agentic-qe 3.15.12 → 3.15.14

package/dist/domains/security-compliance/services/scanners/dast-helpers.d.ts

@@ -2,7 +2,7 @@
  * Agentic QE v3 - DAST Scanner Helper Functions
  * Utility functions for dynamic security analysis
  */
-import type { Vulnerability, ScanSummary, MemoryBackend } from './scanner-types.js';
+import type { Vulnerability, ScanSummary, MemoryBackend, DASTRequestFailure } from './scanner-types.js';
 export { testXSS, testSQLi } from './dast-injection-testing.js';
 export { testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, } from './dast-auth-testing.js';
 /**
@@ -20,23 +20,19 @@ export declare function analyzeServerHeaders(headers: Headers, targetUrl: string
 /**
  * Scan for sensitive file exposure
  */
-export declare function scanSensitiveFiles(parsedUrl: URL, crawledUrls: number, maxDepth: number, vulnerabilities: Vulnerability[]): Promise<number>;
+export declare function scanSensitiveFiles(parsedUrl: URL, crawledUrls: number, maxDepth: number, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<number>;
 /**
  * Analyze CORS configuration
  */
-export declare function analyzeCORS(targetUrl: string, vulnerabilities: Vulnerability[]): Promise<void>;
+export declare function analyzeCORS(targetUrl: string, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<void>;
 /**
  * Extract links from HTML and crawl discovered pages
  */
-export declare function extractAndCrawlLinks(html: string, baseUrl: URL, currentCrawled: number, maxDepth: number, vulnerabilities: Vulnerability[]): Promise<number>;
+export declare function extractAndCrawlLinks(html: string, baseUrl: URL, currentCrawled: number, maxDepth: number, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<number>;
 /**
  * Analyze HTML forms for security issues
  */
 export declare function analyzeFormsForSecurityIssues(html: string, baseUrl: string, vulnerabilities: Vulnerability[]): void;
-/**
- * Handle fetch errors and add appropriate vulnerabilities
- */
-export declare function handleFetchError(fetchError: unknown, targetUrl: string, vulnerabilities: Vulnerability[]): void;
 /**
  * Calculate scan summary from vulnerabilities
  */
@@ -44,5 +40,8 @@ export declare function calculateSummary(vulnerabilities: Vulnerability[], total
 /**
  * Store scan results in memory
  */
-export declare function storeScanResults(memory: MemoryBackend, scanId: string, scanType: string, vulnerabilities: Vulnerability[], summary: ScanSummary): Promise<void>;
+export declare function storeScanResults(memory: MemoryBackend, scanId: string, scanType: string, vulnerabilities: Vulnerability[], summary: ScanSummary, completeness?: {
+    status: string;
+    failedRequests: DASTRequestFailure[];
+}): Promise<void>;
 //# sourceMappingURL=dast-helpers.d.ts.map

