Documentation
¶
Overview ¶
Package scanpolicy holds the scoring choices a scan makes, so every entry point into Draugr makes the same ones. The CLI and the MCP server both run scans; if they prioritized differently, the answer an agent gave and the answer CI gave would diverge for no reason a user could see.
Index ¶
- Variables
- func DefaultPrioritizer(expl *exploit.Source) engine.Prioritizer
- func GateThresholds(g *saga.GateConfig) (map[string]sarif.Severity, map[string]string)
- func PrioritizerWith(expl *exploit.Source, health *dephealth.Source) engine.Prioritizer
- func Unreachable(model saga.Model, band string) []string
Constants ¶
This section is empty.
Variables ¶
var OverrulesUnreachable = map[string]bool{ exploit.SignalKEV: true, exploit.SignalEPSS: true, dephealth.SignalMalicious: true, dephealth.SignalDeprecated: false, }
OverrulesUnreachable declares, for every signal that can raise a band, whether it stands against a verdict that nothing in this codebase can reach the flaw.
A table rather than a switch, because this is the question a new signal is most likely to be added without answering. Ranking pipes compose, and the composition is where the surprises are: a signal written in isolation behaves correctly on its own and quietly discards somebody else's evidence the first time both fire on one finding.
`TestEverySignalDeclaresHowItComposes` reads the signal constants out of the packages that define them and fails on any that is missing here, so adding one is a decision somebody has to write down rather than a default they inherit.
How to decide the answer for a new signal ¶
An unreachable verdict is an *absence* claim: analysis found no route today, on one revision, and reflection, dynamic dispatch and code generation all defeat a call graph. So the question is not "is my signal important". It is **does my signal say this flaw is dangerous now, in a way that survives nobody being able to reach it?**
- Yes for exploitation, observed or predicted: the route appears the day somebody writes the call, and a wrong absence claim costs most where the flaw is one people are already using.
- Yes for a malicious package: a hostile dependency in the tree is a problem whichever of its functions anybody calls.
- No for deprecation: it says who is maintaining the package, which is an argument for replacing it rather than evidence that this flaw can fire here.
Functions ¶
func DefaultPrioritizer ¶
func DefaultPrioritizer(expl *exploit.Source) engine.Prioritizer
DefaultPrioritizer scores a finding from its severity and the component's declared exposure and criticality, optionally escalating on exploitability. expl may be nil, in which case enrichment is skipped.
func GateThresholds ¶ added in v0.98.0
GateThresholds converts a descriptor's gate block into the per-control map a Policy takes. Nil when unset, which leaves every control on the default threshold.
Here rather than beside either caller for the reason in the package doc. A verdict is the answer Draugr exists to give, and one entry point applying the descriptor's gate while another applied a fixed default would have an agent and CI disagree about the same descriptor. With nothing in either answer to show which policy produced it.
Validation has already refused a per-control threshold in the other vocabulary from the gate, so the two maps are never both populated and a value that parses as neither cannot reach here.
Returned as two maps because a threshold only means something in the vocabulary its gate asks in. Parsing every value as a severity and keeping what survived silently discarded a band, which is the whole per-control block on a band gate, and a band gate is the default.
func PrioritizerWith ¶ added in v0.128.0
PrioritizerWith is DefaultPrioritizer plus the dependency-health signal, which is off unless a descriptor asked for it.
Both enrichments may fire on one finding and they answer different questions: exploitability asks whether this flaw is being used, dependency health asks whether the package should be depended on at all. Neither is automatically the stronger claim, so the higher resulting severity wins and the escalation recorded is the one that produced it.
Exploitability takes a tie. Where both reach the same band, the statement about this specific flaw is the more useful thing for a reader to be shown, and a malicious package that only ties is one whose flaw was already critical.
func Unreachable ¶ added in v0.116.0
Unreachable names the components that cannot produce the band this run gates on, with what each one is classified as and the worst band it can actually reach.
Empty when the run gates on severity: a severity threshold is reachable from any classification, because it does not read one.
Types ¶
This section is empty.
Source Files