Stop legacy parameter findings citing an unverified source, or none - #1
Merged
Merged
Conversation
The 33 SecurityParamAuditor.BASELINE rules are the pre-3250501 set. Two provenance failures rode out on every finding they produced: - _details() stamped baseline_source only for the ECS rules, so a legacy finding sent source:"" into server/remediation.py and servicerequest.py and rendered a blank source cell. - The full refs list rode onto the finding, unverified legacy notes (68048, 2416093, 1408081, 510007, 2191612) and CIS clauses included. servicerequest ._basis() returns the first "Note" ref as the document SAP checks the request against, so an unverified SAP Note number was published into a customer->SAP request. CLAUDE.md forbids citing an unverified identifier. Fixed at the single emit point in modules/security_params.py, so the offline reports, the console references list and the service request are all covered without any of them learning which ref is which: - _ref_is_verified() classifies against _UNVERIFIED_BASELINE_NOTES, a denylist of exactly the numbers the BASELINE comment already enumerates plus any CIS clause. A denylist, not an allowlist, so a legitimately sourced note like 3250501 or 1956086 is never dropped. - _public_refs() propagates verified refs verbatim, withholds the unverified ones, and falls back to the generic "SAP Security Baseline" CLAUDE.md prescribes when nothing verified remains, rather than a blank. - _source_label() stamps a verified baseline_source on every rule, at both the wrong-value and the not-set emit paths. check_definition.references_json is upserted on each ingest, so re-scans clean historical rows and no server change is needed. tests/test_baseline_provenance.py (88) covers the classifier, all 33 rules' public refs and source label, and the legacy emit path end to end, including that verified refs survive it (abap/path_normalization keeps both). Full suite 6086 passed / 16 skipped. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 33 SecurityParamAuditor.BASELINE rules are the pre-3250501 set. Two provenance failures rode out on every finding they produced:
Fixed at the single emit point in modules/security_params.py, so the offline reports, the console references list and the service request are all covered without any of them learning which ref is which:
check_definition.references_json is upserted on each ingest, so re-scans clean historical rows and no server change is needed.
tests/test_baseline_provenance.py (88) covers the classifier, all 33 rules' public refs and source label, and the legacy emit path end to end, including that verified refs survive it (abap/path_normalization keeps both). Full suite 6086 passed / 16 skipped.