cognium-ai 2.38.0 → 2.39.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/commands/scan.d.ts.map +1 -1
- package/dist/cli/commands/scan.js +7 -1
- package/dist/cli/commands/scan.js.map +1 -1
- package/dist/cli/severity-policy.d.ts +12 -0
- package/dist/cli/severity-policy.d.ts.map +1 -1
- package/dist/cli/severity-policy.js +56 -12
- package/dist/cli/severity-policy.js.map +1 -1
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAS1C;;GAEG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,
|
|
1
|
+
{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAS1C;;GAEG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA+PhE"}
|
|
@@ -10,7 +10,7 @@ resetTruncationCount, snapshotTruncationCount, } from 'circle-ir-ai';
|
|
|
10
10
|
import { contextProfileFromProjectProfile, resolveContextProfile } from '../cluster-policies.js';
|
|
11
11
|
import { getEffectiveOptions, warnIfSilentExclusion } from '../effective-options.js';
|
|
12
12
|
import { applyFindingsCap } from '../findings-cap.js';
|
|
13
|
-
import { capSeverityByExploitability } from '../severity-policy.js';
|
|
13
|
+
import { capAdvisoryTypeSeverity, capSeverityByExploitability } from '../severity-policy.js';
|
|
14
14
|
import { enrichScanSarif } from '../formatters/scan-sarif-enrich.js';
|
|
15
15
|
import { resolveProjectProfileForEngine } from '../project-profile.js';
|
|
16
16
|
/**
|
|
@@ -134,6 +134,12 @@ export async function executeScan(args) {
|
|
|
134
134
|
if (exploitCapCount > 0 && !args.quiet) {
|
|
135
135
|
console.error(`[info] cognium-ai#214: capped ${exploitCapCount} finding(s) marked exploitable:false from critical/high to medium (originalSeverity preserved).`);
|
|
136
136
|
}
|
|
137
|
+
// cognium-ai#220 — cap advisory-shape CWE types (log_injection /
|
|
138
|
+
// CWE-117) the LLM verifier inflated above circle-ir's low base.
|
|
139
|
+
const { cappedCount: advisoryCapCount } = capAdvisoryTypeSeverity(rawResult);
|
|
140
|
+
if (advisoryCapCount > 0 && !args.quiet) {
|
|
141
|
+
console.error(`[info] cognium-ai#220: capped ${advisoryCapCount} advisory-type finding(s) (e.g. log_injection/CWE-117) to their base ceiling (originalSeverity preserved).`);
|
|
142
|
+
}
|
|
137
143
|
// cognium-ai#203 defense-in-depth — probe on-disk supported-file count
|
|
138
144
|
// when the engine reports 0 files scanned. Fires only on the failure
|
|
139
145
|
// path (probe walk is skipped when totalFiles > 0), so happy-path cost
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB;AACjB,uEAAuE;AACvE,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB;AACjB,uEAAuE;AACvE,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAEvE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAa;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;IAC7B,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,kCAAkC,CAAC,CAAC;gBACxE,OAAO,CAAC,KAAK,CAAC,gBAAgB,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,qCAAqC,CAAC,CAAC;gBAC1H,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,kCAAkC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,kCAAkC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAElD,mEAAmE;IACnE,qEAAqE;IACrE,iEAAiE;IACjE,EAAE;IACF,gEAAgE;IAChE,8DAA8D;IAC9D,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,8DAA8D;IAC9D,oCAAoC;IACpC,MAAM,gBAAgB,GAAG;QACvB,GAAG,GAAG,CAAC,OAAO;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB;KAC9B,CAAC;IAEF,kEAAkE;IAClE,8DAA8D;IAC9D,kEAAkE;IAClE,mEAAmE;IACnE,+BAA+B;IAC/B,MAAM,cAAc,GAAG,MAAM,8BAA8B,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAErF,2DAA2D;IAC3D,oEAAoE;IACpE,iEAAiE;IACjE,6DAA6D;IAC7D,qEAAqE;IACrE,6DAA6D;IAC7D,gEAAgE;IAChE,oEAAoE;IACpE,iCAAiC;IACjC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACzE,MAAM,cAAc,GAClB,sBAAsB,IAAI,gCAAgC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxF,MAAM,oBAAoB,GACxB,sBAAsB,KAAK,SAAS;QAClC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,cAAc,KAAK,SAAS;YAC5B,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,SAAS,CAAC;IAElB,