attackmap 0.4.15__tar.gz → 0.4.21__tar.gz

{attackmap-0.4.15/src/attackmap.egg-info → attackmap-0.4.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.15
+Version: 0.4.21
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>
@@ -77,7 +77,7 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.4.15).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.4.18).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
@@ -384,6 +384,27 @@ excluded from all the heuristic passes above by default, since dangerous
 patterns in test scaffolding are rarely real exposure. Set
 `ATTACKMAP_INCLUDE_TESTS=1` to scan them too (e.g. for test-quality reviews).
 
+**Recall mode (`--recall`).** Aggressiveness is only useful *behind* a verifier —
+so `--recall` widens taint discovery and marks the extra reach **speculative**
+instead of asserting it. It:
+
+- raises the max import-hop depth (2 → 4) and per-route visit budget;
+- surfaces reaches the default pass conservatively hides, like a
+  static-literal-looking `eval`/`exec`/deserialize argument;
+- **enumerates capability-reach**: every reach to a powerful capability —
+  network (`requests`/`httpx`/`axios`/`fetch`/`urlopen`), template
+  (`render_template_string`/`Template`), filesystem (`open`), redirect
+  (`redirect`/`res.redirect`) — even with **no known-bad pattern**, i.e. the
+  bare call without a request-derived argument (a genuine request-derived sink
+  still fires once, as a confirmed finding, not a duplicate).
+
+Speculative chains carry downgraded confidence, get their own LOW-severity
+finding (`SPECULATIVE (recall mode)…`), are excluded from every asserted
+downstream pass (exploitability, BOLA, attack paths), and are kept **out of
+`--fail-on-new-high`** — they are leads for `--hunt --verify` / `--triage` to
+adjudicate, not detections. Default behavior is unchanged; pair `--recall` with
+`--hunt --verify` to widen the net and then adjudicate what it catches.
+
 ### Web hardening gaps
 
 Route- and config-level checks for common web misconfigurations, each an
@@ -516,6 +537,20 @@ within each cohort the odd-one-out is reported:
 | `auth_outlier` | siblings carry an auth/authorization signal near the handler; this route doesn't | HIGH |
 | `validation_outlier` | among a cohort's state-changing handlers, peers validate input and this one shows no validation marker | LOW |
 | `method_outlier` | a lone state-changing method in an otherwise read-only cohort | MEDIUM |
+| `invariant_violation` | a mined-invariant outlier: among handlers that reach the same dangerous sink kind, the majority guard the request *before* the sink and this one doesn't — evidence cites the mined rule | HIGH |
+
+The `invariant_violation` kind is the **mined-invariant** pass (#149a): its
+cohort is not a route-path prefix but the set of handlers that reach the same
+dangerous sink (from the taint pass). When a strong majority guard the request
+before the sink, that pattern is mined as an implicit invariant and the handler
+that reaches the same sink kind with no preceding guard is flagged, citing the
+mined rule (e.g. "9 of 10 handlers that reach a database (SQL execute) sink
+apply an auth/validation guard before it"). It reasons only about **same-file**
+flows, where guard-before-sink ordering is actually verifiable (a cross-file
+sink could be called before an `authorize(...)` that textually follows it), and
+counts one handler per declaration regardless of how many verbs it exposes.
+Sanitized chains are excluded so only genuinely undefended flows form the cohort
+— it measures the code against its own norm and needs no signature.
 
 Everything is peer-relative and **confidence scales with how consistent the
 cohort is** — a lone deviation among many agreeing siblings is likelier a mistake
@@ -664,6 +699,24 @@ to confirm, not detections.** The same grounding contract as the review applies
 assignment, no exploit code, confidence-tiered, and each lead lists exactly what
 a human must verify. Uses the same auth/backend resolution as `--llm`.
 
