that says nothing about the target's security: the request
+ * was refused, throttled or not served. Findings from such a page would be the
+ * headers of the error page (#1092, #1135).
+ */
+export declare function unansweredStatus(status: number): {
+    code: string;
+    label: string;
+} | null;
+/** Throws when the initial response cannot be scanned. */
+export declare function assertScannableResponse(status: number): void;
+/** Transport failure classification; TLS failures are told apart from a closed port (#1135). */
+export declare function classifyRequestError(error: unknown): {
+    code: string;
+    reason: string;
+};
+/** Transport failures are execution errors, not absence of vulnerabilities. */
+export declare function dastRequestFailure(error: unknown): DASTError;
+export interface ProbeResponse {
+    readonly status: number;
+    readonly ok: boolean;
+    readonly headers: Headers;
+    readonly text: string;
+}
+export interface ProbeOptions {
+    /** A 5xx body is analysed (SQL error pages), not counted as unanswered. */
+    readonly analyzeServerErrors?: boolean;
+}
+/**
+ * A follow-up probe. When the target does not answer it (transport failure,
+ * timeout, 407/408/429, or 5xx unless `analyzeServerErrors`), the failure is
+ * recorded in `failures` and null is returned so the remaining probes still
+ * run and the scan is reported incomplete (#1135). Without `failures`, it throws.
+ */
+export declare function probe(url: string, init: RequestInit, failures?: DASTRequestFailure[], options?: ProbeOptions): Promise<ProbeResponse | null>;
+export declare function summarizeFailures(failures: readonly DASTRequestFailure[]): string;
+//# sourceMappingURL=dast-requests.d.ts.map

package/dist/domains/security-compliance/services/scanners/dast-requests.js

@@ -0,0 +1,125 @@
+/**
+ * Agentic QE v3 - DAST request outcomes (#1092, #1135)
+ * Classifies what a DAST request did not answer, so a failed or partial scan
+ * is reported as such and never as a scan that found nothing.
+ */
+export function dastError(message, code, cause) {
+    return Object.assign(new Error(message, cause === undefined ? undefined : { cause }), { code });
+}
+export function isDastError(error) {
+    return error instanceof Error && 'code' in error && /^DAST_[A-Z_]+$/.test(String(error.code));
+}
+/**
+ * The scan subject must be an http(s) URL. Anything else is a validation
+ * error, not a completed scan with a synthetic finding (#1135).
+ */
+export function parseDastTarget(targetUrl) {
+    let parsed;
+    try {
+        parsed = new URL(targetUrl);
+    }
+    catch {
+        throw dastError('DAST target is not a valid URL; no dynamic analysis ran', 'DAST_INVALID_TARGET');
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw dastError(`DAST target must be an http(s) URL, not ${parsed.protocol}; no dynamic analysis ran`, 'DAST_INVALID_TARGET');
+    }
+    return parsed;
+}
+/**
+ * A response status that says nothing about the target's security: the request
+ * was refused, throttled or not served. Findings from such a page would be the
+ * headers of the error page (#1092, #1135).
