mirror of
https://github.com/usestrix/strix.git
synced 2026-10-16 04:28:23 +00:00
f5050e60ce
Add a dedicated client_side_path_traversal skill and wire the full pipeline so agents know when to test for CSPT, cannot silently skip it, and file it as a machine-separable finding class. - skill: exploitable-CSPT discovery/escalation/validation, gated on a proven request sink plus real impact (a decoded ../ that reaches no sink with impact is a false positive) - routing: a CSPT trigger in all four scan modes, plus cross-links from browser_security, path_traversal_lfi_rfi, ssrf, xss, csrf, the source-aware skills, and nextjs - coverage: a canonical VULN_CLASSES registry (aliases, sub-topics, CWE) with _SKILL_PHRASINGS derived from it, and a sub-topic gap detector so a bundled skill like browser_security cannot be marked covered by testing only its easiest surface - reporting: finding_class on create_vulnerability_report, validated from the registry, with a discriminator requirement for CSPT findings - sarif/dedupe: prefer the structured finding_class over a title keyword so CSPT and server-side path traversal (both CWE-22) no longer collide - tests: finding-class/SARIF/dedupe regression and browser-free source-to-sink fixtures; docs skills-catalog entry
20 lines
702 B
HTML
20 lines
702 B
HTML
<!DOCTYPE html>
|
|
<!--
|
|
CSPT fixture - Expected classification: negative.
|
|
The request path is hardcoded; the user-controlled query value is only shown
|
|
in the page text and never reaches the fetch path.
|
|
-->
|
|
<html>
|
|
<head><meta charset="utf-8" /><title>Profile</title></head>
|
|
<body>
|
|
<h1 id="greeting"></h1>
|
|
<pre id="profile"></pre>
|
|
<script>
|
|
const name = new URLSearchParams(location.search).get('name') || 'guest';
|
|
document.getElementById('greeting').textContent = 'Hello ' + name;
|
|
fetch('/api/profile')
|
|
.then((r) => r.json())
|
|
.then((data) => { document.getElementById('profile').textContent = JSON.stringify(data); });
|
|
</script>
|
|
</body>
|
|
</html>
|