Merge pull request #8 from Santandersecurityresearch/feat/openant-pipeline

ci: remove unit limit to scan all reachable units

Author: danielcuthbert

.github/workflows/openant-scan.yml

@@ -83,7 +83,6 @@ jobs:
             --verify \
             --enhance-mode single-shot \
             --model sonnet \
-            --limit 50 \
             --no-report \
             --workers 8 \
             --json \
@@ -94,9 +93,18 @@ jobs:
       - name: Convert findings to SARIF
         if: always()
         run: |
+          # Prefer results_verified.json (all Stage 1 findings with Stage 2 context)
+          # so the Security tab shows everything, not just Stage 2-confirmed findings.
+          VERIFIED="/tmp/openant-results/results_verified.json"
           PIPELINE_OUTPUT="/tmp/openant-results/pipeline_output.json"
-          if [ -f "$PIPELINE_OUTPUT" ]; then
-            python /tmp/openant/tools/sarif_convert.py "$PIPELINE_OUTPUT" \
+          SARIF_INPUT="${VERIFIED:-$PIPELINE_OUTPUT}"
+          if [ -f "$VERIFIED" ]; then
+            SARIF_INPUT="$VERIFIED"
+          elif [ -f "$PIPELINE_OUTPUT" ]; then
+            SARIF_INPUT="$PIPELINE_OUTPUT"
+          fi
+          if [ -f "$SARIF_INPUT" ]; then
+            python /tmp/openant/tools/sarif_convert.py "$SARIF_INPUT" \
               -o /tmp/openant-results/results.sarif
           else
             # Minimal valid empty SARIF so the upload step does not fail.
@@ -122,13 +130,23 @@ jobs:
           PIPELINE_OUTPUT="/tmp/openant-results/pipeline_output.json"
 
           VULNERABLE=0; BYPASSABLE=0; INCONCLUSIVE=0; TOTAL=0; COST="N/A"
+          S1_VULNERABLE=0; S1_INCONCLUSIVE=0; S1_SAFE=0
+          S2_VERIFIED=0; S2_AGREED=0; S2_DISAGREED=0
           if [ -f "$STDOUT" ]; then
-            VULNERABLE=$(jq -r  '.data.metrics.vulnerable   // 0' "$STDOUT" 2>/dev/null || echo 0)
-            BYPASSABLE=$(jq -r  '.data.metrics.bypassable   // 0' "$STDOUT" 2>/dev/null || echo 0)
-            INCONCLUSIVE=$(jq -r '.data.metrics.inconclusive // 0' "$STDOUT" 2>/dev/null || echo 0)
-            TOTAL=$(jq -r       '.data.units_count           // 0' "$STDOUT" 2>/dev/null || echo 0)
-            RAW_COST=$(jq -r    '.data.usage.total_cost_usd  // 0' "$STDOUT" 2>/dev/null || echo 0)
+            VULNERABLE=$(jq -r    '.data.metrics.vulnerable       // 0' "$STDOUT" 2>/dev/null || echo 0)
+            BYPASSABLE=$(jq -r    '.data.metrics.bypassable       // 0' "$STDOUT" 2>/dev/null || echo 0)
+            INCONCLUSIVE=$(jq -r  '.data.metrics.inconclusive     // 0' "$STDOUT" 2>/dev/null || echo 0)
+            TOTAL=$(jq -r         '.data.units_count               // 0' "$STDOUT" 2>/dev/null || echo 0)
+            RAW_COST=$(jq -r      '.data.usage.total_cost_usd      // 0' "$STDOUT" 2>/dev/null || echo 0)
             COST=$(printf '$%.2f' "$RAW_COST" 2>/dev/null || echo "N/A")
+            # Stage 1 raw counts (from analyze step report)
+            S1_VULNERABLE=$(jq -r '.data.step_reports[] | select(.step=="analyze") | .summary.verdicts.vulnerable // 0' "$STDOUT" 2>/dev/null || echo 0)
+            S1_INCONCLUSIVE=$(jq -r '.data.step_reports[] | select(.step=="analyze") | .summary.verdicts.inconclusive // 0' "$STDOUT" 2>/dev/null || echo 0)
+            S1_SAFE=$(jq -r       '.data.step_reports[] | select(.step=="analyze") | .summary.verdicts.safe // 0' "$STDOUT" 2>/dev/null || echo 0)
+            # Stage 2 counts (from verify step report)
+            S2_VERIFIED=$(jq -r   '.data.step_reports[] | select(.step=="verify") | .summary.findings_verified // 0' "$STDOUT" 2>/dev/null || echo 0)
+            S2_AGREED=$(jq -r     '.data.step_reports[] | select(.step=="verify") | .summary.agreed // 0' "$STDOUT" 2>/dev/null || echo 0)
+            S2_DISAGREED=$(jq -r  '.data.step_reports[] | select(.step=="verify") | .summary.disagreed // 0' "$STDOUT" 2>/dev/null || echo 0)
           fi
 