+ */
+export function unansweredStatus(status) {
+    if (status === 401 || status === 403 || status === 407)
+        return { code: 'DAST_AUTHENTICATION_FAILED', label: 'authentication rejected' };
+    if (status === 408)
+        return { code: 'DAST_REQUEST_TIMEOUT', label: 'request timed out' };
+    if (status === 429)
+        return { code: 'DAST_RATE_LIMITED', label: 'rate limited' };
+    if (status >= 500)
+        return { code: 'DAST_TARGET_UNAVAILABLE', label: 'target unavailable' };
+    return null;
+}
+/** Throws when the initial response cannot be scanned. */
+export function assertScannableResponse(status) {
+    const unanswered = unansweredStatus(status);
+    if (unanswered) {
+        throw dastError(`DAST ${unanswered.label} (HTTP ${status}); dynamic analysis is incomplete`, unanswered.code);
+    }
+}
+const TLS_CODE = /^(ERR_TLS_|ERR_SSL_|ERR_CERT_|CERT_|UNABLE_TO_(GET|VERIFY)_|DEPTH_ZERO_SELF_SIGNED_CERT$|SELF_SIGNED_CERT_IN_CHAIN$|EPROTO$)/;
+/** The errno-style code on an error or its causes (undici wraps it as `cause.code`). */
+function causeCode(error) {
+    for (let current = error, depth = 0; current && depth < 5; depth++) {
+        const code = current.code;
+        if (typeof code === 'string' && /^[A-Z0-9_]{1,48}$/.test(code))
+            return code;
+        current = current.cause;
+    }
+    return undefined;
+}
+function isTimeout(error) {
+    return error instanceof Error && (error.name === 'TimeoutError' || error.name === 'AbortError' || /timeout|abort/i.test(error.message));
+}
+/** Transport failure classification; TLS failures are told apart from a closed port (#1135). */
+export function classifyRequestError(error) {
+    const cause = causeCode(error);
+    if (isTimeout(error))
+        return { code: 'DAST_REQUEST_TIMEOUT', reason: cause ?? 'timeout' };
+    if (cause && TLS_CODE.test(cause))
+        return { code: 'DAST_TLS_FAILED', reason: cause };
+    return { code: 'DAST_REQUEST_FAILED', reason: cause ?? 'transport error' };
+}
+/** Transport failures are execution errors, not absence of vulnerabilities. */
+export function dastRequestFailure(error) {
+    if (isDastError(error))
+        return error;
+    const { code, reason } = classifyRequestError(error);
+    const what = code === 'DAST_REQUEST_TIMEOUT' ? 'request timeout'
+        : code === 'DAST_TLS_FAILED' ? 'TLS handshake failed' : 'request failed';
+    return dastError(`DAST target ${what} (${reason}); dynamic analysis is incomplete`, code, error);
+}
+/** Origin and path only: probe URLs can carry user credentials or query tokens. */
+function requestLabel(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.origin}${parsed.pathname}`;
+    }
+    catch {
+        return '(invalid url)';
+    }
+}
+/**
+ * A follow-up probe. When the target does not answer it (transport failure,
+ * timeout, 407/408/429, or 5xx unless `analyzeServerErrors`), the failure is
+ * recorded in `failures` and null is returned so the remaining probes still
+ * run and the scan is reported incomplete (#1135). Without `failures`, it throws.
+ */
+export async function probe(url, init, failures, options = {}) {
+    try {
+        const response = await fetch(url, init);
+        const unanswered = response.status >= 500 && options.analyzeServerErrors ? null : unansweredStatus(response.status);
+        // 401/403 on a probed path is an answer: the path is protected.
+        if (unanswered && response.status !== 401 && response.status !== 403) {
+            await response.body?.cancel().catch(() => undefined);
+            throw dastError(`DAST probe ${unanswered.label} (HTTP ${response.status})`, unanswered.code);
+        }
+        return { status: response.status, ok: response.ok, headers: response.headers, text: await response.text() };
+    }
+    catch (error) {
+        const failure = isDastError(error)
+            ? { code: error.code, reason: error.message.replace(/^DAST probe /, '') }
+            : classifyRequestError(error);
+        if (!failures)
+            throw isDastError(error) ? error : dastRequestFailure(error);
+        failures.push({ url: requestLabel(url), ...failure });
+        return null;
+    }
+}
+export function summarizeFailures(failures) {
+    const codes = [...new Set(failures.map(failure => failure.code))].join(', ');
+    return `${failures.length} DAST request(s) were not answered (${codes}); findings cover only the answered requests`;
+}
+//# sourceMappingURL=dast-requests.js.map

package/dist/domains/security-compliance/services/scanners/dast-scanner.d.ts

@@ -42,6 +42,11 @@ export declare class DASTScanner {
      * Get scan status
      */
     getScanStatus(scanId: string): Promise<ScanStatus>;
+    /**
+     * #1135: probes the target did not answer leave the scan incomplete. The
+     * findings already collected are real and kept; the failed URLs are listed.
