shadowcat 2.2.0__tar.gz → 2.2.2__tar.gz

{shadowcat-2.2.0 → shadowcat-2.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: shadowcat
-Version: 2.2.0
+Version: 2.2.2
 Summary: AI-powered autonomous web security scanner with real-time streaming — enterprise DAST platform
 Project-URL: Homepage, https://github.com/shadowcat-dast/shadowcat
 Project-URL: Repository, https://github.com/shadowcat-dast/shadowcat

{shadowcat-2.2.0 → shadowcat-2.2.2}/backend/reporting/generator.py

@@ -122,6 +122,7 @@ h3 { font-size: 1rem; color: #334155; margin-bottom: 8px; }
           padding:2px 8px; font-size:0.8rem; font-family:monospace; }
 .verdict { padding:6px 12px; border-radius:6px; font-size:0.85rem; margin-top:10px; display:inline-block; }
 .verdict-confirmed    { background:#dcfce7; color:#16a34a; }
+.verdict-likely       { background:#fef3c7; color:#b45309; }
 .verdict-inconclusive { background:#ffedd5; color:#c2410c; }
 .verdict-refuted      { background:#f1f5f9; color:#64748b; }
 .verdict-pending      { background:#fef9c3; color:#92400e; }
@@ -165,12 +166,17 @@ def _render_finding(idx: int, finding: dict[str, Any], verdicts: dict[str, Any])
     elif reproduced is False:
         repro_badge = ' <span class="req-id" title="Did not reproduce on a clean-session replay">⚠ did not reproduce</span>'
     # The oracle's ruling vocabulary is exactly confirmed / refuted / inconclusive
-    # (see idor_oracle.py, general_oracle.py). A finding with no verdict entry at
-    # all hasn't been through the oracle yet — that's the only true "pending" case.
+    # (see idor_oracle.py, general_oracle.py) plus GeneralOracle's "likely" tier
+    # (a suggestive but context-blind signal — worth attention, not proof). A
+    # finding with no verdict entry at all hasn't been through the oracle yet —
+    # that's the only true "pending" case.
     verdict_label = verdict_info.get("status")
     if verdict_label == "confirmed":
         vc = "verdict-confirmed"
         vt = "Confirmed"
+    elif verdict_label == "likely":
+        vc = "verdict-likely"
+        vt = "Likely"
     elif verdict_label == "refuted":
         vc = "verdict-refuted"
         vt = "Refuted"

{shadowcat-2.2.0 → shadowcat-2.2.2}/backend/tools/general_report_tool.py

@@ -15,6 +15,19 @@ from pydantic import ValidationError
 from backend.schemas.api import GeneralFindingReport
 from backend.verification.evidence_store import EvidenceStore
 
+# CWE classes where GeneralOracle's verdict is structurally incapable of
+# rising above "inconclusive" without a baseline (see general_oracle.py's
+# CWE-639/284 branch: no baseline -> no way to prove the response is even
+# unusual, let alone another user's data). Rejecting these at submission time
+# means the agent never wastes a report on a hypothesis whose ceiling is known
+# in advance — the sufficiency gate is enforced here, not left as a "the
+# oracle will just say inconclusive" dead end downstream.
+_IDOR_REQUIRES_BASELINE = {"639", "284"}
+
+
+def _cwe_digits(cwe: str) -> str:
+    return "".join(ch for ch in (cwe or "") if ch.isdigit())
+
 
 class ReportGeneralFindingTool:
     """Validate, ground, and record a General DAST candidate finding."""
@@ -107,6 +120,20 @@ class ReportGeneralFindingTool:
                 "note": "Fix the fields and resubmit. You cannot add fields or declare a verdict.",
             }
 
+        if _cwe_digits(report.vuln_class.cwe) in _IDOR_REQUIRES_BASELINE and not report.evidence.baseline:
+            return {
+                "error": "missing_baseline",
+                "note": (
+                    "CWE-639/284 (IDOR / broken object-level access) can only ever be "
+                    "verified against a baseline showing normal, authorized access to "
+                    "compare with — without one the oracle can never return more than "
+                    "'inconclusive', so don't file it yet. Either capture a baseline "
+                    "request_id first, or if you're only testing 'does this endpoint "
+                    "require authentication at all' (no comparison needed), reclassify "
+                    "as CWE-287 or CWE-306 instead — that class doesn't need a baseline."
+                ),
+            }
+
         cited = report.cited_request_ids()
         missing = [rid for rid in cited if not self._evidence.has(rid)]
         if missing:

{shadowcat-2.2.0 → shadowcat-2.2.2}/frontend/src/components/StatusChip.tsx

@@ -1,8 +1,8 @@
 import { Chip } from "@heroui/react";
 
