gitea-mirror/sif
1
0
Fork 0
mirror of https://github.com/lunchcat/sif.git synced 2026-07-28 14:37:01 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix(frameworks): stop gatsby and svelte prose from faking detection (#285)

Browse Source
This commit is contained in:
Tigah
2026-07-22 12:45:38 -07:00
committed by GitHub
parent 39244b454e
commit 251be8481e
3 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/scan/frameworks/detectors/accuracy_test.go
+4
View File
@@ -39,6 +39,8 @@ func TestDetectorAccuracy_FalsePositives(t *testing.T) {
{"Shopify cdn body only", &shopifyDetector{}, `<script src="https://cdn.shopify.com/s/buy-button.js"></script>`, http.Header{}},
{"Spring Boot tutorial prose", &springBootDetector{}, `<article>To fix the Whitelabel Error Page in Spring Boot, add a controller.</article>`, http.Header{}},
{"Remix audio asset", &remixDetector{}, `<audio src="/audio/track_remix.mp3"></audio>`, http.Header{}},
{"Gatsby plugin comparison prose", &gatsbyDetector{}, `<article>gatsby-image and gatsby-plugin-sharp used to be the standard way to handle images before gatsby-plugin-image.</article>`, http.Header{}},
{"Svelte ecosystem comparison prose", &svelteDetector{}, `<article>popular svelte-native and svelte-check tools round out the ecosystem.</article>`, http.Header{}},
}
for _, c := range cases {
t.Run(c.name, func(t *testing.T) {
@@ -62,6 +64,8 @@ func TestDetectorAccuracy_TruePositives(t *testing.T) {
{"Shopify storefront header", &shopifyDetector{}, "", accHeader("X-Shopify-Stage", "production")},
{"Spring Boot whitelabel page", &springBootDetector{}, `<html><body><h1>Whitelabel Error Page</h1><p>This application has no explicit mapping for /error</p><div>There was an unexpected error (type=Not Found, status=404).</div></body></html>`, http.Header{}},
{"Remix context", &remixDetector{}, `<script>window.__remixContext = {"state":{}};</script>`, http.Header{}},
{"Gatsby root div and page-data", &gatsbyDetector{}, `<html><body><div id="___gatsby"><script src="/page-data/index/page-data.json"></script></div></body></html>`, http.Header{}},
{"Svelte runtime global and internal import", &svelteDetector{}, `<script>window.__svelte = {}; import { onMount } from "svelte/internal";</script>`, http.Header{}},
}
for _, c := range cases {
t.Run(c.name, func(t *testing.T) {
internal/scan/frameworks/detectors/frontend.go
+3 -1
View File
@@ -128,9 +128,11 @@ type svelteDetector struct{}
func (d *svelteDetector) Name() string { return "Svelte" }
func (d *svelteDetector) Signatures() []fw.Signature {
// "svelte-" alone cleared the detection threshold on prose merely naming a
// package (svelte-native, svelte-check). the remaining patterns only show
// up in an actual svelte bundle.
return []fw.Signature{
{Pattern: "__svelte", Weight: 0.5},
{Pattern: "svelte-", Weight: 0.4},
{Pattern: "svelte/internal", Weight: 0.4},
}
}
internal/scan/frameworks/detectors/meta.go
+4 -2
View File
@@ -117,10 +117,12 @@ type gatsbyDetector struct{}
func (d *gatsbyDetector) Name() string { return "Gatsby" }
func (d *gatsbyDetector) Signatures() []fw.Signature {
// "gatsby-" alone cleared the detection threshold on prose merely naming a
// plugin (a migration guide, a plugin comparison). the remaining patterns
// are structural markers that only appear when gatsby rendered the page.
return []fw.Signature{
{Pattern: "___gatsby", Weight: 0.5},
{Pattern: "gatsby-", Weight: 0.4},
{Pattern: "page-data.json", Weight: 0.3},
{Pattern: "/page-data/", Weight: 0.3},
}
}