+     */
+    private toResult;
     /**
      * Perform dynamic (DAST) scanning on a target URL
      */
@@ -50,7 +55,6 @@ export declare class DASTScanner {
      * Perform authenticated dynamic scanning
      */
     private performAuthenticatedScan;
-    private createInvalidUrlVuln;
     private createInsecureProtocolVuln;
     private createTokenInUrlVuln;
     /**

package/dist/domains/security-compliance/services/scanners/dast-scanner.js

@@ -7,19 +7,15 @@ import { ok, err } from '../../../../shared/types/index.js';
 import { toError } from '../../../../shared/error-utils.js';
 import { fetchWithResponseDeadline } from '../../../../shared/llm/providers/response-deadline.js';
 import { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, calculateSummary, storeScanResults, } from './dast-helpers.js';
+import { assertScannableResponse, dastError, dastRequestFailure, isDastError, parseDastTarget, summarizeFailures, unansweredStatus, } from './dast-requests.js';
 // ============================================================================
 // DAST Scanner Service
 // ============================================================================
-/** Transport failures are execution errors, not absence of vulnerabilities. */
-function dastRequestFailure(error) {
-    if (error instanceof Error && 'code' in error && ['DAST_AUTHENTICATION_FAILED', 'DAST_TARGET_UNAVAILABLE'].includes(String(error.code)))
+/** A bug in the analysis code is not a request failure (#1135). */
+function dastAnalysisFailure(error) {
+    if (isDastError(error))
         return error;
-    const timeout = error instanceof Error && /timeout|abort/i.test(error.message);
-    return Object.assign(new Error(timeout
-        ? 'DAST target request timeout; dynamic analysis is incomplete'
-        : 'DAST target request failed; dynamic analysis is incomplete'), {
-        code: timeout ? 'DAST_REQUEST_TIMEOUT' : 'DAST_REQUEST_FAILED',
-    });
+    return dastError(`DAST analysis failed (${toError(error).message}); dynamic analysis is incomplete`, 'DAST_ANALYSIS_FAILED', error);
 }
 /**
  * DAST Scanner - Dynamic Application Security Testing
@@ -72,16 +68,10 @@ export class DASTScanner {
             const result = await this.performDynamicScan(targetUrl, mergedOptions);
             const scanDurationMs = Date.now() - startTime;
             const summary = calculateSummary(result.vulnerabilities, 1, scanDurationMs);
-            // Store results
-            await storeScanResults(this.memory, scanId, 'dast', result.vulnerabilities, summary);
+            const dastResult = this.toResult(scanId, targetUrl, result, summary);
+            await storeScanResults(this.memory, scanId, 'dast', result.vulnerabilities, summary, { status: dastResult.status, failedRequests: dastResult.failedRequests });
             this.activeScans.set(scanId, 'completed');
-            return ok({
-                scanId,
-                targetUrl,
-                vulnerabilities: result.vulnerabilities,
-                summary,
-                crawledUrls: result.crawledUrls,
-            });
+            return ok(dastResult);
         }
         catch (error) {
             this.activeScans.set(scanId, 'failed');
@@ -112,15 +102,10 @@ export class DASTScanner {
             const scanDurationMs = Date.now() - startTime;
             const summary = calculateSummary(result.vulnerabilities, 1, scanDurationMs);
             // Store results (without credentials)
-            await storeScanResults(this.memory, scanId, 'dast-auth', result.vulnerabilities, summary);
+            const dastResult = this.toResult(scanId, targetUrl, result, summary);
+            await storeScanResults(this.memory, scanId, 'dast-auth', result.vulnerabilities, summary, { status: dastResult.status, failedRequests: dastResult.failedRequests });
             this.activeScans.set(scanId, 'completed');
-            return ok({
-                scanId,
-                targetUrl,
-                vulnerabilities: result.vulnerabilities,
-                summary,
-                crawledUrls: result.crawledUrls,
-            });
+            return ok(dastResult);
         }
         catch (error) {
             this.activeScans.set(scanId, 'failed');
@@ -133,6 +118,23 @@ export class DASTScanner {
     async getScanStatus(scanId) {
         return this.activeScans.get(scanId) ?? 'pending';
     }
+    /**
+     * #1135: probes the target did not answer leave the scan incomplete. The
+     * findings already collected are real and kept; the failed URLs are listed.
