Name the exact code finding when the scan and the code agree on a weakness

When a dynamic finding sits on a route whose code holds a matching dangerous
sink, the scan already raised it to confirmed.  Now it also names the exact
code finding behind that sink, by its id, drawn from the open code findings of
that weakness type in the repositories behind the site.  So the two way link is
explicit: the dynamic report says which code finding it matches, and the code
finding shows that a scan confirmed it live.  The code telemetry is doing what a
plain dynamic scanner cannot, pointing the match at the real weakness.

Author: hackrange

app/core/dast_report.py

@@ -302,6 +302,29 @@ def available(scan) -> bool:
                                         and scan.provider == "insightappsec")
 
 
+def _sast_by_type(db, asset, user) -> dict:
+    """Open code (SAST) findings behind this site, grouped by the dynamic sink
+    type they correspond to, as {type: [GCR id, ...]}.  The weakness type is
+    read from the finding's rule, title and description with the same patterns
+    the risk engine uses, so a reachable code sink can be matched to the exact
+    code finding it came from."""
+    from app.core import dast_risk, external
+    from app.core.models import ExternalAssetRepo, Repository
+
+    names = [r.full_name for r in db.query(Repository)
+             .join(ExternalAssetRepo, ExternalAssetRepo.repository_id == Repository.id)
+             .filter(ExternalAssetRepo.asset_id == asset.id).all()]
+    if not names:
+        return {}
+    out = {}
+    for s in external.sast_findings(db, names, 300, user):
+        text = f"{s.rule or ''} {s.title or ''} {s.description or ''}"
+        for typ, rx in dast_risk._SINK_FINDING.items():
+            if rx.search(text):
+                out.setdefault(typ, []).append(s.vuln_id)
+    return out
+
+
 def build(db, asset, scan, user=None, organization: str = "") -> dict:
     """Everything the template needs for one scan."""
     from app.core import dast_engines, external
@@ -362,8 +385,12 @@ def build(db, asset, scan, user=None, organization: str = "") -> dict:
         code_sinks = []
     reachable_sinks = [s for s in code_sinks if s.get("reachable")]
     context_sinks = [s for s in code_sinks if not s.get("reachable")]
+    # Real SAST findings behind this site, grouped by the weakness type they are,
+    # so a corroboration can name the exact code finding (its GCR id), not just
+    # say "a code sink".  That is the SAST telemetry driving a positive match.
+    sast_by_type = _sast_by_type(db, asset, user)
     # A finding a reachable sink corroborates is confirmed by code and scan both.
-    dast_risk.corroborate(findings, reachable_sinks)
+    dast_risk.corroborate(findings, reachable_sinks, sast_by_type)
     risk_matrix = dast_risk.matrix(findings)
     from app.core.external_decisions import counted as _counted
 

app/core/dast_risk.py

@@ -117,10 +117,15 @@ def cell(lk: int, br: int) -> str:
 }
 
 
-def corroborate(findings: list, reachable_sinks: list) -> int:
+def corroborate(findings: list, reachable_sinks: list, sast_by_type: dict = None) -> int:
     """Raise a finding to confirmed when a reachable code sink of the matching
     kind sits on the same route: the code does the dangerous thing and the scan
-    reached it, which is the strongest evidence there is.  -> how many."""
+    reached it, which is the strongest evidence there is.  -> how many.
+
+    sast_by_type maps a sink type to the ids of the real code findings of that
+    type, so a match can name the exact code finding (ai_sast) and the link
+    shows on both the dynamic report and the code finding."""
+    sast_by_type = sast_by_type or {}
     by_route = {}
     for s in reachable_sinks or []:
         by_route.setdefault(s.get("reached_route") or "", set()).add(s.get("type"))
@@ -132,7 +137,16 @@ def corroborate(findings: list, reachable_sinks: list) -> int:
         text = f"{f.get('title') or ''} {f.get('cwe') or ''} {f.get('evidence') or ''}"
         matched = [t for t in sorted(types)
                    if _SINK_FINDING.get(t) and _SINK_FINDING[t].search(text)]
-        if matched and f.get("likelihood", 0) < 5:
+        if not matched:
+            continue
+        # Name the exact code finding the sink came from, when one of that type
+        # is known, so the two way link is explicit and not only the AI's.
+        if not f.get("ai_sast"):
+            for t in matched:
+                if sast_by_type.get(t):
+                    f["ai_sast"] = sast_by_type[t][0]
+                    break
+        if f.get("likelihood", 0) < 5:
             f["likelihood"] = 5
             f["likelihood_label"] = LIKELIHOOD_LABEL[5]
             f["sink_confirmed"] = True