+With `--verify`, each hypothesis is adjudicated against the actual source at its
+cited locations. **`--verify-votes N`** (default 3) turns that into a jury: **N
+independent skeptics** each adjudicate the same fixed hypothesis list. A lead is
+**CONFIRMED only on a strict majority** (NEEDS_REVIEW only when a majority flags
+the evidence as insufficient); ties and uncertainty are **REFUTED** — so a lead
+only one skeptic would confirm is dropped. **`--hunt-lenses N`** additionally
+fans generation out into N independent passes, each specialised in one failure
+mode (auth-bypass, TOCTOU/race, IDOR, deserialization, SSRF-to-internal,
+secret-misuse), and dedupes the leads across passes before verifying — more
+unique novel leads than a single generalist pass. **`--hunt-rounds N`** loops
+generation for up to N rounds, accumulating new (deduped) leads while a
+completeness critic seeds each next round with untried angles, and stops early
+once a round finds nothing new; **`--hunt-budget T`** caps the multi-round output
+tokens.
+This is the verifier the unknown-bug initiative
+([`docs/unknown-bug-epic.md`](docs/unknown-bug-epic.md)) is built on;
+`--verify-votes 1` is the classic single pass.
+
 Layered on top: **MITRE ATT&CK technique mappings** on every insight and
 **detection opportunities** (Sigma/KQL/Splunk-style hints) for each weakness.
 
@@ -722,6 +775,9 @@ attackmap analyze <path> --llm --llm-provider openai     # use OpenAI/Codex (OPE
 attackmap analyze <path> --llm --llm-provider openai --llm-model gpt-5.5   # any OpenAI model ID, passed through
 attackmap analyze <path> --hunt          # LLM vulnerability-hypothesis hunt (leads to confirm)
 attackmap analyze <path> --hunt --verify # adjudicate each lead vs. source (confirmed/refuted/review)
+attackmap analyze <path> --hunt --verify --verify-votes 3   # majority vote of N independent skeptics (default 3; 1 = single pass)
+attackmap analyze <path> --hunt --verify --hunt-lenses 4     # N lens-specialised generation passes, deduped, then verified
+attackmap analyze <path> --hunt --verify --hunt-rounds 4     # loop-until-dry generation (completeness critic seeds each round)
 attackmap analyze <path> --remediate     # LLM review-first fix suggestions (remediation.md)
 attackmap analyze <path> --triage        # cluster/dedupe/rank existing findings (triage.md; deterministic fallback)
 attackmap analyze <path> --pr-comment pr.md   # Markdown PR summary comment for CI
@@ -768,7 +824,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.4.15) — published and validated on real codebases, but
+AttackMap is **beta** (v0.4.18) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**

{attackmap-0.4.15 → attackmap-0.4.21}/README.md

@@ -16,7 +16,7 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.4.15).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.4.18).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
@@ -323,6 +323,27 @@ excluded from all the heuristic passes above by default, since dangerous
 patterns in test scaffolding are rarely real exposure. Set
 `ATTACKMAP_INCLUDE_TESTS=1` to scan them too (e.g. for test-quality reviews).
 
+**Recall mode (`--recall`).** Aggressiveness is only useful *behind* a verifier —
+so `--recall` widens taint discovery and marks the extra reach **speculative**
+instead of asserting it. It:
+
+- raises the max import-hop depth (2 → 4) and per-route visit budget;
+- surfaces reaches the default pass conservatively hides, like a
+  static-literal-looking `eval`/`exec`/deserialize argument;
+- **enumerates capability-reach**: every reach to a powerful capability —
+  network (`requests`/`httpx`/`axios`/`fetch`/`urlopen`), template
+  (`render_template_string`/`Template`), filesystem (`open`), redirect
+  (`redirect`/`res.redirect`) — even with **no known-bad pattern**, i.e. the
+  bare call without a request-derived argument (a genuine request-derived sink
+  still fires once, as a confirmed finding, not a duplicate).
+
+Speculative chains carry downgraded confidence, get their own LOW-severity
+finding (`SPECULATIVE (recall mode)…`), are excluded from every asserted
+downstream pass (exploitability, BOLA, attack paths), and are kept **out of
+`--fail-on-new-high`** — they are leads for `--hunt --verify` / `--triage` to
+adjudicate, not detections. Default behavior is unchanged; pair `--recall` with
+`--hunt --verify` to widen the net and then adjudicate what it catches.
+
 ### Web hardening gaps
 