+     */
+    toResult(scanId, targetUrl, outcome, summary) {
+        const { failedRequests } = outcome;
+        return {
+            scanId,
+            targetUrl,
+            vulnerabilities: outcome.vulnerabilities,
+            summary,
+            crawledUrls: outcome.crawledUrls,
+            status: failedRequests.length > 0 ? 'incomplete' : 'complete',
+            failedRequests,
+            ...(failedRequests.length > 0 ? { error: summarizeFailures(failedRequests) } : {}),
+        };
+    }
     // ==========================================================================
     // Private Methods - Dynamic Scanning
     // ==========================================================================
@@ -141,156 +143,124 @@ export class DASTScanner {
      */
     async performDynamicScan(targetUrl, options) {
         const vulnerabilities = [];
-        let crawledUrls = 0;
+        const failedRequests = [];
+        const parsedUrl = parseDastTarget(targetUrl);
+        const timeout = options.timeout ?? this.config.timeout;
+        const maxDepth = options.maxDepth ?? this.config.dastMaxDepth;
+        const activeScanning = options.activeScanning ?? this.config.dastActiveScanning;
+        // Perform main page scan. #980: the deadline must cover the body too —
+        // the target is untrusted and may send headers and then stall the body,
+        // so it stays armed until `response.text()` below has finished.
+        const deadlineMs = Math.min(timeout, 30000);
+        let response;
+        let responseText = '';
         try {
-            // Validate and parse URL
-            let parsedUrl;
-            try {
-                parsedUrl = new URL(targetUrl);
+            response = await fetchWithResponseDeadline(targetUrl, {
+                method: 'GET',
+                headers: {
+                    'User-Agent': 'AgenticQE-DAST-Scanner/3.0',
+                    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                },
+                redirect: 'follow',
+            }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
+            if (unansweredStatus(response.status)) {
+                await response.body?.cancel().catch(() => undefined);
+                assertScannableResponse(response.status);
             }
-            catch {
-                vulnerabilities.push(this.createInvalidUrlVuln(targetUrl));
-                return { vulnerabilities, crawledUrls: 0 };
+            if (activeScanning) {
+                // Read the page body first, inside the request deadline (#980), so the
+                // slower probes below cannot use up the deadline of a healthy target.
+                responseText = await response.text();
             }
-            const timeout = options.timeout ?? this.config.timeout;
-            const maxDepth = options.maxDepth ?? this.config.dastMaxDepth;
-            // Perform main page scan. #980: the deadline must cover the body too —
-            // the target is untrusted and may send headers and then stall the body,
-            // so it stays armed until `response.clone().text()` below has finished.
-            const deadlineMs = Math.min(timeout, 30000);
-            try {
-                const response = await fetchWithResponseDeadline(targetUrl, {
-                    method: 'GET',
-                    headers: {
-                        'User-Agent': 'AgenticQE-DAST-Scanner/3.0',
-                        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-                    },
-                    redirect: 'follow',
-                }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
-                if (response.status === 401 || response.status === 403 || response.status >= 500) {
-                    await response.body?.cancel().catch(() => undefined);
-                    throw Object.assign(new Error(`DAST ${response.status < 500 ? 'authentication rejected' : 'target unavailable'} (HTTP ${response.status}); dynamic analysis is incomplete`), {
-                        code: response.status < 500 ? 'DAST_AUTHENTICATION_FAILED' : 'DAST_TARGET_UNAVAILABLE',
-                    });
-                }
-                crawledUrls++;
-                // Security header analysis
-                analyzeSecurityHeaders(response.headers, targetUrl, vulnerabilities);
-                // Check for insecure protocol
-                if (parsedUrl.protocol === 'http:') {
-                    vulnerabilities.push(this.createInsecureProtocolVuln(targetUrl));
-                }
-                // Check for cookie security
-                analyzeCookieSecurity(response.headers, targetUrl, vulnerabilities);
-                // Check for server version disclosure
-                analyzeServerHeaders(response.headers, targetUrl, vulnerabilities);
-                // Active scanning features
-                if (options.activeScanning ?? this.config.dastActiveScanning) {
-                    // Read the page body first, inside the request deadline (#980), so the
-                    // slower probes below cannot use up the deadline of a healthy target.