package/dist/domains/security-compliance/services/scanners/dast-helpers.js

@@ -3,7 +3,7 @@
  * Utility functions for dynamic security analysis
  */
 import { v4 as uuidv4 } from 'uuid';
-import { toErrorMessage } from '../../../../shared/error-utils.js';
+import { probe } from './dast-requests.js';
 // Re-export from specialized modules for convenience
 export { testXSS, testSQLi } from './dast-injection-testing.js';
 export { testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, } from './dast-auth-testing.js';
@@ -100,7 +100,7 @@ export function analyzeServerHeaders(headers, targetUrl, vulnerabilities) {
 /**
  * Scan for sensitive file exposure
  */
-export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulnerabilities) {
+export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulnerabilities, failures) {
     const sensitiveEndpoints = [
         { path: '/.git/config', name: 'Git Configuration' },
         { path: '/.env', name: 'Environment File' },
@@ -113,13 +113,13 @@ export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulne
         if (crawledUrls >= maxDepth * 10)
             break;
         const testUrl = new URL(endpoint.path, parsedUrl.origin).toString();
-        const testResponse = await fetch(testUrl, {
+        const testResponse = await probe(testUrl, {
             method: 'GET',
             signal: AbortSignal.timeout(5000),
-        });
-        if (testResponse.ok) {
+        }, failures);
+        if (testResponse?.ok) {
             crawledUrls++;
-            const text = await testResponse.text();
+            const text = testResponse.text;
             if (text.length > 20 && !text.toLowerCase().includes('not found') && !text.toLowerCase().includes('404')) {
                 const isSensitive = endpoint.path.includes('.git') ||
                     endpoint.path.includes('.env') ||
@@ -148,15 +148,17 @@ export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulne
 /**
  * Analyze CORS configuration
  */
-export async function analyzeCORS(targetUrl, vulnerabilities) {
-    const corsResponse = await fetch(targetUrl, {
+export async function analyzeCORS(targetUrl, vulnerabilities, failures) {
+    const corsResponse = await probe(targetUrl, {
         method: 'OPTIONS',
         headers: {
             'Origin': 'https://evil-attacker.com',
             'Access-Control-Request-Method': 'GET',
         },
         signal: AbortSignal.timeout(5000),
-    });
+    }, failures);
+    if (!corsResponse)
+        return;
     const allowOrigin = corsResponse.headers.get('access-control-allow-origin');
     if (allowOrigin === '*' || allowOrigin === 'https://evil-attacker.com') {
         vulnerabilities.push({
@@ -177,7 +179,7 @@ export async function analyzeCORS(targetUrl, vulnerabilities) {
 /**
  * Extract links from HTML and crawl discovered pages
  */
-export async function extractAndCrawlLinks(html, baseUrl, currentCrawled, maxDepth, vulnerabilities) {
+export async function extractAndCrawlLinks(html, baseUrl, currentCrawled, maxDepth, vulnerabilities, failures) {
     let crawledUrls = currentCrawled;
     const maxCrawl = maxDepth * 5;
     const linkPattern = /href=["']([^"']+)["']/gi;
@@ -200,12 +202,14 @@ export async function extractAndCrawlLinks(html, baseUrl, currentCrawled, maxDep
         if (crawledUrls >= maxCrawl)
             break;
         const crawlUrl = new URL(path, baseUrl.origin).toString();
-        const crawlResponse = await fetch(crawlUrl, {
+        const crawlResponse = await probe(crawlUrl, {
             method: 'GET',
             headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
             signal: AbortSignal.timeout(5000),
             redirect: 'follow',
-        });
+        }, failures);
+        if (!crawlResponse)
+            continue;
         crawledUrls++;
         if (crawlResponse.ok) {
             if (path.includes('password') || path.includes('token') || path.includes('api_key')) {
@@ -220,7 +224,7 @@ export async function extractAndCrawlLinks(html, baseUrl, currentCrawled, maxDep
                     references: ['https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url'],
                 });
             }
-            const responseText = await crawlResponse.text();
+            const responseText = crawlResponse.text;
             if (responseText.includes('Index of /') || responseText.includes('Directory listing for')) {
                 vulnerabilities.push({
                     id: uuidv4(),
@@ -308,36 +312,6 @@ export function analyzeFormsForSecurityIssues(html, baseUrl, vulnerabilities) {
 // ============================================================================
 // Utility Functions
 // ============================================================================
-/**
- * Handle fetch errors and add appropriate vulnerabilities
- */
-export function handleFetchError(fetchError, targetUrl, vulnerabilities) {
-    const errorMsg = toErrorMessage(fetchError);
-    if (errorMsg.includes('CERT') || errorMsg.includes('SSL') || errorMsg.includes('TLS') || errorMsg.includes('certificate')) {
-        vulnerabilities.push({
-            id: uuidv4(),
-            title: 'TLS Certificate Error',
-            description: `SSL/TLS error: ${errorMsg}`,
-            severity: 'high',
-            category: 'security-misconfiguration',
-            location: { file: targetUrl },
-            remediation: { description: 'Fix TLS certificate configuration', estimatedEffort: 'moderate', automatable: false },
-            references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-        });
-    }
-    else if (errorMsg.includes('timeout') || errorMsg.includes('abort')) {
-        vulnerabilities.push({
-            id: uuidv4(),
-            title: 'Connection Timeout',
-            description: `Target did not respond within timeout: ${errorMsg}`,
-            severity: 'informational',
-            category: 'security-misconfiguration',
-            location: { file: targetUrl },
-            remediation: { description: 'Verify target is accessible', estimatedEffort: 'trivial', automatable: false },
-            references: [],
-        });
-    }
-}
 /**
  * Calculate scan summary from vulnerabilities
  */
@@ -359,12 +333,13 @@ export function calculateSummary(vulnerabilities, totalFiles, scanDurationMs) {
 /**
  * Store scan results in memory
  */
-export async function storeScanResults(memory, scanId, scanType, vulnerabilities, summary) {
+export async function storeScanResults(memory, scanId, scanType, vulnerabilities, summary, completeness) {
     await memory.set(`security:scan:${scanId}`, {
         scanId,
         scanType,
         vulnerabilities,
         summary,
+        ...completeness,
         timestamp: new Date().toISOString(),
     }, { namespace: 'security-compliance', ttl: 86400 * 7 });
 }

package/dist/domains/security-compliance/services/scanners/dast-injection-testing.d.ts

