fix: eliminate false positives from severity inflation, CDN headers, HSTS correlation by Bulletdev · Pull Request #17 · effront/anarcry

Bulletdev · 2026-11-01T13:20:43Z

Summary

Finding.of() severity override removed -- the factory was replacing module-set severity with Severity.fromScore(cvss), inflating INFO findings to MEDIUM (Headers) and deflating CRITICAL/HIGH to LOW (HSTS). Modules now control their own severity.
CDN/WAF Server header whitelist -- Server: cloudflare/akamai/fastly/etc no longer flagged as technology disclosure. CDN names extracted to CDN_WAF_NAMES constant, reused in WAF detection.
HSTS probe correlation -- HTTPS probe runs first; "HTTP accessible -- SSLstrip" suppressed when HSTS has adequate max-age (>= 31536000).
Module severity alignment -- OpenRedirect (HIGH->MEDIUM), CRLF (CRITICAL->MEDIUM), CachePoisoning (CRITICAL->HIGH), XSS reflected (HIGH->CRITICAL) aligned to CVSS profiles.

False positives eliminated (usenexus.app.br scan)

Finding	Root cause	Result
Server: cloudflare (MEDIUM)	CDN header + severity inflation	Suppressed
Permissions-Policy ausente (MEDIUM)	INFO inflated to MEDIUM	Now INFO
HTTP accessible -- SSLstrip (LOW)	HSTS present with max-age=31536000	Suppressed
HSTS sem preload (LOW)	INFO inflated to LOW	Now INFO

Test plan

./gradlew test -- 209 tests passing
./gradlew spotlessApply -- formatting clean
Re-scan usenexus.app.br and verify eliminated findings don't appear
Scan a target without HSTS to verify HTTP accessible finding still fires
Scan a target with Server: nginx/1.21 to verify non-CDN disclosure still fires

…and HSTS correlation Finding.of() was silently replacing each module's severity with Severity.fromScore(cvss), causing INFO findings to appear as MEDIUM (Headers CWE-693 CVSS 5.4) and CRITICAL/HIGH findings to deflate to LOW (HSTS CWE-319 CVSS 3.1). The factory now honors the passed severity so each module controls its own risk rating. HeadersModule no longer flags CDN/WAF/proxy Server headers (cloudflare, akamai, fastly, etc.) as technology disclosure -- these are edge-injected, not controllable by the origin, and the recommendation to remove them was not actionable. HSTSModule now runs the HTTPS probe first; the "HTTP accessible -- SSLstrip" finding is suppressed when HSTS is present with adequate max-age, since SSLstrip is mitigated after the first visit. Aligned severity values in OpenRedirect (HIGH->MEDIUM), CRLF (CRITICAL->MEDIUM), CachePoisoning (CRITICAL->HIGH), and XSS reflected (HIGH->CRITICAL) to match their CVSS profiles -- these modules passed aspirational values that were always overridden.

github-actions · 2026-11-01T13:21:24Z

Semgrep Static Analysis

Severity	Count
Errors	0
Critical (HIGH confidence)	0
Warnings	0

✅ No issues found.

github-actions · 2026-11-01T13:21:30Z

SpotBugs + FindSecBugs

Total findings: 0
High priority (P1/P2): 0

✅ No high-priority issues.

codacy-production · 2026-11-01T13:21:32Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 5 complexity · 12 duplication

Metric Results

Complexity 5

Duplication 12

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

github-actions · 2026-11-01T13:21:40Z

Security Scan Summary

Check	Status
SpotBugs + FindSecBugs	✅ success
Semgrep	✅ success
Secret Detection	✅ success

✅ All security checks passed!

codacy-production

Pull Request Overview

⚠️ Resolve issues before merging

The reflected-XSS finding is assigned CRITICAL while the detection log still reports HIGH, reintroducing severity inflation and contradicting the stated calibration goal. This should be corrected before merging.

No regression tests or coverage data were included, so the acceptance criteria around severity preservation, CDN handling, HSTS correlation, and non-CDN disclosure remain unverified. The CDN classification should also avoid suppressing unrelated headers that merely contain a known token.

Test suggestions

Verify both Finding.of overloads preserve the caller-provided severity rather than deriving it from CVSS.
Verify CDN/WAF Server values are recognized for WAF handling and are excluded from Server technology-disclosure findings.
Verify a non-CDN Server value still generates a technology-disclosure finding.
Verify the HTTP downgrade finding is suppressed when HTTPS HSTS max-age is at least one year.
Verify the HTTP downgrade finding remains present when HSTS is absent or below the threshold.
Verify the adjusted severities for OpenRedirect, CRLF, CachePoisoning, and reflected XSS.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify both Finding.of overloads preserve the caller-provided severity rather than deriving it from CVSS.
2. Verify CDN/WAF Server values are recognized for WAF handling and are excluded from Server technology-disclosure findings.
3. Verify a non-CDN Server value still generates a technology-disclosure finding.
4. Verify the HTTP downgrade finding is suppressed when HTTPS HSTS max-age is at least one year.
5. Verify the HTTP downgrade finding remains present when HSTS is absent or below the threshold.
6. Verify the adjusted severities for OpenRedirect, CRLF, CachePoisoning, and reflected XSS.

