cognium-ai 2.39.0 → 2.40.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/commands/scan.d.ts.map +1 -1
- package/dist/cli/commands/scan.js +7 -6
- package/dist/cli/commands/scan.js.map +1 -1
- package/dist/cli/severity-policy.d.ts +1 -1
- package/dist/cli/severity-policy.d.ts.map +1 -1
- package/dist/cli/severity-policy.js +45 -14
- package/dist/cli/severity-policy.js.map +1 -1
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAS1C;;GAEG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,
|
|
1
|
+
{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAS1C;;GAEG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAgQhE"}
|
|
@@ -10,7 +10,7 @@ resetTruncationCount, snapshotTruncationCount, } from 'circle-ir-ai';
|
|
|
10
10
|
import { contextProfileFromProjectProfile, resolveContextProfile } from '../cluster-policies.js';
|
|
11
11
|
import { getEffectiveOptions, warnIfSilentExclusion } from '../effective-options.js';
|
|
12
12
|
import { applyFindingsCap } from '../findings-cap.js';
|
|
13
|
-
import {
|
|
13
|
+
import { capSeverityByExploitability, capVerifierInflation } from '../severity-policy.js';
|
|
14
14
|
import { enrichScanSarif } from '../formatters/scan-sarif-enrich.js';
|
|
15
15
|
import { resolveProjectProfileForEngine } from '../project-profile.js';
|
|
16
16
|
/**
|
|
@@ -134,11 +134,12 @@ export async function executeScan(args) {
|
|
|
134
134
|
if (exploitCapCount > 0 && !args.quiet) {
|
|
135
135
|
console.error(`[info] cognium-ai#214: capped ${exploitCapCount} finding(s) marked exploitable:false from critical/high to medium (originalSeverity preserved).`);
|
|
136
136
|
}
|
|
137
|
-
// cognium-ai#220 — cap
|
|
138
|
-
//
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
137
|
+
// cognium-ai#220 — cap verifier-inflated findings at circle-ir's base
|
|
138
|
+
// severity + 1 tier (log_injection low→medium, xss medium→high, …),
|
|
139
|
+
// reining in the LLM verifier's exploitability→severity upgrade.
|
|
140
|
+
const { cappedCount: inflationCapCount } = capVerifierInflation(rawResult);
|
|
141
|
+
if (inflationCapCount > 0 && !args.quiet) {
|
|
142
|
+
console.error(`[info] cognium-ai#220: capped ${inflationCapCount} verifier-inflated finding(s) to circle-ir base + 1 tier (originalSeverity preserved).`);
|
|
142
143
|
}
|
|
143
144
|
// cognium-ai#203 defense-in-depth — probe on-disk supported-file count
|
|
144
145
|
// when the engine reports 0 files scanned. Fires only on the failure
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB;AACjB,uEAAuE;AACvE,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/cli/commands/scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB;AACjB,uEAAuE;AACvE,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAEvE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAa;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;IAC7B,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,kCAAkC,CAAC,CAAC;gBACxE,OAAO,CAAC,KAAK,CAAC,gBAAgB,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,qCAAqC,CAAC,CAAC;gBAC1H,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,kCAAkC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,YAAY,UAAU,kCAAkC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAElD,mEAAmE;IACnE,qEAAqE;IACrE,iEAAiE;IACjE,EAAE;IACF,gEAAgE;IAChE,8DAA8D;IAC9D,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,8DAA8D;IAC9D,oCAAoC;IACpC,MAAM,gBAAgB,GAAG;QACvB,GAAG,GAAG,CAAC,OAAO;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB;KAC9B,CAAC;IAEF,kEAAkE;IAClE,8DAA8D;IAC9D,kEAAkE;IAClE,mEAAmE;IACnE,+BAA+B;IAC/B,MAAM,cAAc,GAAG,MAAM,8BAA8B,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAErF,2DAA2D;IAC3D,oEAAoE;IACpE,iEAAiE;IACjE,6DAA6D;IAC7D,qEAAqE;IACrE,6DAA6D;IAC7D,gEAAgE;IAChE,oEAAoE;IACpE,iCAAiC;IACjC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACzE,MAAM,cAAc,GAClB,sBAAsB,IAAI,gCAAgC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxF,MAAM,oBAAoB,GACxB,sBAAsB,KAAK,SAAS;QAClC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,cAAc,KAAK,SAAS;YAC5B,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,SAAS,CAAC;IAElB,MAAM,OAAO,GAAyB;QACpC,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAwB;QACrK,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAClE,SAAS,EAAE,UAAU;QACrB,mEAAmE;QACnE,kEAAkE;QAClE,gEAAgE;QAChE,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QACpD,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;QACpB,aAAa,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI;QACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QACpC,WAAW,EAAE,GAAG,CAAC,QAAQ;QACzB,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACjE,eAAe,