@@ -2,19 +2,19 @@
  * Agentic QE v3 - DAST Injection Testing
  * XSS and SQL injection testing utilities
  */
-import type { Vulnerability } from './scanner-types.js';
+import type { Vulnerability, DASTRequestFailure } from './scanner-types.js';
 /**
  * Test for XSS vulnerabilities
  */
 export declare function testXSS(targetUrl: string, parsedUrl: URL, paramName: string, payloads: Array<{
     payload: string;
     name: string;
-}>, vulnerabilities: Vulnerability[]): Promise<void>;
+}>, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<void>;
 /**
  * Test for SQL injection vulnerabilities
  */
 export declare function testSQLi(targetUrl: string, parsedUrl: URL, paramName: string, payloads: Array<{
     payload: string;
     name: string;
-}>, vulnerabilities: Vulnerability[]): Promise<void>;
+}>, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<void>;
 //# sourceMappingURL=dast-injection-testing.d.ts.map

package/dist/domains/security-compliance/services/scanners/dast-injection-testing.js

@@ -3,24 +3,25 @@
  * XSS and SQL injection testing utilities
  */
 import { v4 as uuidv4 } from 'uuid';
+import { probe } from './dast-requests.js';
 // ============================================================================
 // Injection Testing
 // ============================================================================
 /**
  * Test for XSS vulnerabilities
  */
-export async function testXSS(targetUrl, parsedUrl, paramName, payloads, vulnerabilities) {
+export async function testXSS(targetUrl, parsedUrl, paramName, payloads, vulnerabilities, failures) {
     for (const xss of payloads) {
         const testParams = new URLSearchParams(parsedUrl.search);
         testParams.set(paramName, xss.payload);
         const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
-        const response = await fetch(testUrl, {
+        const response = await probe(testUrl, {
             method: 'GET',
             headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
             signal: AbortSignal.timeout(5000),
-        });
-        if (response.ok) {
-            const text = await response.text();
+        }, failures);
+        if (response?.ok) {
+            const text = response.text;
             const escapedPayload = xss.payload
                 .replace(/&/g, '&')
                 .replace(/</g, '&lt;')
@@ -48,7 +49,7 @@ export async function testXSS(targetUrl, parsedUrl, paramName, payloads, vulnera
 /**
  * Test for SQL injection vulnerabilities
  */
-export async function testSQLi(targetUrl, parsedUrl, paramName, payloads, vulnerabilities) {
+export async function testSQLi(targetUrl, parsedUrl, paramName, payloads, vulnerabilities, failures) {
     const sqlErrorPatterns = [
         /SQL syntax.*MySQL/i,
         /Warning.*mysql/i,
@@ -63,12 +64,15 @@ export async function testSQLi(targetUrl, parsedUrl, paramName, payloads, vulner
         const testParams = new URLSearchParams(parsedUrl.search);
         testParams.set(paramName, sqli.payload);
         const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
-        const response = await fetch(testUrl, {
+        // SQL errors often come back as HTTP 500: that body is analysed.
+        const response = await probe(testUrl, {
             method: 'GET',
             headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
             signal: AbortSignal.timeout(5000),
-        });
-        const text = await response.text();
+        }, failures, { analyzeServerErrors: true });
+        if (!response)
+            continue;
+        const text = response.text;
         for (const pattern of sqlErrorPatterns) {
             if (pattern.test(text)) {
                 vulnerabilities.push({

