shadowcat 2.2.0__tar.gz → 2.2.1__tar.gz

{shadowcat-2.2.0 → shadowcat-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: shadowcat
-Version: 2.2.0
+Version: 2.2.1
 Summary: AI-powered autonomous web security scanner with real-time streaming — enterprise DAST platform
 Project-URL: Homepage, https://github.com/shadowcat-dast/shadowcat
 Project-URL: Repository, https://github.com/shadowcat-dast/shadowcat

{shadowcat-2.2.0 → shadowcat-2.2.1}/backend/tools/general_report_tool.py

@@ -15,6 +15,19 @@ from pydantic import ValidationError
 from backend.schemas.api import GeneralFindingReport
 from backend.verification.evidence_store import EvidenceStore
 
+# CWE classes where GeneralOracle's verdict is structurally incapable of
+# rising above "inconclusive" without a baseline (see general_oracle.py's
+# CWE-639/284 branch: no baseline -> no way to prove the response is even
+# unusual, let alone another user's data). Rejecting these at submission time
+# means the agent never wastes a report on a hypothesis whose ceiling is known
+# in advance — the sufficiency gate is enforced here, not left as a "the
+# oracle will just say inconclusive" dead end downstream.
+_IDOR_REQUIRES_BASELINE = {"639", "284"}
+
+
+def _cwe_digits(cwe: str) -> str:
+    return "".join(ch for ch in (cwe or "") if ch.isdigit())
+
 
 class ReportGeneralFindingTool:
     """Validate, ground, and record a General DAST candidate finding."""
@@ -107,6 +120,20 @@ class ReportGeneralFindingTool:
                 "note": "Fix the fields and resubmit. You cannot add fields or declare a verdict.",
             }
 
+        if _cwe_digits(report.vuln_class.cwe) in _IDOR_REQUIRES_BASELINE and not report.evidence.baseline:
+            return {
+                "error": "missing_baseline",
+                "note": (
+                    "CWE-639/284 (IDOR / broken object-level access) can only ever be "
+                    "verified against a baseline showing normal, authorized access to "
+                    "compare with — without one the oracle can never return more than "
+                    "'inconclusive', so don't file it yet. Either capture a baseline "
+                    "request_id first, or if you're only testing 'does this endpoint "
+                    "require authentication at all' (no comparison needed), reclassify "
+                    "as CWE-287 or CWE-306 instead — that class doesn't need a baseline."
+                ),
+            }
+
         cited = report.cited_request_ids()
         missing = [rid for rid in cited if not self._evidence.has(rid)]
         if missing:

{shadowcat-2.2.0 → shadowcat-2.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "shadowcat"
-version = "2.2.0"
+version = "2.2.1"
 description = "AI-powered autonomous web security scanner with real-time streaming — enterprise DAST platform"
 authors = [{ name = "ShadowCat Team" }]
 readme = "README.md"

{shadowcat-2.2.0 → shadowcat-2.2.1}/tests/test_general_report_tool.py

@@ -45,6 +45,37 @@ async def test_report_finding_rejects_duplicate_signal() -> None:
     assert len(tool.findings) == 1  # the duplicate was never recorded
 
 
+async def test_report_finding_rejects_idor_without_baseline() -> None:
+    """CWE-639/284 without a baseline is guaranteed 'inconclusive' downstream —
+    reject at submission so the agent doesn't waste a report on a known dead end."""
+    store = EvidenceStore("s")
+    rid = store.put({"method": "GET", "url": "https://t/rest/order-history"}, {"status": 200})
+    tool = ReportGeneralFindingTool(store)
+    result = await tool.run(
+        title="Possible IDOR on /rest/order-history",
+        hypothesis="h",
+        vuln_class={"cwe": "CWE-639"},
+        evidence={"probe": rid},
+    )
+    assert result["error"] == "missing_baseline"
+    assert tool.findings == []
+
+
+async def test_report_finding_accepts_idor_with_baseline() -> None:
+    store = EvidenceStore("s")
+    base = store.put({"method": "GET", "url": "https://t/rest/order-history/1"}, {"status": 200})
+    probe = store.put({"method": "GET", "url": "https://t/rest/order-history/2"}, {"status": 200})
+    tool = ReportGeneralFindingTool(store)
+    result = await tool.run(
+        title="IDOR on /rest/order-history",
+        hypothesis="h",
+        vuln_class={"cwe": "CWE-639"},
+        evidence={"probe": probe, "baseline": base},
+    )
+    assert "error" not in result
+    assert len(tool.findings) == 1
+
+
 async def test_report_finding_allows_same_probe_for_a_different_cwe() -> None:
     """The same request_id may legitimately support two different findings."""
     store = EvidenceStore("s")

{shadowcat-2.2.0 → shadowcat-2.2.1}/uv.lock

@@ -1648,7 +1648,7 @@ wheels = [
 
 [[package]]
 name = "shadowcat"
-version = "2.1.0"
+version = "2.2.0"
 source = { editable = "." }
 dependencies = [
     { name = "anthropic" },