From 251be8481e1f794d3d37ebd21b38adf0adad779b Mon Sep 17 00:00:00 2001 From: Tigah <88289044+TBX3D@users.noreply.github.com> Date: Wed, 22 Jul 2026 12:45:38 -0700 Subject: [PATCH] fix(frameworks): stop gatsby and svelte prose from faking detection (#285) --- internal/scan/frameworks/detectors/accuracy_test.go | 4 ++++ internal/scan/frameworks/detectors/frontend.go | 4 +++- internal/scan/frameworks/detectors/meta.go | 6 ++++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/internal/scan/frameworks/detectors/accuracy_test.go b/internal/scan/frameworks/detectors/accuracy_test.go index 0a70168..8e014c7 100644 --- a/internal/scan/frameworks/detectors/accuracy_test.go +++ b/internal/scan/frameworks/detectors/accuracy_test.go @@ -39,6 +39,8 @@ func TestDetectorAccuracy_FalsePositives(t *testing.T) { {"Shopify cdn body only", &shopifyDetector{}, ``, http.Header{}}, {"Spring Boot tutorial prose", &springBootDetector{}, `
To fix the Whitelabel Error Page in Spring Boot, add a controller.
`, http.Header{}}, {"Remix audio asset", &remixDetector{}, ``, http.Header{}}, + {"Gatsby plugin comparison prose", &gatsbyDetector{}, `
gatsby-image and gatsby-plugin-sharp used to be the standard way to handle images before gatsby-plugin-image.
`, http.Header{}}, + {"Svelte ecosystem comparison prose", &svelteDetector{}, `
popular svelte-native and svelte-check tools round out the ecosystem.
`, http.Header{}}, } for _, c := range cases { t.Run(c.name, func(t *testing.T) { @@ -62,6 +64,8 @@ func TestDetectorAccuracy_TruePositives(t *testing.T) { {"Shopify storefront header", &shopifyDetector{}, "", accHeader("X-Shopify-Stage", "production")}, {"Spring Boot whitelabel page", &springBootDetector{}, `

Whitelabel Error Page

This application has no explicit mapping for /error

There was an unexpected error (type=Not Found, status=404).
`, http.Header{}}, {"Remix context", &remixDetector{}, ``, http.Header{}}, + {"Gatsby root div and page-data", &gatsbyDetector{}, `
`, http.Header{}}, + {"Svelte runtime global and internal import", &svelteDetector{}, ``, http.Header{}}, } for _, c := range cases { t.Run(c.name, func(t *testing.T) { diff --git a/internal/scan/frameworks/detectors/frontend.go b/internal/scan/frameworks/detectors/frontend.go index 488cfa4..ec1bff2 100644 --- a/internal/scan/frameworks/detectors/frontend.go +++ b/internal/scan/frameworks/detectors/frontend.go @@ -128,9 +128,11 @@ type svelteDetector struct{} func (d *svelteDetector) Name() string { return "Svelte" } func (d *svelteDetector) Signatures() []fw.Signature { + // "svelte-" alone cleared the detection threshold on prose merely naming a + // package (svelte-native, svelte-check). the remaining patterns only show + // up in an actual svelte bundle. return []fw.Signature{ {Pattern: "__svelte", Weight: 0.5}, - {Pattern: "svelte-", Weight: 0.4}, {Pattern: "svelte/internal", Weight: 0.4}, } } diff --git a/internal/scan/frameworks/detectors/meta.go b/internal/scan/frameworks/detectors/meta.go index ad30466..f14d08f 100644 --- a/internal/scan/frameworks/detectors/meta.go +++ b/internal/scan/frameworks/detectors/meta.go @@ -117,10 +117,12 @@ type gatsbyDetector struct{} func (d *gatsbyDetector) Name() string { return "Gatsby" } func (d *gatsbyDetector) Signatures() []fw.Signature { + // "gatsby-" alone cleared the detection threshold on prose merely naming a + // plugin (a migration guide, a plugin comparison). the remaining patterns + // are structural markers that only appear when gatsby rendered the page. return []fw.Signature{ {Pattern: "___gatsby", Weight: 0.5}, - {Pattern: "gatsby-", Weight: 0.4}, - {Pattern: "page-data.json", Weight: 0.3}, + {Pattern: "/page-data/", Weight: 0.3}, } }