Critical bug fixes and recall improvements (#68)

tests/fixtures/fp_guards/url_builder_const_base/expectations.json

@@ -0,0 +1,24 @@
+{
+  "required_findings": [
+    {
+      "id_prefix": "taint-unsanitised-flow",
+      "min_count": 1
+    }
+  ],
+  "forbidden_findings": [
+    {
+      "id_prefix": "taint-unsanitised-flow",
+      "file_glob": "**/server.ts"
+    }
+  ],
+  "noise_budget": {
+    "max_total_findings": 8,
+    "max_high_findings": 2
+  },
+  "performance_expectations": {
+    "max_ms_no_index": 1500,
+    "max_ms_index_cold": 2000,
+    "max_ms_index_warm": 1000,
+    "ci_mode": "lenient"
+  }
+}

tests/fixtures/fp_guards/url_builder_const_base/handler.ts

@@ -0,0 +1,10 @@
+// Negative control: an unbound base must still surface SSRF.
+// Without const-bound origin lock the abstract domain has no prefix
+// info, the SSRF arm fires.
+
+export async function fetchByBase(req: {
+  body: { path: string; base: string };
+}) {
+  const u = new URL(req.body.path, req.body.base);
+  return fetch(u);
+}

tests/fixtures/fp_guards/url_builder_const_base/server.ts

@@ -0,0 +1,17 @@
+// Phase 08 const-bound base: the URL constructor's second arg is a
+// `const` identifier whose value is a literal. Must surface no SSRF
+// finding because the abstract-string singleton domain proves the
+// origin is locked even though the base arg is not a syntactic
+// literal at the call site.
+
+export async function fetchUserPath(req: { body: { path: string } }) {
+  const apiBase = "https://api.example.com";
+  const u = new URL(req.body.path, apiBase);
+  return fetch(u);
+}
+
+export async function fetchAltPath(req: { body: { path: string } }) {
+  const altBase = "https://alt.example.com/";
+  const u = new URL(req.body.path, altBase);
+  return fetch(u);
+}