Repository navigation
feat(scanner): Phase 2 built-in scanner hardening & SARIF v2.1.0 export - #6
Open
huangji6693-max wants to merge 1 commit into
Open
huangji6693-max wants to merge 1 commit into
huangji6693-max wants to merge 1 commit into
Conversation
… v2.1.0 export
- Expand OWASP Top 10 coverage in app/services/owasp_top10.py with A04 Insecure Design and A08 Subresource Integrity probes plus baseline SQLi false-positive suppression
- Add false-positive filtering, severity calibration, and cross-phase deduplication in app/services/finding_utils.py
- Add quick/standard/deep parameter fuzz budget profiles in app/config.py
- Implement SARIF v2.1.0 exporter and GET /api/scans/{id}/report/sarif endpoint
- Add DVWA Low and OWASP Juice Shop regression fixture tests and Chapter 4 benchmark documentation
Closes BreachDirect#1
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements Phase 2 built-in scanner hardening and SARIF v2.1.0 export:
app/services/owasp_top10.py,app/services/owasp.py): Added A04:2021 — Insecure Design (check_insecure_design) and A08:2021 — Software and Data Integrity Failures (check_subresource_integrity) probes, and added baseline response comparison infuzz_url_parametersto suppress false-positive SQL error matches on pages that naturally mention SQL terms.app/services/finding_utils.py): Addedfilter_false_positives,calibrate_finding_severity, anddeduplicate_findingsto filter HTML-entity-encoded XSS reflections, calibrate verified injection findings, and keep duplicate rates well below 20%.app/config.py): Addedfuzz_profile(quick/standard/deep) andSettings.get_fuzz_budget().app/services/sarif_exporter.py,app/routers/scans.py): AddedGET /api/scans/{id}/report/sarifreturning GitHub Code Scanning compatible SARIF v2.1.0 JSON.tests/test_scanner_phase2.py,docs/thesis_chapter4_findings.md,README.md): Added DVWA Low (>= 15 findings, < 20% duplicate rate) and OWASP Juice Shop regression test suites, documented Chapter 4 benchmark finding counts, and updatedREADME.mdwith SARIF usage examples.Verification
pytest tests/ -v: 18 passedruff check app tests: All checks passedbandit -r app -c bandit.yaml -ll -q: CleanCloses #1
Payout Wallets
GBYWLISGOUWQ43VQEGXX6KRGDZ3CKAFFK3JXVLXKDO5TIFJUJ3OHJYOZ0x380C97bcbcAEf29DAc2d0ba7E180F1b4A7F38fddAyXYaA9Nf4z5fpLKY6DmubWe6D2qveMd79w8pEDNHcDw