-                    const responseText = await response.text();
-                    crawledUrls = await scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulnerabilities);
-                    await analyzeCORS(targetUrl, vulnerabilities);
-                    // Enhanced DAST: Link crawling, injection testing, form analysis
-                    crawledUrls = await extractAndCrawlLinks(responseText, parsedUrl, crawledUrls, maxDepth, vulnerabilities);
-                    if (parsedUrl.search) {
-                        await this.testInjectionVulnerabilities(targetUrl, parsedUrl, vulnerabilities);
-                    }
-                    analyzeFormsForSecurityIssues(responseText, targetUrl, vulnerabilities);
-                }
-                else {
-                    // Passive scan: headers only. Release the connection instead of
-                    // leaving an unread body to the deadline timer.
-                    await response.body?.cancel().catch(() => undefined);
-                }
+            else {
+                // Passive scan: headers only. Release the connection instead of
+                // leaving an unread body to the deadline timer.
+                await response.body?.cancel().catch(() => undefined);
+            }
+        }
+        catch (fetchError) {
+            throw dastRequestFailure(fetchError);
+        }
+        let crawledUrls = 1;
+        try {
+            analyzeSecurityHeaders(response.headers, targetUrl, vulnerabilities);
+            if (parsedUrl.protocol === 'http:') {
+                vulnerabilities.push(this.createInsecureProtocolVuln(targetUrl));
             }
-            catch (fetchError) {
-                throw dastRequestFailure(fetchError);
+            analyzeCookieSecurity(response.headers, targetUrl, vulnerabilities);
+            analyzeServerHeaders(response.headers, targetUrl, vulnerabilities);
+            if (activeScanning) {
+                // #1135: a probe the target does not answer is recorded and the scan
+                // continues; the result is then incomplete, not discarded.
+                crawledUrls = await scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulnerabilities, failedRequests);
+                await analyzeCORS(targetUrl, vulnerabilities, failedRequests);
+                crawledUrls = await extractAndCrawlLinks(responseText, parsedUrl, crawledUrls, maxDepth, vulnerabilities, failedRequests);
+                if (parsedUrl.search) {
+                    await this.testInjectionVulnerabilities(targetUrl, parsedUrl, vulnerabilities, failedRequests);
+                }
+                analyzeFormsForSecurityIssues(responseText, targetUrl, vulnerabilities);
             }
         }
         catch (error) {
-            throw toError(error);
+            throw dastAnalysisFailure(error);
         }
-        return { vulnerabilities, crawledUrls };
+        return { vulnerabilities, crawledUrls, failedRequests };
     }
     /**
      * Perform authenticated dynamic scanning
      */
     async performAuthenticatedScan(targetUrl, credentials, options) {
         const vulnerabilities = [];
-        let crawledUrls = 0;
+        const failedRequests = [];
+        const authHeaders = buildAuthHeaders(credentials);
+        const parsedUrl = parseDastTarget(targetUrl);
+        const timeout = options.timeout ?? this.config.timeout;
+        const maxDepth = options.maxDepth ?? this.config.dastMaxDepth;
+        // #980 review N8: same deadline treatment as the unauthenticated scan.
+        // This path reads headers only; the unread body is cancelled below so
+        // a target that stalls it cannot hold the connection open.