MAAM,OAAO,GAAyB;QACpC,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAwB;QACrK,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAClE,SAAS,EAAE,UAAU;QACrB,mEAAmE;QACnE,kEAAkE;QAClE,gEAAgE;QAChE,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QACpD,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;QACpB,aAAa,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI;QACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QACpC,WAAW,EAAE,GAAG,CAAC,QAAQ;QACzB,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACjE,eAAe,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QAC3E,kEAAkE;QAClE,6DAA6D;QAC7D,iEAAiE;QACjE,cAAc,EAAE,cAA+C;QAC/D,6DAA6D;QAC7D,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,gEAAgE;QAChE,cAAc,EAAE,cAA+C;QAC/D,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;KACF,CAAC;IAEF,IAAI,CAAC;QACH,kEAAkE;QAClE,sDAAsD;QACtD,oBAAoB,EAAE,CAAC;QAEvB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,eAAe,GAAG,uBAAuB,EAAE,CAAC;QAElD,gEAAgE;QAChE,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;QAChF,IAAI,eAAe,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CACX,iCAAiC,eAAe,iGAAiG,CAClJ,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,iEAAiE;QACjE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,gBAAgB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,OAAO,CAAC,KAAK,CACX,iCAAiC,gBAAgB,4GAA4G,CAC9J,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,0BAA0B;QAC1B,qBAAqB,CACnB,UAAU,EACV;YACE,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,gBAAgB;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAoC,CAAC,CAAC,CAAC,CAAC,SAAS;SACnF,EACD,SAAS,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,EAClC,IAAI,CACL,CAAC;QAEF,qEAAqE;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,iEAAiE;QACjE,8DAA8D;QAC9D,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CACX,0BAA0B,eAAe,uIAAuI,CACjL,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,kEAAkE;QAClE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAClD,SAAS,EACT,GAAG,CAAC,IAAI,CAAC,yBAAyB,CACnC,CAAC;QACF,mDAAmD;QACnD,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,wDAAwD;QACxD,IAAI,QAAQ,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CACX,8BAA8B,QAAQ,CAAC,GAAG,eAAe,QAAQ,CAAC,eAAe,oBAAoB,QAAQ,CAAC,iBAAiB,gDAAgD,QAAQ,CAAC,uBAAuB,wDAAwD,CACxQ,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CACX,cAAc,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,eAAe,+BAA+B,QAAQ,CAAC,iBAAiB,kCAAkC,QAAQ,CAAC,uBAAuB,IAAI,CACvL,CAAC;QACJ,CAAC;QAED,iBAAiB;QACjB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,oEAAoE;YACpE,oEAAoE;YACpE,qCAAqC;YACrC,kEAAkE;YAClE,qDAAqD;YACrD,MAAM,UAAU,GAAG;gBACjB,GAAG,MAAM;gBACT,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;gBAC3C,YAAY,EAAE,QAAQ;gBACtB,8DAA8D;gBAC9D,+DAA+D;gBAC/D,eAAe;gBACf,8DAA8D;gBAC9D,6DAA6D;gBAC7D,8DAA8D;gBAC9D,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,4DAA4D;YAC5D,6DAA6D;YAC7D,yDAAyD;YACzD,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iBAAiB;YACjB,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}
|
|
@@ -22,6 +22,7 @@
|
|
|
22
22
|
* `ScanFinding` / `ScanResult` types satisfy it without an index sig. */
|
|
23
23
|
interface CappableFinding {
|
|
24
24
|
severity?: string;
|
|
25
|
+
type?: string;
|
|
25
26
|
exploitable?: boolean;
|
|
26
27
|
originalSeverity?: string;
|
|
27
28
|
}
|
|
@@ -44,5 +45,16 @@ interface CappableResult {
|
|
|
44
45
|
export declare function capSeverityByExploitability(result: CappableResult): {
|
|
45
46
|
cappedCount: number;
|
|
46
47
|
};
|
|
48
|
+
/**
|
|
49
|
+
* cognium-ai#220 — cap advisory-shape CWE types (e.g. `log_injection`,
|
|
50
|
+
* CWE-117) at their circle-ir base ceiling when the LLM verifier
|
|
51
|
+
* inflated them above it. Stamps `originalSeverity`; recomputes the
|
|
52
|
+
* summary. No-op for types not in `ADVISORY_SEVERITY_CEILING` and for
|
|
53
|
+
* findings already at/below the ceiling — so scans without inflated
|
|
54
|
+
* advisory findings are byte-identical.