 Route- and config-level checks for common web misconfigurations, each an
@@ -455,6 +476,20 @@ within each cohort the odd-one-out is reported:
 | `auth_outlier` | siblings carry an auth/authorization signal near the handler; this route doesn't | HIGH |
 | `validation_outlier` | among a cohort's state-changing handlers, peers validate input and this one shows no validation marker | LOW |
 | `method_outlier` | a lone state-changing method in an otherwise read-only cohort | MEDIUM |
+| `invariant_violation` | a mined-invariant outlier: among handlers that reach the same dangerous sink kind, the majority guard the request *before* the sink and this one doesn't — evidence cites the mined rule | HIGH |
+
+The `invariant_violation` kind is the **mined-invariant** pass (#149a): its
+cohort is not a route-path prefix but the set of handlers that reach the same
+dangerous sink (from the taint pass). When a strong majority guard the request
+before the sink, that pattern is mined as an implicit invariant and the handler
+that reaches the same sink kind with no preceding guard is flagged, citing the
+mined rule (e.g. "9 of 10 handlers that reach a database (SQL execute) sink
+apply an auth/validation guard before it"). It reasons only about **same-file**
+flows, where guard-before-sink ordering is actually verifiable (a cross-file
+sink could be called before an `authorize(...)` that textually follows it), and
+counts one handler per declaration regardless of how many verbs it exposes.
+Sanitized chains are excluded so only genuinely undefended flows form the cohort
+— it measures the code against its own norm and needs no signature.
 
 Everything is peer-relative and **confidence scales with how consistent the
 cohort is** — a lone deviation among many agreeing siblings is likelier a mistake
@@ -603,6 +638,24 @@ to confirm, not detections.** The same grounding contract as the review applies
 assignment, no exploit code, confidence-tiered, and each lead lists exactly what
 a human must verify. Uses the same auth/backend resolution as `--llm`.
 
+With `--verify`, each hypothesis is adjudicated against the actual source at its
+cited locations. **`--verify-votes N`** (default 3) turns that into a jury: **N
+independent skeptics** each adjudicate the same fixed hypothesis list. A lead is
+**CONFIRMED only on a strict majority** (NEEDS_REVIEW only when a majority flags
+the evidence as insufficient); ties and uncertainty are **REFUTED** — so a lead
+only one skeptic would confirm is dropped. **`--hunt-lenses N`** additionally
+fans generation out into N independent passes, each specialised in one failure
+mode (auth-bypass, TOCTOU/race, IDOR, deserialization, SSRF-to-internal,
+secret-misuse), and dedupes the leads across passes before verifying — more
+unique novel leads than a single generalist pass. **`--hunt-rounds N`** loops
+generation for up to N rounds, accumulating new (deduped) leads while a
+completeness critic seeds each next round with untried angles, and stops early
+once a round finds nothing new; **`--hunt-budget T`** caps the multi-round output
+tokens.
+This is the verifier the unknown-bug initiative
+([`docs/unknown-bug-epic.md`](docs/unknown-bug-epic.md)) is built on;
+`--verify-votes 1` is the classic single pass.
+
 Layered on top: **MITRE ATT&CK technique mappings** on every insight and
 **detection opportunities** (Sigma/KQL/Splunk-style hints) for each weakness.
 
@@ -661,6 +714,9 @@ attackmap analyze <path> --llm --llm-provider openai     # use OpenAI/Codex (OPE
 attackmap analyze <path> --llm --llm-provider openai --llm-model gpt-5.5   # any OpenAI model ID, passed through
 attackmap analyze <path> --hunt          # LLM vulnerability-hypothesis hunt (leads to confirm)
 attackmap analyze <path> --hunt --verify # adjudicate each lead vs. source (confirmed/refuted/review)
+attackmap analyze <path> --hunt --verify --verify-votes 3   # majority vote of N independent skeptics (default 3; 1 = single pass)
+attackmap analyze <path> --hunt --verify --hunt-lenses 4     # N lens-specialised generation passes, deduped, then verified
+attackmap analyze <path> --hunt --verify --hunt-rounds 4     # loop-until-dry generation (completeness critic seeds each round)
 attackmap analyze <path> --remediate     # LLM review-first fix suggestions (remediation.md)
 attackmap analyze <path> --triage        # cluster/dedupe/rank existing findings (triage.md; deterministic fallback)
 attackmap analyze <path> --pr-comment pr.md   # Markdown PR summary comment for CI
@@ -707,7 +763,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.4.15) — published and validated on real codebases, but
+AttackMap is **beta** (v0.4.18) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**

{attackmap-0.4.15 → attackmap-0.4.21}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attackmap"
-version = "0.4.15"
+version = "0.4.21"
 description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
 readme = "README.md"
 requires-python = ">=3.11"