package/dist/domains/security-compliance/services/scanners/dast-requests.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Agentic QE v3 - DAST request outcomes (#1092, #1135)
+ * Classifies what a DAST request did not answer, so a failed or partial scan
+ * is reported as such and never as a scan that found nothing.
+ */
+import type { DASTRequestFailure } from './scanner-types.js';
+/** Error carrying a DAST failure code. */
+export type DASTError = Error & {
+    code: string;
+};
+export declare function dastError(message: string, code: string, cause?: unknown): DASTError;
+export declare function isDastError(error: unknown): error is DASTError;
+/**
+ * The scan subject must be an http(s) URL. Anything else is a validation
+ * error, not a completed scan with a synthetic finding (#1135).
+ */
+export declare function parseDastTarget(targetUrl: string): URL;
+/**
+ * A response status that says nothing about the target's security: the request
+ * was refused, throttled or not served. Findings from such a page would be the
+ * headers of the error page (#1092, #1135).
+ */
+export declare function unansweredStatus(status: number): {
+    code: string;
+    label: string;
+} | null;
+/** Throws when the initial response cannot be scanned. */
+export declare function assertScannableResponse(status: number): void;
+/** Transport failure classification; TLS failures are told apart from a closed port (#1135). */
+export declare function classifyRequestError(error: unknown): {
+    code: string;
+    reason: string;
+};
+/** Transport failures are execution errors, not absence of vulnerabilities. */
+export declare function dastRequestFailure(error: unknown): DASTError;
+export interface ProbeResponse {
+    readonly status: number;
+    readonly ok: boolean;
+    readonly headers: Headers;
+    readonly text: string;
+}
+export interface ProbeOptions {
+    /** A 5xx body is analysed (SQL error pages), not counted as unanswered. */
+    readonly analyzeServerErrors?: boolean;
+}
+/**
+ * A follow-up probe. When the target does not answer it (transport failure,
+ * timeout, 407/408/429, or 5xx unless `analyzeServerErrors`), the failure is
+ * recorded in `failures` and null is returned so the remaining probes still
+ * run and the scan is reported incomplete (#1135). Without `failures`, it throws.
+ */
+export declare function probe(url: string, init: RequestInit, failures?: DASTRequestFailure[], options?: ProbeOptions): Promise<ProbeResponse | null>;
+export declare function summarizeFailures(failures: readonly DASTRequestFailure[]): string;
+//# sourceMappingURL=dast-requests.d.ts.map

