Flag a repository pinned to a subdomain the scan says it probably does not power

Developers do not always know which sites their code serves, so a repository
gets pinned to a subdomain and the mapping is never corrected.  When a scan
reaches none of the routes a pinned repository declares, and the site's host is
not written in that repository's code, the scan now says so on the code section,
names the repository, and offers to un-pin it, which puts it back to being
worked out automatically.  It asks for the owner to confirm first, because a
repository can still be behind a site it shares no reachable route with.

Author: hackrange

app/core/external.py

@@ -2998,8 +2998,23 @@ def code_behind(db, user, scan: ExternalDastScan, asset: ExternalAsset) -> dict:
         out.append(dict(c, full_name=repo.full_name, linked=bool(link.get("linked")),
                         link_source=link.get("source") or "",
                         link_reasons=link.get("reasons") or []))
-    linked = [dict(l, full_name=visible[l["repo_id"]].full_name)
-              for l in data.get("linked") or [] if l.get("repo_id") in visible]
+    linked = []
+    for l in data.get("linked") or []:
+        rid = l.get("repo_id")
+        if rid not in visible:
+            continue
+        link = links.get(rid) or {}
+        src = link.get("source") or ""
+        total = int(l.get("routes_total") or 0)
+        reached = int(l.get("routes_reached") or 0)
+        # A repository pinned to this subdomain that declares routes none of
+        # which the scan reached, and whose link is not from the host being
+        # written in its code, is probably not what powers this site.  Flag it
+        # so somebody can un-pin it: developers often do not know which sites
+        # their code serves, so the mapping drifts and nobody corrects it.
+        unlikely = total > 0 and reached == 0 and src != "code"
+        linked.append(dict(l, full_name=visible[rid].full_name, source=src,
+                           unlikely=unlikely))
     return {"counts": paths.get("counts") or {}, "control": paths.get("control") or {},
             "candidates": out, "linked": linked, "indexed": data.get("indexed", 0),
             "at": data.get("at", ""), "has_paths": bool(paths.get("paths"))}

app/web/templates/external_scan.html

@@ -108,6 +108,27 @@
     {% if code.linked %}
     <div class="small" style="margin-bottom:.5rem">Linked code reached:
       {% for l in code.linked %}<span class="mono">{{ l.full_name }}</span> {{ l.routes_reached }} of {{ l.routes_total }} routes{{ ', ' if not loop.last }}{% endfor %}</div>
+    {% set unlikely = code.linked | selectattr('unlikely') | list %}
+    {% if unlikely %}
+    <div class="notice warn" style="margin-bottom:.5rem">
+      <div><strong>Pinned, but maybe not behind this subdomain.</strong>
+        The scan reached none of the routes these repositories declare, and the site's host is not written in their code, so they may be pinned to <span class="mono">{{ asset.host }}</span> by mistake.  Confirm with the owner before un-pinning; developers do not always know which sites their code powers.</div>
+      {% for l in unlikely %}
+      <div class="small" style="margin-top:.3rem">
+        <span class="mono">{{ l.full_name }}</span>
+        <span class="faint">0 of {{ l.routes_total }} routes reached</span>
+        <form method="post" action="{{ base }}/external/{{ asset.id }}/repos" style="display:inline">
+          <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
+          <input type="hidden" name="repository" value="{{ l.full_name }}">
+          <input type="hidden" name="action" value="forget">
+          <input type="hidden" name="back" value="/external/{{ asset.id }}/scans/{{ scan.id }}">
+          <button class="btn sm" type="submit"
+                  data-confirm="Un-pin {{ l.full_name }} from {{ asset.host }}?  It goes back to being worked out automatically.">Un-pin</button>
+        </form>
+      </div>
+      {% endfor %}
+    </div>
+    {% endif %}
     {% endif %}
     {% if code.candidates %}
     <div class="table-scroll"><table>