rays
eeb72fd677
Vendored from cloudflare/security-audit-skill under .agents/skills, pinned in skills-lock.json and linked into .claude/skills. Also adds the project's shared permission allow-rules in .claude/settings.json. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Tk3nAVF6n4dtjQS17FRFr
462 lines
14 KiB
JSON
462 lines
14 KiB
JSON
{
|
|
"$comment": "Top-level contract for findings.json. validate-findings.cjs interprets and checks this schema directly.",
|
|
"type": "array",
|
|
"items": {
|
|
"oneOf": [
|
|
{
|
|
"type": "object",
|
|
"description": "A source-grounded vulnerability that was independently demonstrated.",
|
|
"properties": {
|
|
"verdict": {
|
|
"type": "string",
|
|
"const": "confirmed"
|
|
},
|
|
"fingerprint": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$",
|
|
"description": "A stable source-derived identifier that does not change between validation states."
|
|
},
|
|
"title": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"root_cause": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"intended_behavior": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"trace": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string",
|
|
"enum": ["entrypoint", "propagation", "sink"]
|
|
},
|
|
"file": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"line": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"scope": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"required": ["kind", "file", "line", "scope", "description"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"evidence": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"file": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"line": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"required": ["file", "line", "description"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"conditions": {
|
|
"type": "array",
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string",
|
|
"enum": ["authentication_level", "authorization_role", "user_interaction", "system_configuration", "network_routing", "environmental_dependency", "data_state", "timing_dependency", "third_party_dependency"]
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"required": ["kind", "description"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"execution": {
|
|
"type": "object",
|
|
"description": "Target-neutral reproduction in the target's native interface.",
|
|
"properties": {
|
|
"attacker_perspective": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"payloads": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"instructions": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"observed_result": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"required": ["attacker_perspective", "payloads", "instructions", "observed_result"],
|
|
"additionalProperties": false
|
|
},
|
|
"remediation": {
|
|
"type": "object",
|
|
"properties": {
|
|
"strategy": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"code_changes": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"file_name": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"fixed_code": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": ["file_name", "fixed_code"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
},
|
|
"required": ["strategy"],
|
|
"additionalProperties": false
|
|
},
|
|
"severity": {
|
|
"type": "object",
|
|
"properties": {
|
|
"likelihood": {
|
|
"type": "object",
|
|
"properties": {
|
|
"score": {
|
|
"type": "string",
|
|
"enum": ["informational", "low", "medium", "high", "critical"]
|
|
},
|
|
"reason": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"required": ["score", "reason"],
|
|
"additionalProperties": false
|
|
},
|
|
"impact": {
|
|
"type": "object",
|
|
"properties": {
|
|
"score": {
|
|
"type": "string",
|
|
"enum": ["informational", "low", "medium", "high", "critical"]
|
|
},
|
|
"reason": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"required": ["score", "reason"],
|
|
"additionalProperties": false
|
|
},
|
|
"overall_severity": {
|
|
"type": "string",
|
|
"enum": ["informational", "low", "medium", "high", "critical"]
|
|
}
|
|
},
|
|
"required": ["likelihood", "impact", "overall_severity"],
|
|
"additionalProperties": false
|
|
},
|
|
"confidence": {
|
|
"type": "object",
|
|
"properties": {
|
|
"score": {
|
|
"type": "string",
|
|
"enum": ["low", "medium", "high"]
|
|
},
|
|
"reason": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"required": ["score", "reason"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"required": ["verdict", "fingerprint", "title", "description", "root_cause", "intended_behavior", "trace", "evidence", "conditions", "execution", "remediation", "severity", "confidence"],
|
|
"additionalProperties": false
|
|
},
|
|
{
|
|
"type": "object",
|
|
"description": "A source-grounded candidate whose decisive validation is blocked.",
|
|
"properties": {
|
|
"verdict": {
|
|
"type": "string",
|
|
"const": "needs_validation"
|
|
},
|
|
"fingerprint": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$"
|
|
},
|
|
"title": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"claimed_root_cause": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"trace": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string",
|
|
"enum": ["entrypoint", "propagation", "sink"]
|
|
},
|
|
"file": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"line": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"scope": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"required": ["kind", "file", "line", "scope", "description"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"evidence": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"file": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"line": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"required": ["file", "line", "description"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"blockers": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"validation_plan": {
|
|
"type": "object",
|
|
"properties": {
|
|
"local": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"deployment": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"required": ["verdict", "fingerprint", "title", "description", "claimed_root_cause", "trace", "evidence", "blockers", "validation_plan"],
|
|
"additionalProperties": false
|
|
},
|
|
{
|
|
"type": "object",
|
|
"description": "A source-grounded candidate refuted during validation.",
|
|
"properties": {
|
|
"verdict": {
|
|
"type": "string",
|
|
"const": "rejected"
|
|
},
|
|
"fingerprint": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$"
|
|
},
|
|
"title": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"claimed_root_cause": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"trace": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"kind": {
|
|
"type": "string",
|
|
"enum": ["entrypoint", "propagation", "sink"]
|
|
},
|
|
"file": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"line": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"scope": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"required": ["kind", "file", "line", "scope", "description"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"evidence": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"file": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"line": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"required": ["file", "line", "description"],
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"reason": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"visibleContent": true
|
|
}
|
|
},
|
|
"required": ["verdict", "fingerprint", "title", "description", "claimed_root_cause", "trace", "evidence", "reason"],
|
|
"additionalProperties": false
|
|
}
|
|
]
|
|
}
|
|
}
|