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QAC3E,kEAAkE;QAClE,6DAA6D;QAC7D,iEAAiE;QACjE,cAAc,EAAE,cAA+C;QAC/D,6DAA6D;QAC7D,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,gEAAgE;QAChE,cAAc,EAAE,cAA+C;QAC/D,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;KACF,CAAC;IAEF,IAAI,CAAC;QACH,kEAAkE;QAClE,sDAAsD;QACtD,oBAAoB,EAAE,CAAC;QAEvB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,eAAe,GAAG,uBAAuB,EAAE,CAAC;QAElD,gEAAgE;QAChE,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;QAChF,IAAI,eAAe,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CACX,iCAAiC,eAAe,iGAAiG,CAClJ,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,iBAAiB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,OAAO,CAAC,KAAK,CACX,iCAAiC,iBAAiB,wFAAwF,CAC3I,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,0BAA0B;QAC1B,qBAAqB,CACnB,UAAU,EACV;YACE,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,gBAAgB;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAoC,CAAC,CAAC,CAAC,CAAC,SAAS;SACnF,EACD,SAAS,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,EAClC,IAAI,CACL,CAAC;QAEF,qEAAqE;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,iEAAiE;QACjE,8DAA8D;QAC9D,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CACX,0BAA0B,eAAe,uIAAuI,CACjL,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,kEAAkE;QAClE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAClD,SAAS,EACT,GAAG,CAAC,IAAI,CAAC,yBAAyB,CACnC,CAAC;QACF,mDAAmD;QACnD,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,wDAAwD;QACxD,IAAI,QAAQ,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CACX,8BAA8B,QAAQ,CAAC,GAAG,eAAe,QAAQ,CAAC,eAAe,oBAAoB,QAAQ,CAAC,iBAAiB,gDAAgD,QAAQ,CAAC,uBAAuB,wDAAwD,CACxQ,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CACX,cAAc,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,eAAe,+BAA+B,QAAQ,CAAC,iBAAiB,kCAAkC,QAAQ,CAAC,uBAAuB,IAAI,CACvL,CAAC;QACJ,CAAC;QAED,iBAAiB;QACjB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,oEAAoE;YACpE,oEAAoE;YACpE,qCAAqC;YACrC,kEAAkE;YAClE,qDAAqD;YACrD,MAAM,UAAU,GAAG;gBACjB,GAAG,MAAM;gBACT,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;gBAC3C,YAAY,EAAE,QAAQ;gBACtB,8DAA8D;gBAC9D,+DAA+D;gBAC/D,eAAe;gBACf,8DAA8D;gBAC9D,6DAA6D;gBAC7D,8DAA8D;gBAC9D,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,4DAA4D;YAC5D,6DAA6D;YAC7D,yDAAyD;YACzD,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iBAAiB;YACjB,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}
|
|
@@ -53,7 +53,7 @@ export declare function capSeverityByExploitability(result: CappableResult): {
|
|
|
53
53
|
* findings already at/below the ceiling — so scans without inflated
|
|
54
54
|
* advisory findings are byte-identical.
|
|
55
55
|
*/
|
|
56
|
-
export declare function
|
|
56
|
+
export declare function capVerifierInflation(result: CappableResult): {
|
|
57
57
|
cappedCount: number;
|
|
58
58
|
};
|
|
59
59
|
export {};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"severity-policy.d.ts","sourceRoot":"","sources":["../../src/cli/severity-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;0EAC0E;AAC1E,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AACD,UAAU,cAAc;IACtB,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACnD;
|
|
1
|
+
{"version":3,"file":"severity-policy.d.ts","sourceRoot":"","sources":["../../src/cli/severity-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;0EAC0E;AAC1E,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AACD,UAAU,cAAc;IACtB,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACnD;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,GACrB;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAsBzB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,cAAc,GACrB;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAuBzB"}
|
|
@@ -19,19 +19,48 @@
|
|
|
19
19
|
* findings-cap, so the cap operates on corrected severities.
|
|
20
20
|
*/
|
|
21
21
|
const CAP_TO = 'medium';
|
|
22
|
+
import { getRuleInfo } from 'circle-ir';
|
|
22
23
|
const SEV_RANK = { low: 1, medium: 2, high: 3, critical: 4 };
|
|
24
|
+
const SEV_NAME = ['', 'low', 'medium', 'high', 'critical'];
|
|
23
25
|
/**
|
|
24
|
-
* cognium-ai#220
|
|
25
|
-
*
|
|
26
|
-
*
|
|
27
|
-
*
|
|
28
|
-
*
|
|
29
|
-
*
|
|
30
|
-
*
|
|
26
|
+
* cognium-ai#220 follow-up — the general anti-inflation rule. The LLM
|
|
27
|
+
* verifier maps its exploitability verdict straight to a severity
|
|
28
|
+
* (`workflow.ts` exploitabilityMap), ignoring circle-ir's base severity,
|
|
29
|
+
* so it can inflate a finding several tiers above what the engine
|
|
30
|
+
* classifies the type as (log_injection low→critical, xss medium→
|
|
31
|
+
* critical, external_taint_escape medium→critical).