 // Covers both scan RunStatus (queued/running/verifying/completed/failed/cancelled)
-// and the oracle's verdict vocabulary (confirmed/refuted/inconclusive — see
-// backend/verification/{idor,general}_oracle.py). Anything else (e.g. a
+// and the oracle's verdict vocabulary (confirmed/likely/refuted/inconclusive —
+// see backend/verification/{idor,general}_oracle.py). Anything else (e.g. a
 // finding's own "pending_verification" lifecycle field) falls back to default.
 const COLOR: Record<string, "accent" | "success" | "danger" | "warning" | "default"> = {
   queued: "accent",
@@ -10,6 +10,7 @@ const COLOR: Record<string, "accent" | "success" | "danger" | "warning" | "defau
   verifying: "accent",
   completed: "success",
   confirmed: "success",
+  likely: "warning",
   failed: "danger",
   error: "danger",
   cancelled: "default",

{shadowcat-2.2.0 → shadowcat-2.2.2}/frontend/src/lib/severity.ts

@@ -23,12 +23,19 @@ export function severityOf(finding: Finding): Severity {
   return (cwe && SEVERITY_BY_CWE[cwe]) || "medium";
 }
 
-export type Verdict = "confirmed" | "refuted" | "inconclusive";
+export type Verdict = "confirmed" | "likely" | "refuted" | "inconclusive";
 
-/** The oracle's ruling vocabulary is exactly these three (see
- * backend/verification/{idor,general}_oracle.py) — anything else means the
- * finding hasn't been verified yet. */
+/** The oracle's ruling vocabulary — confirmed/refuted/inconclusive from both
+ * oracles, plus GeneralOracle's "likely" tier (a suggestive but context-blind
+ * signal — worth attention, not proof; see backend/verification/general_oracle.py).
+ * Anything else means the finding hasn't been verified yet. */
 export function normalizeVerdict(status: string | undefined): Verdict | "pending" {
-  if (status === "confirmed" || status === "refuted" || status === "inconclusive") return status;
+  if (
+    status === "confirmed" ||
+    status === "likely" ||
+    status === "refuted" ||
+    status === "inconclusive"
+  )
+    return status;
   return "pending";
 }

{shadowcat-2.2.0 → shadowcat-2.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "shadowcat"
-version = "2.2.0"
+version = "2.2.2"
 description = "AI-powered autonomous web security scanner with real-time streaming — enterprise DAST platform"
 authors = [{ name = "ShadowCat Team" }]
 readme = "README.md"

{shadowcat-2.2.0 → shadowcat-2.2.2}/tests/test_general_report_tool.py

@@ -45,6 +45,37 @@ async def test_report_finding_rejects_duplicate_signal() -> None:
     assert len(tool.findings) == 1  # the duplicate was never recorded
 
 
+async def test_report_finding_rejects_idor_without_baseline() -> None:
+    """CWE-639/284 without a baseline is guaranteed 'inconclusive' downstream —
+    reject at submission so the agent doesn't waste a report on a known dead end."""
+    store = EvidenceStore("s")
+    rid = store.put({"method": "GET", "url": "https://t/rest/order-history"}, {"status": 200})
+    tool = ReportGeneralFindingTool(store)
+    result = await tool.run(
+        title="Possible IDOR on /rest/order-history",
+        hypothesis="h",
+        vuln_class={"cwe": "CWE-639"},
+        evidence={"probe": rid},
+    )
+    assert result["error"] == "missing_baseline"
+    assert tool.findings == []
+
+
+async def test_report_finding_accepts_idor_with_baseline() -> None:
+    store = EvidenceStore("s")
+    base = store.put({"method": "GET", "url": "https://t/rest/order-history/1"}, {"status": 200})
+    probe = store.put({"method": "GET", "url": "https://t/rest/order-history/2"}, {"status": 200})
+    tool = ReportGeneralFindingTool(store)
+    result = await tool.run(
+        title="IDOR on /rest/order-history",
+        hypothesis="h",
+        vuln_class={"cwe": "CWE-639"},
+        evidence={"probe": probe, "baseline": base},
+    )
+    assert "error" not in result
+    assert len(tool.findings) == 1
+
+
 async def test_report_finding_allows_same_probe_for_a_different_cwe() -> None:
     """The same request_id may legitimately support two different findings."""
     store = EvidenceStore("s")

{shadowcat-2.2.0 → shadowcat-2.2.2}/uv.lock

@@ -1648,7 +1648,7 @@ wheels = [
 
 [[package]]
 name = "shadowcat"
-version = "2.1.0"
+version = "2.2.0"
 source = { editable = "." }
 dependencies = [
     { name = "anthropic" },