+        const deadlineMs = Math.min(timeout, 30000);
+        let response;
         try {
-            const authHeaders = buildAuthHeaders(credentials);
-            let parsedUrl;
-            try {
-                parsedUrl = new URL(targetUrl);
-            }
-            catch {
-                vulnerabilities.push(this.createInvalidUrlVuln(targetUrl));
-                return { vulnerabilities, crawledUrls: 0 };
-            }
-            const timeout = options.timeout ?? this.config.timeout;
-            const maxDepth = options.maxDepth ?? this.config.dastMaxDepth;
-            // #980 review N8: same deadline treatment as the unauthenticated scan.
-            // This path reads headers only; the unread body is cancelled below so
-            // a target that stalls it cannot hold the connection open.
-            const deadlineMs = Math.min(timeout, 30000);
-            try {
-                const response = await fetchWithResponseDeadline(targetUrl, {
-                    method: 'GET',
-                    headers: {
-                        'User-Agent': 'AgenticQE-DAST-Scanner/3.0',
-                        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
-                        ...authHeaders,
-                    },
-                    redirect: 'follow',
-                }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
-                await response.body?.cancel().catch(() => undefined);
-                if (response.status === 401 || response.status === 403 || response.status >= 500) {
-                    await response.body?.cancel().catch(() => undefined);
-                    throw Object.assign(new Error(`DAST ${response.status < 500 ? 'authentication rejected' : 'target unavailable'} (HTTP ${response.status}); dynamic analysis is incomplete`), {
-                        code: response.status < 500 ? 'DAST_AUTHENTICATION_FAILED' : 'DAST_TARGET_UNAVAILABLE',
-                    });
-                }
-                crawledUrls++;
-                // Standard security header checks
-                analyzeSecurityHeaders(response.headers, targetUrl, vulnerabilities, true);
-                // Check for session token in URL
-                if (parsedUrl.search.includes('token=') || parsedUrl.search.includes('session=') || parsedUrl.search.includes('auth=')) {
-                    vulnerabilities.push(this.createTokenInUrlVuln(targetUrl, parsedUrl.search));
-                }
-                // Active scanning for authenticated endpoints
-                if (options.activeScanning ?? this.config.dastActiveScanning) {
-                    crawledUrls = await testAuthorizationBypass(parsedUrl, authHeaders, crawledUrls, maxDepth, vulnerabilities);
-                    crawledUrls = await testIDOR(parsedUrl, authHeaders, crawledUrls, maxDepth, vulnerabilities);
-                }
-                // Enhanced cookie security for authenticated sessions
-                analyzeCookieSecurity(response.headers, targetUrl, vulnerabilities, true);
+            response = await fetchWithResponseDeadline(targetUrl, {
+                method: 'GET',
+                headers: {
+                    'User-Agent': 'AgenticQE-DAST-Scanner/3.0',
+                    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                    ...authHeaders,
+                },
+                redirect: 'follow',
+            }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
+            await response.body?.cancel().catch(() => undefined);
+            assertScannableResponse(response.status);
+        }
+        catch (fetchError) {
+            throw dastRequestFailure(fetchError);
+        }
+        let crawledUrls = 1;
+        try {
+            // Standard security header checks
+            analyzeSecurityHeaders(response.headers, targetUrl, vulnerabilities, true);
+            // Check for session token in URL
+            if (parsedUrl.search.includes('token=') || parsedUrl.search.includes('session=') || parsedUrl.search.includes('auth=')) {
+                vulnerabilities.push(this.createTokenInUrlVuln(targetUrl, parsedUrl.search));
             }
-            catch (fetchError) {
-                throw dastRequestFailure(fetchError);
+            // Active scanning for authenticated endpoints
+            if (options.activeScanning ?? this.config.dastActiveScanning) {
