From 7d206ad0330414c7d38f3a667a9fd182c2022096 Mon Sep 17 00:00:00 2001 From: Tigah <88289044+TBX3D@users.noreply.github.com> Date: Wed, 22 Jul 2026 15:10:21 -0700 Subject: [PATCH] fix(frameworks): stop prose and image mime types from faking magento (#322) the bare "Magento" body word matched any page that merely named the platform, and "mage/" is a substring of the near-ubiquitous "image/" mime type, so a migration guide carrying a single image reference scored both signatures and cleared the detection threshold. key on the frontend static-asset base, the data-mage-init widget attribute and the module namespace, which only appear when magento actually rendered the page. Co-authored-by: vmfunc --- internal/scan/frameworks/detectors/accuracy_test.go | 2 ++ internal/scan/frameworks/detectors/cms.go | 7 +++++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/internal/scan/frameworks/detectors/accuracy_test.go b/internal/scan/frameworks/detectors/accuracy_test.go index 8e014c7..f5a01e6 100644 --- a/internal/scan/frameworks/detectors/accuracy_test.go +++ b/internal/scan/frameworks/detectors/accuracy_test.go @@ -39,6 +39,7 @@ func TestDetectorAccuracy_FalsePositives(t *testing.T) { {"Shopify cdn body only", &shopifyDetector{}, ``, http.Header{}}, {"Spring Boot tutorial prose", &springBootDetector{}, `
To fix the Whitelabel Error Page in Spring Boot, add a controller.
`, http.Header{}}, {"Remix audio asset", &remixDetector{}, ``, http.Header{}}, + {"Magento migration guide with image mime", &magentoDetector{}, `

How to migrate your Magento store

A guide to Magento 2.
`, http.Header{}}, {"Gatsby plugin comparison prose", &gatsbyDetector{}, `
gatsby-image and gatsby-plugin-sharp used to be the standard way to handle images before gatsby-plugin-image.
`, http.Header{}}, {"Svelte ecosystem comparison prose", &svelteDetector{}, `
popular svelte-native and svelte-check tools round out the ecosystem.
`, http.Header{}}, } @@ -64,6 +65,7 @@ func TestDetectorAccuracy_TruePositives(t *testing.T) { {"Shopify storefront header", &shopifyDetector{}, "", accHeader("X-Shopify-Stage", "production")}, {"Spring Boot whitelabel page", &springBootDetector{}, `

Whitelabel Error Page

This application has no explicit mapping for /error

There was an unexpected error (type=Not Found, status=404).
`, http.Header{}}, {"Remix context", &remixDetector{}, ``, http.Header{}}, + {"Magento storefront markup", &magentoDetector{}, ``, http.Header{}}, {"Gatsby root div and page-data", &gatsbyDetector{}, `
`, http.Header{}}, {"Svelte runtime global and internal import", &svelteDetector{}, ``, http.Header{}}, } diff --git a/internal/scan/frameworks/detectors/cms.go b/internal/scan/frameworks/detectors/cms.go index fd03051..88e5efe 100644 --- a/internal/scan/frameworks/detectors/cms.go +++ b/internal/scan/frameworks/detectors/cms.go @@ -120,11 +120,14 @@ type magentoDetector struct{} func (d *magentoDetector) Name() string { return "Magento" } func (d *magentoDetector) Signatures() []fw.Signature { + // "Magento" matched mere prose, and "mage/" matched the "image/" mime + // type, together clearing the threshold on unrelated pages. key on + // structural markers that only appear when Magento actually rendered. return []fw.Signature{ - {Pattern: "Magento", Weight: 0.4}, {Pattern: "/static/frontend/", Weight: 0.4}, - {Pattern: "mage/", Weight: 0.3}, + {Pattern: "data-mage-init", Weight: 0.4}, {Pattern: "Mage.Cookies", Weight: 0.3}, + {Pattern: "Magento_", Weight: 0.3}, } }