open/llm-security
1
0
Fork 0
Code Issues Releases 1 Activity

fix(llm-security): misc scanner correctness — reflog FP, diff exact-pass, hex dedupe, SARIF version (#20,#22,#50,#54,#56)

Browse source 
#20 git-forensics' reflog force-push detector had a redundant bare 'reset' term subsuming 'reset:', so any commit subject containing 'reset' tripped it; removed. #22 diff-engine's per-current moved-fallback greedily consumed a baseline candidate a later byte-exact match needed (mislabeling unchanged as new/moved on duplicate fingerprints); a global exact pass now runs before the moved-fallback. #54 memory-poisoning double-reported a 64+ char hex token as both base64 and hex; the base64 check now skips pure-hex tokens.

#56 SARIF output hardcoded driver.version 6.0.0 because the orchestrator called toSARIF() without a version; it now passes the real plugin version from package.json. #50 the VS Code known-malicious blocklist was empty with no explanation (unlike the JetBrains file's 'empty by design' note); added a matching blocklist_note. Suite 2004/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ
This commit is contained in:
Kjell Tore Guttormsen 2026-07-18 10:36:51 +02:00
commit 66e8ce2740
10 changed files with 340 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

27
tests/scanners/ide-extension-data.test.mjs
View file

@ -5,6 +5,9 @@
import { describe, it, beforeEach } from 'node:test';
import assert from 'node:assert/strict';
import { readFileSync } from 'node:fs';
import { resolve, dirname } from 'node:path';
import { fileURLToPath } from 'node:url';
import {
loadTopJetBrains,
loadJetBrainsBlocklist,
@ -14,6 +17,8 @@ import {
_resetCache,
} from '../../scanners/lib/ide-extension-data.mjs';
const __dirname = dirname(fileURLToPath(import.meta.url));
describe('loadTopJetBrains', () => {
beforeEach(() => _resetCache());
@ -98,3 +103,25 @@ describe('cache sanity', () => {
assert.ok(Array.isArray(vs));
});
});
// #50 (v7.8.3): the VS Code knowledge file has an empty blocklist like the
// JetBrains one, but lacked the explicit "empty by design" note — making the
// empty list read as an oversight. Pin the data/doc consistency here.
describe('top-vscode-extensions.json metadata (#50)', () => {
const KNOWLEDGE_PATH = resolve(__dirname, '../../knowledge/top-vscode-extensions.json');
it('parses as valid JSON', () => {
assert.doesNotThrow(() => JSON.parse(readFileSync(KNOWLEDGE_PATH, 'utf8')));
});
it('has a blocklist_note documenting the empty-by-design blocklist', () => {
const data = JSON.parse(readFileSync(KNOWLEDGE_PATH, 'utf8'));
assert.ok(Array.isArray(data.blocklist), 'blocklist should be an array');
assert.equal(data.blocklist.length, 0, 'blocklist is empty by design');
assert.equal(
typeof data._meta.blocklist_note, 'string',
'_meta.blocklist_note should document the empty-by-design state (like top-jetbrains-plugins.json)',
);
assert.match(data._meta.blocklist_note, /empty by design/i);
});
});