{attackmap-0.4.15 → attackmap-0.4.21}/src/attackmap/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.4.15"
+__version__ = "0.4.21"

{attackmap-0.4.15 → attackmap-0.4.21}/src/attackmap/analyzers.py

@@ -225,9 +225,14 @@ class DefaultAnalyzer:
     def name(self) -> str:
         return self.metadata.name
 
-    def analyze(self, root: str | Path, progress: "ScanProgress | None" = None) -> AnalyzerResult:
+    def analyze(
+        self, root: str | Path, progress: "ScanProgress | None" = None, recall: bool = False
+    ) -> AnalyzerResult:
         return scan_repo(
-            root, suffixes=set(CODE_EXTENSIONS) - self._CLAIMED_SUFFIXES, progress=progress
+            root,
+            suffixes=set(CODE_EXTENSIONS) - self._CLAIMED_SUFFIXES,
+            progress=progress,
+            recall=recall,
         )
 
 
@@ -249,8 +254,10 @@ class BuiltinPythonWebAnalyzer:
     def name(self) -> str:
         return self.metadata.name
 
-    def analyze(self, root: str | Path, progress: "ScanProgress | None" = None) -> AnalyzerResult:
-        return scan_repo(root, suffixes={".py"}, progress=progress)
+    def analyze(
+        self, root: str | Path, progress: "ScanProgress | None" = None, recall: bool = False
+    ) -> AnalyzerResult:
+        return scan_repo(root, suffixes={".py"}, progress=progress, recall=recall)
 
 
 class BuiltinJavaScriptWebAnalyzer:
@@ -323,8 +330,10 @@ class BuiltinJavaScriptWebAnalyzer:
             return False
         return False
 
-    def analyze(self, root: str | Path, progress: "ScanProgress | None" = None) -> AnalyzerResult:
-        return scan_repo(root, suffixes=self._JS_SUFFIXES, progress=progress)
+    def analyze(
+        self, root: str | Path, progress: "ScanProgress | None" = None, recall: bool = False
+    ) -> AnalyzerResult:
+        return scan_repo(root, suffixes=self._JS_SUFFIXES, progress=progress, recall=recall)
 
 
 class BuiltinConfigAnalyzer:
@@ -604,12 +613,13 @@ def analyze_repository(
     root: str | Path,
     analyzers: Iterable[Analyzer] | None = None,
     progress: "ScanProgress | None" = None,
+    recall: bool = False,
 ) -> AnalyzerResult:
     repo_root = Path(root).resolve()
     active_analyzers = resolve_run_analyzers(repo_root, analyzers=analyzers)
     results: list[AnalyzerResult] = []
     for analyzer in active_analyzers:
-        result = _call_analyze(analyzer, repo_root, progress)
+        result = _call_analyze(analyzer, repo_root, progress, recall)
         _stamp_provenance(result, analyzer.name)
         results.append(result)
     if not results:
@@ -617,17 +627,26 @@ def analyze_repository(
     return merge_analyzer_results(results, root=repo_root)
 
 
-def _call_analyze(analyzer: Analyzer, root: Path, progress: "ScanProgress | None") -> AnalyzerResult:
-    """Invoke ``analyzer.analyze``, forwarding ``progress`` only to analyzers
-    that accept it. Keeps the plugin ``analyze(root)`` contract intact — old
-    plugins that don't know about progress are called unchanged."""
-    if progress is not None:
-        try:
-            if "progress" in inspect.signature(analyzer.analyze).parameters:
-                return analyzer.analyze(root, progress=progress)  # type: ignore[call-arg]
-        except (TypeError, ValueError):
-            pass
-    return analyzer.analyze(root)
+def _call_analyze(
+    analyzer: Analyzer,
+    root: Path,
+    progress: "ScanProgress | None",
+    recall: bool = False,
+) -> AnalyzerResult:
+    """Invoke ``analyzer.analyze``, forwarding ``progress``/``recall`` only to
+    analyzers that accept them. Keeps the plugin ``analyze(root)`` contract
+    intact — old plugins that don't know about these kwargs are called
+    unchanged, and ``recall`` is only ever passed when it's on."""
+    kwargs: dict[str, object] = {}
+    try:
+        params = inspect.signature(analyzer.analyze).parameters
+        if progress is not None and "progress" in params:
+            kwargs["progress"] = progress
+        if recall and "recall" in params:
+            kwargs["recall"] = recall
+    except (TypeError, ValueError):
+        pass
+    return analyzer.analyze(root, **kwargs)  # type: ignore[call-arg]
 
 
 def _stamp_provenance(result: AnalyzerResult, analyzer_name: str) -> None:

