Add rules and a reasoning pass for weaknesses the code patterns missed

Twenty three new code rules, each written for a class of weakness rather
than one application: checks that return true before checking anything,
CSV exports without formula neutralizing, redirects followed after checking
only the first address, a host checked and then fetched by name, certificate
checking turned off, secrets on a command line, headers set for a whole
browser session, links printed with HTML escaping only, strip_tags and
regular expressions used as sanitizers, archives read without a size limit,
SAML responses not tied to a sign in, privileged containers, and editor
settings a workspace can redirect.  Fixtures say what each rule must find
and what it must leave alone.

Code reasoning, on the AI page and off by default, asks the model about the
request handlers that take an id or do something privileged, with the access
checks they call and nothing else.  Answers are cached against exactly what
was sent, only high severity claims get a second question, and a monthly
token limit is checked before every question.  It only adds findings for a
person to confirm, and a scan never closes them.

Three read only dynamic rules: a sign in form that sends the password in the
address, single sign on discovery that names plain http addresses, and a
session cookie sent on requests from other sites.  The rule language gains
body_matches and cookie_matches, both bounded.

Author: hackrange

app/core/ai.py

@@ -107,6 +107,19 @@
     "ai.auto_review_max":      (200, False,
                                 "Most new findings one scan hands to the automatic "
                                 "review, worst first. 0 for no limit."),
+    # Off by default for the same reason.  On, the handlers that read the
+    # request and touch stored data are read after every scan, a few at a
+    # time, for access checks a pattern cannot judge.
+    "ai.code_reasoning":       (False, False,
+                                "After a scan, ask the model about request handlers for "
+                                "missing access checks and similar logic mistakes."),
+    "ai.code_reasoning_monthly_tokens": (1_000_000, False,
+                                         "Most tokens the code reasoning pass may "
+                                         "use in a calendar month, in and out "
+                                         "together."),
+    "ai.code_reasoning_per_repo": (25, False,
+                                   "Most handlers asked about in one repository per "
+                                   "run, the likeliest first."),
     # What the custom service charges, per million tokens, for the cost page.
     # Kept as text so 0.10 stays 0.10.  Empty is not counted.
     "ai.price_input":          ("", False, "Price per million input tokens."),
@@ -190,6 +203,12 @@ def read_form(form, text, number, url, checked) -> dict:
                                             "Questions per minute", 1, 600),
         "ai.auto_review_max": number(form.get("ai.auto_review_max") or 200,
                                      "New findings per scan", 0, 100_000),
+        "ai.code_reasoning": checked("ai.code_reasoning"),
+        "ai.code_reasoning_monthly_tokens": number(
+            form.get("ai.code_reasoning_monthly_tokens") or 0,
+            "Monthly token limit", 0, 2_000_000_000),
+        "ai.code_reasoning_per_repo": number(form.get("ai.code_reasoning_per_repo") or 25,
+                                             "Handlers per repository", 1, 500),
     }
 
 
@@ -295,6 +314,18 @@ def describe_model(cfg: dict) -> str:
     return ""
 
 
+def low_effort(cfg: dict) -> dict:
+    """A copy of the settings asking for the least effort the provider allows.
+
+    Only a provider with an effort setting is changed, and only when one is
+    set, because an empty one means the model does not take it.
+    """
+    out = dict(cfg)
+    if out.get("ai.anthropic_effort"):
+        out["ai.anthropic_effort"] = "low"
+    return out
+
+
 def complete(cfg: dict, system: str, prompt: str, *, max_tokens: int = None,
              timeout: float = None, purpose: str = "other") -> dict:
     """Ask once.  -> {ok, text, error, provider, model, input_tokens,

app/core/assessment.py

@@ -1106,6 +1106,9 @@ def progress():
 
 
 REPORT_ENGINE = "security-report"
+# Findings a model raised rather than a scanner.  A scan never closes them,
+# and they step aside when a scanner reports the same place.
+MODEL_ENGINES = (REPORT_ENGINE, "code-reasoning")
 MAX_LINE_FILES = 20_000
 NEAR_LINES = 3        # the same place, give or take a line or two
 SAME_CWE_LINES = 30   # the same weakness in the same part of the file
@@ -1169,7 +1172,7 @@ def hand_over(session, repositories) -> int:
         return 0
     ours = (session.query(Finding)
             .filter(Finding.repository.in_(list(repositories)),
-                    Finding.engines == REPORT_ENGINE,
+                    Finding.engines.in_(MODEL_ENGINES),
                     Finding.state == FindingState.OPEN)
             .all())
     handed = 0
@@ -1184,13 +1187,15 @@ def hand_over(session, repositories) -> int:
                                 Finding.kind.in_([FindingKind.CODE,
                                                   FindingKind.MISCONFIGURATION]),
                                 Finding.state == FindingState.OPEN,
-                                Finding.engines != REPORT_ENGINE)
+                                Finding.engines.notin_(MODEL_ENGINES))
                         .all() if _near(g, place)), None)
         if scanner is None:
             continue
         f.state, f.excepted = FindingState.WAIVED, True
         f.exception_reason = f"Now reported by the scanner as finding {scanner.id}."
-        f.exception_by, f.exception_at = "the security report", _now()
+        f.exception_by = ("the security report" if f.engines == REPORT_ENGINE
+                          else "the code reasoning pass")
+        f.exception_at = _now()
         handed += 1
     return handed