package/dist/domains/security-compliance/services/scanners/dast-requests.js

@@ -0,0 +1,125 @@
+/**
+ * Agentic QE v3 - DAST request outcomes (#1092, #1135)
+ * Classifies what a DAST request did not answer, so a failed or partial scan
+ * is reported as such and never as a scan that found nothing.
+ */
+export function dastError(message, code, cause) {
+    return Object.assign(new Error(message, cause === undefined ? undefined : { cause }), { code });
+}
+export function isDastError(error) {
+    return error instanceof Error && 'code' in error && /^DAST_[A-Z_]+$/.test(String(error.code));
+}
+/**
+ * The scan subject must be an http(s) URL. Anything else is a validation
+ * error, not a completed scan with a synthetic finding (#1135).
+ */
+export function parseDastTarget(targetUrl) {
+    let parsed;
+    try {
+        parsed = new URL(targetUrl);
+    }
+    catch {
+        throw dastError('DAST target is not a valid URL; no dynamic analysis ran', 'DAST_INVALID_TARGET');
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw dastError(`DAST target must be an http(s) URL, not ${parsed.protocol}; no dynamic analysis ran`, 'DAST_INVALID_TARGET');
+    }
+    return parsed;
+}
+/**
+ * A response status that says nothing about the target's security: the request
+ * was refused, throttled or not served. Findings from such a page would be the
+ * headers of the error page (#1092, #1135).
+ */
+export function unansweredStatus(status) {
+    if (status === 401 || status === 403 || status === 407)
+        return { code: 'DAST_AUTHENTICATION_FAILED', label: 'authentication rejected' };
+    if (status === 408)
+        return { code: 'DAST_REQUEST_TIMEOUT', label: 'request timed out' };
+    if (status === 429)
+        return { code: 'DAST_RATE_LIMITED', label: 'rate limited' };
+    if (status >= 500)
+        return { code: 'DAST_TARGET_UNAVAILABLE', label: 'target unavailable' };
+    return null;
+}
+/** Throws when the initial response cannot be scanned. */
+export function assertScannableResponse(status) {
+    const unanswered = unansweredStatus(status);
+    if (unanswered) {
+        throw dastError(`DAST ${unanswered.label} (HTTP ${status}); dynamic analysis is incomplete`, unanswered.code);
+    }
+}
+const TLS_CODE = /^(ERR_TLS_|ERR_SSL_|ERR_CERT_|CERT_|UNABLE_TO_(GET|VERIFY)_|DEPTH_ZERO_SELF_SIGNED_CERT$|SELF_SIGNED_CERT_IN_CHAIN$|EPROTO$)/;
+/** The errno-style code on an error or its causes (undici wraps it as `cause.code`). */
+function causeCode(error) {
+    for (let current = error, depth = 0; current && depth < 5; depth++) {
+        const code = current.code;
+        if (typeof code === 'string' && /^[A-Z0-9_]{1,48}$/.test(code))
+            return code;
+        current = current.cause;
+    }
+    return undefined;
+}
+function isTimeout(error) {
+    return error instanceof Error && (error.name === 'TimeoutError' || error.name === 'AbortError' || /timeout|abort/i.test(error.message));
+}
+/** Transport failure classification; TLS failures are told apart from a closed port (#1135). */
+export function classifyRequestError(error) {
+    const cause = causeCode(error);
+    if (isTimeout(error))
+        return { code: 'DAST_REQUEST_TIMEOUT', reason: cause ?? 'timeout' };
+    if (cause && TLS_CODE.test(cause))
+        return { code: 'DAST_TLS_FAILED', reason: cause };
+    return { code: 'DAST_REQUEST_FAILED', reason: cause ?? 'transport error' };
+}
+/** Transport failures are execution errors, not absence of vulnerabilities. */
+export function dastRequestFailure(error) {
+    if (isDastError(error))
+        return error;
+    const { code, reason } = classifyRequestError(error);
+    const what = code === 'DAST_REQUEST_TIMEOUT' ? 'request timeout'
+        : code === 'DAST_TLS_FAILED' ? 'TLS handshake failed' : 'request failed';
+    return dastError(`DAST target ${what} (${reason}); dynamic analysis is incomplete`, code, error);
+}
+/** Origin and path only: probe URLs can carry user credentials or query tokens. */
+function requestLabel(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.origin}${parsed.pathname}`;
+    }
+    catch {
+        return '(invalid url)';
+    }
+}
+/**
+ * A follow-up probe. When the target does not answer it (transport failure,
+ * timeout, 407/408/429, or 5xx unless `analyzeServerErrors`), the failure is
+ * recorded in `failures` and null is returned so the remaining probes still
+ * run and the scan is reported incomplete (#1135). Without `failures`, it throws.
+ */
+export async function probe(url, init, failures, options = {}) {
+    try {
+        const response = await fetch(url, init);
+        const unanswered = response.status >= 500 && options.analyzeServerErrors ? null : unansweredStatus(response.status);
+        // 401/403 on a probed path is an answer: the path is protected.
+        if (unanswered && response.status !== 401 && response.status !== 403) {
+            await response.body?.cancel().catch(() => undefined);
+            throw dastError(`DAST probe ${unanswered.label} (HTTP ${response.status})`, unanswered.code);
+        }
+        return { status: response.status, ok: response.ok, headers: response.headers, text: await response.text() };
+    }
+    catch (error) {
+        const failure = isDastError(error)
+            ? { code: error.code, reason: error.message.replace(/^DAST probe /, '') }
+            : classifyRequestError(error);
+        if (!failures)
+            throw isDastError(error) ? error : dastRequestFailure(error);
+        failures.push({ url: requestLabel(url), ...failure });
+        return null;
+    }
+}
+export function summarizeFailures(failures) {
+    const codes = [...new Set(failures.map(failure => failure.code))].join(', ');
+    return `${failures.length} DAST request(s) were not answered (${codes}); findings cover only the answered requests`;
+}
+//# sourceMappingURL=dast-requests.js.map

package/dist/domains/security-compliance/services/scanners/dast-scanner.d.ts

@@ -42,6 +42,11 @@ export declare class DASTScanner {
      * Get scan status
      */
     getScanStatus(scanId: string): Promise<ScanStatus>;
+    /**
+     * #1135: probes the target did not answer leave the scan incomplete. The
+     * findings already collected are real and kept; the failed URLs are listed.
+     */
+    private toResult;
     /**
      * Perform dynamic (DAST) scanning on a target URL
      */
@@ -50,7 +55,6 @@ export declare class DASTScanner {
      * Perform authenticated dynamic scanning
      */
     private performAuthenticatedScan;
-    private createInvalidUrlVuln;
     private createInsecureProtocolVuln;
     private createTokenInUrlVuln;
     /**