{attackmap-0.4.15 → attackmap-0.4.21}/src/attackmap/anomalies.py

@@ -18,6 +18,14 @@ forgotten decorator or a copy-paste that dropped a guard.
   validate their input and this one shows no validation marker.
 - **method_outlier**: a lone state-changing method exposed in a cohort
   that is otherwise read-only.
+- **invariant_violation** (#149a): the *mined-invariant* pass. Its cohort is
+  not a route-path prefix but the set of handlers that reach the same
+  dangerous sink kind (from the taint pass). When a strong majority guard the
+  request — an auth or validation check *before* the sink — the pass mines
+  that as an implicit invariant and flags the handler that reaches the same
+  sink kind with no guard before it, citing the mined rule as evidence. This
+  is signature-free: it compares the code against itself, so it can surface a
+  forgotten guard on a sink pattern no rule anticipates.
 
 ## Precision
 
@@ -103,6 +111,26 @@ _MAX_FILE_BYTES = 1_000_000
 # A cohort must have at least this many routes to reason about a "norm".
 _MIN_GROUP = 3
 
+# Invariant mining (#149a). A sink cohort must have at least this many distinct
+# handlers before a "guard the request before the sink" invariant is credible —
+# higher than `_MIN_GROUP` because a wrong call here points at a dangerous sink.
+_MIN_INVARIANT_COHORT = 4
+
+# Human labels for the taint sink kinds an invariant is mined over (mirrors
+# threat_model._TAINT_SINK_LABEL; kept local so anomalies.py stays standalone).
+_SINK_LABELS: dict[str, str] = {
+    "sql_execute": "database (SQL execute)",
+    "subprocess_shell": "command execution",
+    "eval": "code eval",
+    "exec": "code exec",
+    "dynamic_open": "filesystem open",
+    "unsafe_deserialization": "unsafe deserialization",
+    "ssti": "template injection",
+    "ssrf": "outbound request (SSRF)",
+    "nosql_injection": "NoSQL query",
+    "open_redirect": "redirect target",
+}
+
 # Leading segments that are transport scaffolding, not the resource itself
 # (`/api`, `/v1`, `/rest`). Stripped so the cohort key lands on the resource
 # root — /api/users, /api/users/<id> and /api/users/export all group as
@@ -159,6 +187,10 @@ def find_anomalies(
         out.extend(_method_outliers(key, members))
         out.extend(_validation_outliers(key, members, ctx))
 
+    # Mined-invariant pass (#149a): cohorts of handlers reaching the same
+    # dangerous sink, flagged when the majority guard the request before it.
+    out.extend(_invariant_violations(scan, ctx))
+
     out.sort(key=lambda a: (-a.confidence, a.route_file, a.route_path))
     return out
 
@@ -274,6 +306,180 @@ def _method_outliers(key: str, members: list[Route]) -> list[Anomaly]:
     ]
 