|
|
32
|
+
*
|
|
33
|
+
* We anchor the ceiling on circle-ir's own registry: a finding may sit at
|
|
34
|
+
* most **one tier above** its `getRuleInfo(type).severityLevel`. So
|
|
35
|
+
* log_injection (low) → medium max, xss (medium) → high max, while
|
|
36
|
+
* sql_injection (critical) / path_traversal (high) / code_injection
|
|
37
|
+
* (critical) are unaffected. Static findings already sit at ≤ base, so
|
|
38
|
+
* this only ever touches verifier-inflated ones. Subsumes the original
|
|
39
|
+
* #220 log_injection special case.
|
|
31
40
|
*/
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
41
|
+
function verifierCeiling(type) {
|
|
42
|
+
if (!type)
|
|
43
|
+
return undefined;
|
|
44
|
+
let info;
|
|
45
|
+
try {
|
|
46
|
+
info = getRuleInfo(type);
|
|
47
|
+
}
|
|
48
|
+
catch {
|
|
49
|
+
return undefined;
|
|
50
|
+
}
|
|
51
|
+
// `getRuleInfo` returns a generic CWE-20 / medium placeholder for any
|
|
52
|
+
// type it doesn't specifically classify (incl. real-but-unregistered
|
|
53
|
+
// aliases like `insecure_deserialization`, `template_injection`).
|
|
54
|
+
// Never anchor on the placeholder — capping those at base+1 would
|
|
55
|
+
// demote genuine critical findings. Only cap types with a real
|
|
56
|
+
// registry classification.
|
|
57
|
+
if (!info || info.cwe === 'CWE-20')
|
|
58
|
+
return undefined;
|
|
59
|
+
const baseRank = info.severityLevel ? SEV_RANK[info.severityLevel] : undefined;
|
|
60
|
+
if (baseRank === undefined)
|
|
61
|
+
return undefined;
|
|
62
|
+
return SEV_NAME[Math.min(4, baseRank + 1)];
|
|
63
|
+
}
|
|
35
64
|
/** Recompute summary.bySeverity from the (mutated) findings. */
|
|
36
65
|
function recomputeBySeverity(result) {
|
|
37
66
|
const findings = result.findings;
|
|
@@ -82,19 +111,21 @@ export function capSeverityByExploitability(result) {
|
|
|
82
111
|
* findings already at/below the ceiling — so scans without inflated
|
|
83
112
|
* advisory findings are byte-identical.
|
|
84
113
|
*/
|
|
85
|
-
export function
|
|
114
|
+
export function capVerifierInflation(result) {
|
|
86
115
|
const findings = result.findings;
|
|
87
116
|
if (!Array.isArray(findings) || findings.length === 0) {
|
|
88
117
|
return { cappedCount: 0 };
|
|
89
118
|
}
|
|
90
119
|
let cappedCount = 0;
|
|
91
120
|
for (const f of findings) {
|
|
92
|
-
|
|
93
|
-
|
|
121
|
+
if (!f.severity || f.originalSeverity !== undefined)
|
|
122
|
+
continue;
|
|
123
|
+
const ceiling = verifierCeiling(f.type);
|
|
124
|
+
if (ceiling === undefined)
|
|
94
125
|
continue;
|
|
95
126
|
const cur = SEV_RANK[f.severity] ?? 0;
|
|
96
127
|
const cap = SEV_RANK[ceiling] ?? 0;
|
|
97
|
-
if (cur > cap
|
|
128
|
+
if (cur > cap) {
|
|
98
129
|
f.originalSeverity = f.severity;
|
|
99
130
|
f.severity = ceiling;
|
|
100
131
|
cappedCount++;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"severity-policy.js","sourceRoot":"","sources":["../../src/cli/severity-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAeH,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,MAAM,QAAQ,GAA2B,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"severity-policy.js","sourceRoot":"","sources":["../../src/cli/severity-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAeH,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,QAAQ,GAA2B,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACrF,MAAM,QAAQ,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;;GAeG;AACH,SAAS,eAAe,CAAC,IAAwB;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,IAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,sEAAsE;IACtE,qEAAqE;IACrE,kEAAkE;IAClE,kEAAkE;IAClE,+DAA+D;IAC/D,2BAA2B;IAC3B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,gEAAgE;AAChE,SAAS,mBAAmB,CAAC,MAAsB;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO;IACzC,MAAM,UAAU,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU;YAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IACE,CAAC,CAAC,WAAW,KAAK,KAAK;YACvB,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;YACpD,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAChC,CAAC;YACD,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,QAAQ,CAAC;YAChC,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC;YACpB,WAAW,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,WAAW,GAAG,CAAC;QAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAEjD,OAAO,EAAE,WAAW,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS;YAAE,SAAS;QAC9D,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;YACd,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,QAAQ,CAAC;YAChC,CAAC,CAAC,QAAQ,GAAG,OAAO,CAAC;YACrB,WAAW,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,WAAW,GAAG,CAAC;QAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAEjD,OAAO,EAAE,WAAW,EAAE,CAAC;AACzB,CAAC"}
|