+                crawledUrls = await testAuthorizationBypass(parsedUrl, authHeaders, crawledUrls, maxDepth, vulnerabilities, failedRequests);
+                crawledUrls = await testIDOR(parsedUrl, authHeaders, crawledUrls, maxDepth, vulnerabilities, failedRequests);
             }
+            // Enhanced cookie security for authenticated sessions
+            analyzeCookieSecurity(response.headers, targetUrl, vulnerabilities, true);
         }
         catch (error) {
-            throw toError(error);
+            throw dastAnalysisFailure(error);
         }
-        return { vulnerabilities, crawledUrls };
+        return { vulnerabilities, crawledUrls, failedRequests };
     }
     // ==========================================================================
     // Private Methods - Vulnerability Factories
     // ==========================================================================
-    createInvalidUrlVuln(targetUrl) {
-        return {
-            id: uuidv4(),
-            title: 'Invalid Target URL',
-            description: 'The provided target URL is not valid',
-            severity: 'informational',
-            category: 'security-misconfiguration',
-            location: { file: targetUrl },
-            remediation: { description: 'Provide a valid URL', estimatedEffort: 'trivial', automatable: false },
-            references: [],
-        };
-    }
     createInsecureProtocolVuln(targetUrl) {
         return {
             id: uuidv4(),
@@ -321,7 +291,7 @@ export class DASTScanner {
     /**
      * Test URL parameters for injection vulnerabilities
      */
-    async testInjectionVulnerabilities(targetUrl, parsedUrl, vulnerabilities) {
+    async testInjectionVulnerabilities(targetUrl, parsedUrl, vulnerabilities, failures) {
         const params = new URLSearchParams(parsedUrl.search);
         const paramNames = Array.from(params.keys());
         const xssPayloads = [
@@ -335,8 +305,8 @@ export class DASTScanner {
             { payload: "1' AND '1'='1", name: 'SQL AND Injection' },
         ];
         for (const paramName of paramNames.slice(0, 3)) {
-            await testXSS(targetUrl, parsedUrl, paramName, xssPayloads, vulnerabilities);
-            await testSQLi(targetUrl, parsedUrl, paramName, sqliPayloads, vulnerabilities);
+            await testXSS(targetUrl, parsedUrl, paramName, xssPayloads, vulnerabilities, failures);
+            await testSQLi(targetUrl, parsedUrl, paramName, sqliPayloads, vulnerabilities, failures);
         }
     }
 }

package/dist/domains/security-compliance/services/scanners/index.d.ts

@@ -10,5 +10,5 @@ export type { SecurityScannerConfig, SecurityScannerDependencies, ISecurityScann
 export { DEFAULT_CONFIG } from './scanner-types.js';
 export type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, RemediationAdvice, ScanSummary, SecurityCoverage, ScanStatus, SASTResult, DASTResult, DASTOptions, AuthCredentials, RuleSet, FalsePositiveCheck, } from './scanner-types.js';
 export { ALL_SECURITY_PATTERNS, SQL_INJECTION_PATTERNS, XSS_PATTERNS, SECRET_PATTERNS, PATH_TRAVERSAL_PATTERNS, COMMAND_INJECTION_PATTERNS, MISCONFIGURATION_PATTERNS, DESERIALIZATION_PATTERNS, AUTH_PATTERNS, BUILT_IN_RULE_SETS, } from './security-patterns.js';
-export { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, handleFetchError, calculateSummary, storeScanResults, } from './dast-helpers.js';
+export { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, calculateSummary, storeScanResults, } from './dast-helpers.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/domains/security-compliance/services/scanners/index.js

@@ -12,5 +12,5 @@ export { DEFAULT_CONFIG } from './scanner-types.js';
 // Security patterns
 export { ALL_SECURITY_PATTERNS, SQL_INJECTION_PATTERNS, XSS_PATTERNS, SECRET_PATTERNS, PATH_TRAVERSAL_PATTERNS, COMMAND_INJECTION_PATTERNS, MISCONFIGURATION_PATTERNS, DESERIALIZATION_PATTERNS, AUTH_PATTERNS, BUILT_IN_RULE_SETS, } from './security-patterns.js';
 // DAST helper functions (for advanced/custom usage)
-export { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, handleFetchError, calculateSummary, storeScanResults, } from './dast-helpers.js';
+export { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, calculateSummary, storeScanResults, } from './dast-helpers.js';
 //# sourceMappingURL=index.js.map