pentest/threat_correlation.py:18-29 treats Hypothesis.file as a filesystem path:
p = Path(file)
if not p.is_absolute():
return p.as_posix().removeprefix("./")SARIF's artifactLocation.uri is a URI, and the spec permits an absolute file:// form. guardlink.py passes it through verbatim. Path('file:///repo/src/main.ts') is relative as far as pathlib is concerned — it has no leading / — so the absolute branch is never taken, no resolution happens, and the key becomes the literal string file:/repo/src/main.ts. That matches no key electron_surface ever produces.
Every routeless threat from such a producer is therefore filed review-only, and the run prints 0 correlated, N review-only and exits successfully — indistinguishable from a codebase where nothing genuinely correlates. Same silent-miss shape as the relative---codebase bug fixed on feat/constant-channels (resolved once at the boundary via cxg_pentest.resolve_codebase), but on the other side of the join, and not reachable through that fix.
guardlink itself emits relative URIs today, which is why this has not bitten; it is a correctness gap against any other SARIF producer.
Suggested fix: in _rel, detect a file: scheme and convert with urllib.request.url2pathname(urlparse(uri).path) before the existing absolute/relative split. Reject or pass through unchanged any other scheme rather than string-stripping it — see _rel's own annotation on why a character strip manufactured false correlations.
pentest/threat_correlation.py:18-29treatsHypothesis.fileas a filesystem path:SARIF's
artifactLocation.uriis a URI, and the spec permits an absolutefile://form.guardlink.pypasses it through verbatim.Path('file:///repo/src/main.ts')is relative as far as pathlib is concerned — it has no leading/— so the absolute branch is never taken, no resolution happens, and the key becomes the literal stringfile:/repo/src/main.ts. That matches no keyelectron_surfaceever produces.Every routeless threat from such a producer is therefore filed review-only, and the run prints
0 correlated, N review-onlyand exits successfully — indistinguishable from a codebase where nothing genuinely correlates. Same silent-miss shape as the relative---codebasebug fixed onfeat/constant-channels(resolved once at the boundary viacxg_pentest.resolve_codebase), but on the other side of the join, and not reachable through that fix.guardlink itself emits relative URIs today, which is why this has not bitten; it is a correctness gap against any other SARIF producer.
Suggested fix: in
_rel, detect afile:scheme and convert withurllib.request.url2pathname(urlparse(uri).path)before the existing absolute/relative split. Reject or pass through unchanged any other scheme rather than string-stripping it — see_rel's own annotation on why a character strip manufactured false correlations.