 
+# --- Mined-invariant pass (#149a) ------------------------------------------
+
+
+@dataclass
+class _InvHandler:
+    """One handler in a sink cohort: its analysis file + declaration line, the
+    verbs it is registered under, and the same-file chains it reaches."""
+
+    file: str
+    line: int | None
+    path: str
+    methods: set[str]
+    chains: list
+
+
+def _invariant_violations(scan: ScanResult, ctx: _SignalCtx) -> list[Anomaly]:
+    """Mine a "guard the request before the sink" invariant per sink kind and
+    flag the handler that violates it.
+
+    The cohort is not a route-path prefix but the set of handlers that reach
+    the *same dangerous sink kind* (from ``scan.taint_chains``). When a strong
+    majority of those handlers apply an auth/validation guard before the sink,
+    that pattern is mined as an implicit invariant and every cohort member that
+    reaches the same sink kind with no preceding guard is flagged, citing the
+    mined rule. Signature-free: the code is measured against its own norm.
+
+    Scope decisions that keep the high-severity signal precise:
+
+    - **Same-file flows only** (``hops == 0``). "Guard before the sink" is a
+      statement about ordering, and ordering is only verifiable when the guard
+      and the sink live in one file. A downstream (cross-file) sink could be
+      called before an ``authorize(...)`` that textually follows it, so we
+      don't guess — cross-file chains are simply out of scope here.
+    - **Anchored on the chain's own file.** The taint pass reasons from the
+      module that *defines* the handler (#107), which for a central-registration
+      Node app is not the route's registration file. Analysis therefore anchors
+      on ``chain.route_file``; a matching ``Route`` supplies the declaration line
+      for a precise per-handler span, and a resolved handler module with no such
+      match falls back to a whole-file span.
+    - **Per handler, not per verb.** One handler registered for several methods
+      emits one ``Route`` per verb; cohort identity is the handler (file +
+      declaration line), so multi-verb handlers count once.
+    - **Sanitized chains excluded** (#137) — a sink-local neutralizer is a
+      different control from a handler guard, so dropping them keeps the cohort
+      to genuinely undefended flows.
+    """
+    # (file, method, path) -> declaration line, for handlers whose defining file
+    # is the file the chain is anchored on (inline / decorator handlers).
+    line_by_key: dict[tuple[str, str, str], int] = {}
+    for route in scan.routes:
+        if is_test_file(route.file) or route.line is None:
+            continue
+        line_by_key.setdefault((route.file, route.method, route.path), route.line)
+
+    # sink_kind -> { handler_id -> _InvHandler }
+    per_kind: dict[str, dict[tuple[str, object], _InvHandler]] = {}
+    for chain in scan.taint_chains:
+        # Same-file, undefended flows only (see the scope notes above); for
+        # hops == 0 the sink file is the anchor file, so one test covers both.
+        # Speculative recall chains (#148a) are unconfirmed leads — don't mine
+        # an asserted invariant violation from them.
+        if chain.sanitized or chain.speculative or chain.hops != 0:
+            continue
+        anchor_file = chain.route_file
+        if is_test_file(anchor_file):
+            continue
+        line = line_by_key.get((anchor_file, chain.route_method, chain.route_path))
+        # Handler identity: (file, decl line) when known, else (file, path) so a
+        # resolved handler module's several verbs still collapse to one handler.
+        handler_id: tuple[str, object] = (
+            (anchor_file, line) if line is not None else (anchor_file, chain.route_path)
+        )
+        cohort = per_kind.setdefault(chain.sink_kind, {})
+        handler = cohort.get(handler_id)
+        if handler is None:
+            handler = _InvHandler(
+                file=anchor_file, line=line, path=chain.route_path, methods=set(), chains=[]
+            )
+            cohort[handler_id] = handler
+        handler.methods.add(chain.route_method)
+        handler.chains.append(chain)
+
+    out: list[Anomaly] = []
+    for kind, cohort in per_kind.items():
+        handlers = list(cohort.values())
+        if len(handlers) < _MIN_INVARIANT_COHORT:
+            continue
+        guarded: list[_InvHandler] = []
+        unguarded: list[_InvHandler] = []
+        for handler in handlers:
+            if all(
+                _guard_before_sink(handler.file, handler.line, c.sink_file, c.sink_line, ctx)
+                for c in handler.chains
+            ):
+                guarded.append(handler)
+            else:
+                unguarded.append(handler)
+        if not _is_outlier_split(len(guarded), len(unguarded), len(handlers)):
+            continue
+        label = _SINK_LABELS.get(kind, kind)
+        invariant = (
+            f"{len(guarded)} of {len(handlers)} handlers that reach a {label} sink "
+            f"apply an auth/validation guard before it"
+        )
+        examples = _handler_examples(guarded)
+        for handler in unguarded:
+            out.append(
+                Anomaly(
+                    kind="invariant_violation",
+                    route_path=handler.path,
+                    route_method="/".join(sorted(handler.methods)),
+                    route_file=handler.file,
+                    route_line=handler.line,
+                    peer_group=f"sink:{kind}",
+                    peer_group_size=len(handlers),
+                    consistent_peers=len(guarded),
+                    deviation=(
+                        f"reaches a {label} sink with no auth/validation guard "
+                        f"before it, unlike its sibling handlers"
+                    ),
+                    invariant=invariant,
+                    peer_examples=examples,
+                    severity="high",
+                    confidence=_confidence(len(guarded)),
+                    source_analyzer="anomalies",
+                )
+            )
+    return out
+
+
+def _handler_examples(handlers: list[_InvHandler], limit: int = 3) -> list[str]:
+    seen: list[str] = []
+    for h in handlers:
+        label = f"{'/'.join(sorted(h.methods))} {h.path}"
+        if label not in seen:
+            seen.append(label)
+        if len(seen) >= limit:
+            break
+    return seen
+
+
+def _guard_before_sink(
+    file: str, line: int | None, sink_file: str, sink_line: int | None, ctx: _SignalCtx
+) -> bool:
+    """True if an auth/validation marker guards the handler *before* the sink.
+
+    The handler span is its declaration line down to the next route (``line``
+    known), or the whole file when the handler is a resolved module with no
+    matching route declaration. The sink is same-file (this pass only reasons
+    about ``hops == 0`` flows): when it sits inside the span the window is
+    tightened to strictly above the sink line — a guard placed *after* the sink
+    doesn't defend it — otherwise (a sink in another handler's body, reached via
+    same-file import fan-out) the whole span counts.
+    """
+    lines = _file_lines(file, ctx)
+    if not lines:
+        return False
+    if line is None:
+        start, end = 0, len(lines)
+    else:
+        start, end = _span_bounds(line, lines, ctx.file_route_lines.get(file, []))
+    # sink_line is 1-based; index sink_line-1 is the sink itself. Only tighten
+    # the window to "before the sink" when the sink sits within this span.
+    if sink_file == file and sink_line is not None and start < sink_line - 1 < end:
+        end = sink_line - 1
+    if end <= start:
+        return False
+    window = "\n".join(lines[start:end])
+    return (
+        _AUTH_MARKERS.search(window) is not None
+        or _VALIDATION_MARKERS.search(window) is not None
+    )
+
+
 # --- Internals -------------------------------------------------------------
 