Low confidence findings

Add automated regression coverage for the changed severity, header-classification, and HSTS-correlation paths. Ensure CDN/WAF matching is token-aware or exact enough that unrelated Server values are not suppressed.

_{TIP Improve review quality by adding custom instructions}
_{TIP How was this review? Give us feedback}

codacy-production · 2026-11-01T13:21:47Z

                            log.accept("[!!] XSS HIGH: '" + htmlPayload + "' refletido sem encoding em " + endpoint);
                            local.add(Finding.of(id(), endpoint, "Reflected XSS -- Payload Executável Refletido",
-                                    Severity.HIGH,
+                                    Severity.CRITICAL,


_{🔴 HIGH RISK}

Keep the confirmed reflected-XSS finding at HIGH to align with the detection/log severity and avoid reintroducing severity inflation.

Suggested change:

Suggested change

Severity.CRITICAL,

Severity.HIGH,

See Complexity in Codacy

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

Bulletdev · 2026-11-01T13:47:49Z

Re: Codacy XSS severity suggestion -- Dismissing. CVSS for XSS is 9.3 (CRITICAL) and the test at ScanHarnessTest:2099 asserts Severity.CRITICAL. Reverting to HIGH would break the test and underrate a confirmed reflected XSS with executable payload. Fixed the log message inconsistency ("XSS HIGH" -> "XSS CRITICAL") in e6a4fa9.

github-actions · 2026-11-01T13:48:13Z

SpotBugs + FindSecBugs

Total findings: 0
High priority (P1/P2): 0

✅ No high-priority issues.

github-actions · 2026-11-01T13:48:17Z

Semgrep Static Analysis

Severity	Count
Errors	0
Critical (HIGH confidence)	0
Warnings	0

✅ No issues found.

github-actions · 2026-11-01T13:48:25Z

Security Scan Summary

Check	Status
SpotBugs + FindSecBugs	✅ success
Semgrep	✅ success
Secret Detection	✅ success

✅ All security checks passed!

- Finding.of preserves caller severity (both overloads) - CDN Server header (cloudflare) suppressed, non-CDN (nginx) reported - HSTS HTTP downgrade suppressed with adequate max-age - HSTS HTTP downgrade present when HSTS absent

github-actions · 2026-11-01T13:58:24Z

Semgrep Static Analysis

Severity	Count
Errors	0
Critical (HIGH confidence)	0
Warnings	0

✅ No issues found.

github-actions · 2026-11-01T13:58:45Z

SpotBugs + FindSecBugs

Total findings: 0
High priority (P1/P2): 0

✅ No high-priority issues.

github-actions · 2026-11-01T13:58:53Z

Security Scan Summary

Check	Status
SpotBugs + FindSecBugs	✅ success
Semgrep	✅ success
Secret Detection	✅ success

✅ All security checks passed!

codacy-production Bot reviewed Nov 1, 2026

View reviewed changes

fix: align XSS log message with CRITICAL severity

e6a4fa9

test: add 6 regression tests for false-positive fixes

61b4e01

- Finding.of preserves caller severity (both overloads) - CDN Server header (cloudflare) suppressed, non-CDN (nginx) reported - HSTS HTTP downgrade suppressed with adequate max-age - HSTS HTTP downgrade present when HSTS absent

Bulletdev merged commit 316b8df into main Nov 1, 2026
9 checks passed

Conversation

Bulletdev commented Nov 1, 2026

Summary

False positives eliminated (usenexus.app.br scan)

Test plan

Uh oh!

github-actions Bot commented Nov 1, 2026

Semgrep Static Analysis

Uh oh!

github-actions Bot commented Nov 1, 2026

SpotBugs + FindSecBugs

Uh oh!

codacy-production Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

github-actions Bot commented Nov 1, 2026

Security Scan Summary

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

Test suggestions

Uh oh!

codacy-production Bot Nov 1, 2026

Choose a reason for hiding this comment

Uh oh!

Bulletdev commented Nov 1, 2026

Uh oh!

github-actions Bot commented Nov 1, 2026

SpotBugs + FindSecBugs

Uh oh!

github-actions Bot commented Nov 1, 2026

Semgrep Static Analysis

Uh oh!

github-actions Bot commented Nov 1, 2026

Security Scan Summary

Uh oh!

github-actions Bot commented Nov 1, 2026

Semgrep Static Analysis

Uh oh!

github-actions Bot commented Nov 1, 2026

SpotBugs + FindSecBugs

Uh oh!

github-actions Bot commented Nov 1, 2026

Security Scan Summary

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

codacy-production Bot commented Nov 1, 2026 •

edited

Loading