From b805bfbb87666aac5106ae1e210981eaa9169dda Mon Sep 17 00:00:00 2001 From: Tigah <88289044+TBX3D@users.noreply.github.com> Date: Wed, 22 Jul 2026 15:44:53 -0700 Subject: [PATCH] fix(frameworks): stop django source prose from faking detection (#328) the django detector keyed on the import paths django.contrib and django.core, which appear only in tutorials and settings snippets and never in a rendered response, so any two of them crossed the threshold and fingerprinted a docs page as a live django server. replace the source tokens with real response artifacts: the csrfmiddlewaretoken hidden field, the csrftoken cookie and the /static/admin/ asset path. Co-authored-by: vmfunc --- internal/scan/frameworks/detectors/accuracy_test.go | 3 +++ internal/scan/frameworks/detectors/backend.go | 4 +--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/internal/scan/frameworks/detectors/accuracy_test.go b/internal/scan/frameworks/detectors/accuracy_test.go index f5a01e6..0046dec 100644 --- a/internal/scan/frameworks/detectors/accuracy_test.go +++ b/internal/scan/frameworks/detectors/accuracy_test.go @@ -39,6 +39,8 @@ func TestDetectorAccuracy_FalsePositives(t *testing.T) { {"Shopify cdn body only", &shopifyDetector{}, ``, http.Header{}}, {"Spring Boot tutorial prose", &springBootDetector{}, `
To fix the Whitelabel Error Page in Spring Boot, add a controller.
`, http.Header{}}, {"Remix audio asset", &remixDetector{}, ``, http.Header{}}, + {"Django settings tutorial", &djangoDetector{}, `
INSTALLED_APPS = ['django.contrib.admin', 'django.contrib.auth']
+from django.core.exceptions import ValidationError
`, http.Header{}}, {"Magento migration guide with image mime", &magentoDetector{}, `

How to migrate your Magento store

A guide to Magento 2.
`, http.Header{}}, {"Gatsby plugin comparison prose", &gatsbyDetector{}, `
gatsby-image and gatsby-plugin-sharp used to be the standard way to handle images before gatsby-plugin-image.
`, http.Header{}}, {"Svelte ecosystem comparison prose", &svelteDetector{}, `
popular svelte-native and svelte-check tools round out the ecosystem.
`, http.Header{}}, @@ -65,6 +67,7 @@ func TestDetectorAccuracy_TruePositives(t *testing.T) { {"Shopify storefront header", &shopifyDetector{}, "", accHeader("X-Shopify-Stage", "production")}, {"Spring Boot whitelabel page", &springBootDetector{}, `

Whitelabel Error Page

This application has no explicit mapping for /error

There was an unexpected error (type=Not Found, status=404).
`, http.Header{}}, {"Remix context", &remixDetector{}, ``, http.Header{}}, + {"Django admin login form", &djangoDetector{}, `
`, accHeader("Set-Cookie", "csrftoken=xyz; Path=/")}, {"Magento storefront markup", &magentoDetector{}, ``, http.Header{}}, {"Gatsby root div and page-data", &gatsbyDetector{}, `
`, http.Header{}}, {"Svelte runtime global and internal import", &svelteDetector{}, ``, http.Header{}}, diff --git a/internal/scan/frameworks/detectors/backend.go b/internal/scan/frameworks/detectors/backend.go index e789d81..94b8dcd 100644 --- a/internal/scan/frameworks/detectors/backend.go +++ b/internal/scan/frameworks/detectors/backend.go @@ -91,9 +91,7 @@ func (d *djangoDetector) Signatures() []fw.Signature { // never a header, so this must not be HeaderOnly. {Pattern: "csrfmiddlewaretoken", Weight: 0.4}, {Pattern: "csrftoken", Weight: 0.3, HeaderOnly: true}, - {Pattern: "django.contrib", Weight: 0.3}, - {Pattern: "django.core", Weight: 0.3}, - {Pattern: "__admin_media_prefix__", Weight: 0.3}, + {Pattern: "/static/admin/", Weight: 0.3}, } }