 
@@ -364,23 +570,23 @@ def _route_has_signal(route: Route, ctx: _SignalCtx, marker: re.Pattern[str]) ->
         return False
     if route.line is None:
         return marker.search("\n".join(lines)) is not None
-    start, end = _span_bounds(route, lines, ctx.file_route_lines.get(route.file, []))
+    start, end = _span_bounds(route.line, lines, ctx.file_route_lines.get(route.file, []))
     return marker.search("\n".join(lines[start:end])) is not None
 
 
-def _span_bounds(route: Route, lines: list[str], route_lines: list[int]) -> tuple[int, int]:
-    """Return the 0-based [start, end) slice of ``lines`` owned by ``route``."""
-    assert route.line is not None
-    idx = route.line - 1  # 0-based route declaration line
+def _span_bounds(line: int, lines: list[str], route_lines: list[int]) -> tuple[int, int]:
+    """Return the 0-based [start, end) slice of ``lines`` owned by the handler
+    declared at 1-based ``line``."""
+    idx = line - 1  # 0-based route declaration line
     # End at the next route declaration in the file (its decorators/body
     # belong to it), capped so a huge handler can't swallow the file.
-    next_line = next((ln for ln in route_lines if ln > route.line), None)
-    end = min(len(lines), route.line - 1 + _MAX_SPAN)
+    next_line = next((ln for ln in route_lines if ln > line), None)
+    end = min(len(lines), line - 1 + _MAX_SPAN)
     if next_line is not None:
         end = min(end, next_line - 1)
     # Extend upward over contiguous decorator lines (auth decorator placed
     # above the @route decorator), but not past the previous route.
-    prev_line = next((ln for ln in reversed(route_lines) if ln < route.line), 0)
+    prev_line = next((ln for ln in reversed(route_lines) if ln < line), 0)
     start = idx
     limit = max(prev_line, idx - _DECORATOR_LOOKUP)
     while start - 1 >= limit and lines[start - 1].lstrip().startswith("@"):

{attackmap-0.4.15 → attackmap-0.4.21}/src/attackmap/authz.py

@@ -119,7 +119,10 @@ def analyze_authz(scan: ScanResult, root: str | Path | None = None) -> list[Bola
     taint_sql_routes = {
         (c.route_method, c.route_path)
         for c in scan.taint_chains
-        if c.sink_kind == "sql_execute"
+        # Speculative recall chains (#148a) are unconfirmed leads — they must
+        # not manufacture an asserted HIGH BOLA finding that could trip the
+        # baseline gate.
+        if c.sink_kind == "sql_execute" and not c.speculative
     }
 
     # Cache per-file content (read at most once per route file).