           if [ "$VULNERABLE" -gt 0 ] || [ "$BYPASSABLE" -gt 0 ]; then
@@ -161,13 +179,21 @@ jobs:
 
           ${BADGE}
 
-          | Metric | Value |
-          |--------|-------|
-          | Units scanned | ${TOTAL} |
-          | Confirmed vulnerable | ${VULNERABLE} |
-          | Bypassable controls | ${BYPASSABLE} |
-          | Inconclusive | ${INCONCLUSIVE} |
-          | LLM cost | ${COST} |
+          ### Pipeline summary
+
+          | Stage | Metric | Value |
+          |-------|--------|-------|
+          | | Units scanned | ${TOTAL} |
+          | Stage 1 — Detection | Flagged vulnerable | ${S1_VULNERABLE} |
+          | Stage 1 — Detection | Inconclusive | ${S1_INCONCLUSIVE} |
+          | Stage 1 — Detection | Safe | ${S1_SAFE} |
+          | Stage 2 — Attacker simulation | Sent for verification | ${S2_VERIFIED} |
+          | Stage 2 — Attacker simulation | Confirmed (agreed) | ${S2_AGREED} |
+          | Stage 2 — Attacker simulation | Eliminated (disagreed) | ${S2_DISAGREED} |
+          | Final | Confirmed vulnerable | ${VULNERABLE} |
+          | Final | Bypassable controls | ${BYPASSABLE} |
+          | Final | Inconclusive | ${INCONCLUSIVE} |
+          | | LLM cost | ${COST} |
 
           ${FINDING_TABLE}
 

OPENANT.md

@@ -0,0 +1,26 @@
+# OpenAnt Security Context
+
+## Application Type
+web_app
+
+## Purpose
+Vulpy is an intentionally vulnerable Python/Flask web application used for security training.
+It demonstrates common web vulnerabilities including SQL injection, XSS, CSRF, and insecure session handling.
+
+## Deployment Assumption
+For security analysis purposes, assume this application is deployed and accessible over the internet
+on a public IP address. The localhost binding in the source (`host='127.0.1.1'`) is a development
+artifact — treat the application as a production web server reachable by a remote attacker.
+
+## Trust Boundaries
+- All HTTP request parameters (query string, POST body, JSON body, headers) are attacker-controlled
+- The SQLite database is initialised and populated
+- All routes under `/user`, `/posts`, `/api`, `/mfa`, `/csp`, and `/hello` are accessible without prior authentication unless the route explicitly checks session state
+
+## Known Intentional Vulnerabilities (do not mark as false positives)
+- SQL injection via string formatting in `bad/libuser.py` and `bad/libposts.py`
+- XSS via unescaped template output
+- CSRF — no token validation on state-changing routes
+- Session impersonation via predictable session tokens
+- Authentication bypass via SQL injection in login
+- Insecure deserialisation in session handling