|
|
55
|
+
*/
|
|
56
|
+
export declare function capAdvisoryTypeSeverity(result: CappableResult): {
|
|
57
|
+
cappedCount: number;
|
|
58
|
+
};
|
|
47
59
|
export {};
|
|
48
60
|
//# sourceMappingURL=severity-policy.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"severity-policy.d.ts","sourceRoot":"","sources":["../../src/cli/severity-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;0EAC0E;AAC1E,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AACD,UAAU,cAAc;IACtB,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACnD;
|
|
1
|
+
{"version":3,"file":"severity-policy.d.ts","sourceRoot":"","sources":["../../src/cli/severity-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;0EAC0E;AAC1E,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AACD,UAAU,cAAc;IACtB,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACnD;AA+BD;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,GACrB;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAsBzB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,cAAc,GACrB;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAsBzB"}
|
|
@@ -19,6 +19,32 @@
|
|
|
19
19
|
* findings-cap, so the cap operates on corrected severities.
|
|
20
20
|
*/
|
|
21
21
|
const CAP_TO = 'medium';
|
|
22
|
+
const SEV_RANK = { low: 1, medium: 2, high: 3, critical: 4 };
|
|
23
|
+
/**
|
|
24
|
+
* cognium-ai#220 — per-type severity ceiling for advisory-shape CWE
|
|
25
|
+
* classes whose circle-ir base severity is low, but which the LLM
|
|
26
|
+
* verifier upgrades to critical/high via its exploitability map
|
|
27
|
+
* (workflow.ts), overriding the base. Anchored to circle-ir's own
|
|
28
|
+
* `getRuleInfo(type).severityLevel`: `log_injection` (CWE-117) is
|
|
29
|
+
* `low` → cap at medium. Implements the cognium-dev#247 "cap CWE-117 at
|
|
30
|
+
* medium" policy at the layer where the verifier bypasses it.
