Confirm a finding by code and scan both, and label its evidence as proof

When a reachable code sink of the matching kind sits on the same route as a
dynamic finding, the finding is raised to confirmed: the code does the
dangerous thing and the scan reached it, which is the strongest evidence
there is.  A heuristic SQL injection on a route whose handler builds a query by
string joining, both reachable, now reads as confirmed and lands in the top
risk cell instead of the middle.

The report labels a confirmed finding's evidence as Proof rather than Evidence,
so a reader can tell what is shown to be real from what is reported but not
re-proven.  Deterministic, no AI.

Author: hackrange

app/core/dast_report.py

@@ -333,7 +333,6 @@ def build(db, asset, scan, user=None, organization: str = "") -> dict:
     from app.core import dast_risk
 
     dast_risk.annotate(findings, getattr(asset, "exposure", "") or "")
-    risk_matrix = dast_risk.matrix(findings)
     # Code sinks from the mapped repositories, split by whether the scan reached
     # the route they sit behind.  Reachable ones are leads to prove; the rest
     # are context to review, not dynamic bugs.
@@ -343,6 +342,9 @@ def build(db, asset, scan, user=None, organization: str = "") -> dict:
         code_sinks = []
     reachable_sinks = [s for s in code_sinks if s.get("reachable")]
     context_sinks = [s for s in code_sinks if not s.get("reachable")]
+    # A finding a reachable sink corroborates is confirmed by code and scan both.
+    dast_risk.corroborate(findings, reachable_sinks)
+    risk_matrix = dast_risk.matrix(findings)
     from app.core.external_decisions import counted as _counted
 
     by_sev = {s: sum(1 for f in findings if f.get("severity") == s and _counted(f))

app/core/dast_risk.py

@@ -13,6 +13,7 @@
 from __future__ import annotations
 
 import re
+from urllib.parse import urlparse
 
 LIKELIHOOD_LABEL = {1: "Rare", 2: "Unlikely", 3: "Possible", 4: "Likely",
                     5: "Confirmed"}
@@ -97,6 +98,44 @@ def cell(lk: int, br: int) -> str:
     return _TABLE.get(max(1, min(5, lk)), {}).get(max(1, min(5, br)), "low")
 
 
+# A code sink type and the dynamic finding it would corroborate.
+_SINK_FINDING = {
+    "sql-injection": re.compile(r"sql\s*inj|\bsqli\b|CWE-?89\b", re.I),
+    "command-injection": re.compile(r"command inj|\brce\b|code exec|os command|CWE-?(?:78|94|77)\b", re.I),
+    "deserialization": re.compile(r"deserial|CWE-?502\b", re.I),
+    "template-injection": re.compile(r"\bssti\b|template inj|CWE-?1336\b", re.I),
+    "xss-sink": re.compile(r"\bxss\b|cross.site.script|CWE-?79\b", re.I),
+    "path-traversal": re.compile(r"path travers|directory travers|local file|\blfi\b|CWE-?(?:22|98)\b", re.I),
+}
+
+
+def corroborate(findings: list, reachable_sinks: list) -> int:
+    """Raise a finding to confirmed when a reachable code sink of the matching
+    kind sits on the same route: the code does the dangerous thing and the scan
+    reached it, which is the strongest evidence there is.  -> how many."""
+    by_route = {}
+    for s in reachable_sinks or []:
+        by_route.setdefault(s.get("reached_route") or "", set()).add(s.get("type"))
+    raised = 0
+    for f in findings:
+        types = by_route.get(urlparse(str(f.get("url") or "")).path)
+        if not types:
+            continue
+        text = f"{f.get('title') or ''} {f.get('cwe') or ''} {f.get('evidence') or ''}"
+        matched = [t for t in sorted(types)
+                   if _SINK_FINDING.get(t) and _SINK_FINDING[t].search(text)]
+        if matched and f.get("likelihood", 0) < 5:
+            f["likelihood"] = 5
+            f["likelihood_label"] = LIKELIHOOD_LABEL[5]
+            f["sink_confirmed"] = True
+            f["risk"] = cell(5, f.get("breachability", 3))
+            f["risk_basis"] = ((f.get("risk_basis") or "")
+                               + f"  Corroborated by a code sink ({', '.join(matched)}) "
+                               "on the same reachable route.")
+            raised += 1
+    return raised
+
+
 def annotate(findings: list, exposure: str = "") -> list:
     """Add likelihood, breachability, risk and a basis to each finding, in place."""
     for f in findings:

app/web/templates/dast_report_pdf.html

@@ -251,7 +251,7 @@ <h3>{{ f.ref }}  {{ f.title }}</h3>
     {% if f.decision and f.decision.kind == 'exception' %}<tr><td class="k">Exception</td><td>Accepted until {{ f.decision.expires[:10] }} by {{ f.decision.by }}.  {{ f.decision.reason | sentence_spaced }}  Not counted toward the grade.</td></tr>{% endif %}
     {% if f.ai_verdict %}<tr><td class="k">Enhanced review</td><td>{{ f.ai_verdict | replace('_', ' ') }}{% if f.ai_why %}.  {{ f.ai_why | sentence_spaced }}{% endif %}{% if f.ai_sast %}  Matches code finding {{ f.ai_sast }}.{% endif %}</td></tr>{% endif %}
   </table>
-  {% if f.evidence %}<div class="label"><strong>Evidence</strong></div><pre>{{ f.evidence }}</pre>{% endif %}
+  {% if f.evidence %}<div class="label"><strong>{{ 'Proof' if f.likelihood and f.likelihood >= 4 else 'Evidence' }}</strong></div><pre>{{ f.evidence }}</pre>{% endif %}
   {% if f.repro.command %}
   <div style="margin-top:2mm"><strong>To see it again</strong></div>
   <pre>{{ f.repro.command }}</pre>