|
|
31
|
+
*/
|
|
32
|
+
const ADVISORY_SEVERITY_CEILING = {
|
|
33
|
+
log_injection: 'medium',
|
|
34
|
+
};
|
|
35
|
+
/** Recompute summary.bySeverity from the (mutated) findings. */
|
|
36
|
+
function recomputeBySeverity(result) {
|
|
37
|
+
const findings = result.findings;
|
|
38
|
+
if (!findings || !result.summary)
|
|
39
|
+
return;
|
|
40
|
+
const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
|
|
41
|
+
for (const f of findings) {
|
|
42
|
+
const s = f.severity;
|
|
43
|
+
if (s && s in bySeverity)
|
|
44
|
+
bySeverity[s]++;
|
|
45
|
+
}
|
|
46
|
+
result.summary.bySeverity = bySeverity;
|
|
47
|
+
}
|
|
22
48
|
/**
|
|
23
49
|
* Downgrade `exploitable: false` findings that are ranked critical/high
|
|
24
50
|
* to `medium`, stamping `originalSeverity`. Recomputes
|
|
@@ -44,20 +70,38 @@ export function capSeverityByExploitability(result) {
|
|
|
44
70
|
cappedCount++;
|
|
45
71
|
}
|
|
46
72
|
}
|
|
47
|
-
if (cappedCount > 0
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
73
|
+
if (cappedCount > 0)
|
|
74
|
+
recomputeBySeverity(result);
|
|
75
|
+
return { cappedCount };
|
|
76
|
+
}
|
|
77
|
+
/**
|
|
78
|
+
* cognium-ai#220 — cap advisory-shape CWE types (e.g. `log_injection`,
|
|
79
|
+
* CWE-117) at their circle-ir base ceiling when the LLM verifier
|
|
80
|
+
* inflated them above it. Stamps `originalSeverity`; recomputes the
|
|
81
|
+
* summary. No-op for types not in `ADVISORY_SEVERITY_CEILING` and for
|
|
82
|
+
* findings already at/below the ceiling — so scans without inflated
|
|
83
|
+
* advisory findings are byte-identical.
|
|
84
|
+
*/
|
|
85
|
+
export function capAdvisoryTypeSeverity(result) {
|
|
86
|
+
const findings = result.findings;
|
|
87
|
+
if (!Array.isArray(findings) || findings.length === 0) {
|
|
88
|
+
return { cappedCount: 0 };
|
|
89
|
+
}
|
|
90
|
+
let cappedCount = 0;
|
|
91
|
+
for (const f of findings) {
|
|
92
|
+
const ceiling = f.type ? ADVISORY_SEVERITY_CEILING[f.type] : undefined;
|
|
93
|
+
if (ceiling === undefined || !f.severity)
|
|
94
|
+
continue;
|
|
95
|
+
const cur = SEV_RANK[f.severity] ?? 0;
|
|
96
|
+
const cap = SEV_RANK[ceiling] ?? 0;
|
|
97
|
+
if (cur > cap && f.originalSeverity === undefined) {
|
|
98
|
+
f.originalSeverity = f.severity;
|
|
99
|
+
f.severity = ceiling;
|
|
100
|
+
cappedCount++;
|
|
58
101
|
}
|
|
59
|
-
result.summary.bySeverity = bySeverity;
|
|
60
102
|
}
|
|
103
|
+
if (cappedCount > 0)
|
|
104
|
+
recomputeBySeverity(result);
|
|
61
105
|
return { cappedCount };
|
|
62
106
|
}
|
|
63
107
|
//# sourceMappingURL=severity-policy.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"severity-policy.js","sourceRoot":"","sources":["../../src/cli/severity-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;
|
|
1
|
+
{"version":3,"file":"severity-policy.js","sourceRoot":"","sources":["../../src/cli/severity-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAeH,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,MAAM,QAAQ,GAA2B,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAErF;;;;;;;;GAQG;AACH,MAAM,yBAAyB,GAA2B;IACxD,aAAa,EAAE,QAAQ;CACxB,CAAC;AAEF,gEAAgE;AAChE,SAAS,mBAAmB,CAAC,MAAsB;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO;IACzC,MAAM,UAAU,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU;YAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IACE,CAAC,CAAC,WAAW,KAAK,KAAK;YACvB,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;YACpD,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAChC,CAAC;YACD,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,QAAQ,CAAC;YAChC,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC;YACpB,WAAW,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,WAAW,GAAG,CAAC;QAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAEjD,OAAO,EAAE,WAAW,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,SAAS;QACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAClD,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,QAAQ,CAAC;YAChC,CAAC,CAAC,QAAQ,GAAG,OAAO,CAAC;YACrB,WAAW,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,WAAW,GAAG,CAAC;QAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAEjD,OAAO,EAAE,WAAW,EAAE,CAAC;AACzB,CAAC"}
|