fix: resolve CI failures from Copilot autofix side-effects

- Revert broken path validation in scan_policy.py from_yaml() that
  caused infinite recursion (default() -> from_yaml(absolute_path) ->
  reject absolute -> default() -> ...)
- Simplify _resolve_policy() in routes.py to only accept preset names,
  eliminating CodeQL py/path-injection alerts entirely
- Add static_analyzer to wizard _KNOWN_ANALYZERS set
- Fix severity ordering in reporters (CRITICAL before HIGH)
- Use dynamic version in SARIF reporter
- Add permissions block to python-tests workflow (CodeQL alert #8)
- Clean up deprecated typing imports (ruff auto-fix)

Author: vineethsai7

.github/workflows/python-tests.yml

@@ -6,6 +6,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

a2ascanner/api/routes.py

@@ -23,25 +23,25 @@
 import json
 import tempfile
 from pathlib import Path
+from typing import Any
+
 from fastapi import APIRouter, HTTPException
 from pydantic import BaseModel, Field
-from typing import Optional, List, Dict, Any
-import os
 
-from a2ascanner.core.scanner import Scanner
+from a2ascanner.config.config import Config
 from a2ascanner.core.analyzer_factory import build_core_analyzers
 from a2ascanner.core.scan_policy import ScanPolicy
-from a2ascanner.config.config import Config
-from a2ascanner.utils.http_client import fetch_agent_card
+from a2ascanner.core.scanner import Scanner
 from a2ascanner.exceptions import (
+    A2AScannerError,
+    AuthenticationError,
     NetworkError,
+    SSRFError,
     TimeoutError,
     ValidationError,
-    SSRFError,
-    AuthenticationError,
-    A2AScannerError,
 )
-from a2ascanner.utils.logging_config import set_correlation_id, get_logger
+from a2ascanner.utils.http_client import fetch_agent_card
+from a2ascanner.utils.logging_config import get_logger, set_correlation_id
 
 logger = get_logger(__name__)
 
@@ -51,121 +51,42 @@
 # API-only fields stripped when the request body is a raw agent card JSON object
 _SCAN_REQUEST_META_FIELDS = frozenset({"analyzers", "policy"})
 
-# Directory containing allowed policy YAML files for file-based policies.
-# Paths provided via the API are resolved relative to this directory and
-# must not escape it.
-_POLICY_DIR = Path("policies").resolve()
 
+def _resolve_policy(policy_name: str | None) -> ScanPolicy:
+    """Resolve a policy preset name to a *ScanPolicy*.
 
-def _resolve_policy(policy_name: Optional[str]) -> ScanPolicy:
-    """Resolve a policy name to a ScanPolicy, with safe handling of file-based policies.
-
-    The policy name may refer to a built-in preset or to a YAML file under
-    the configured _POLICY_DIR directory. When resolving file-based policies,
-    this function enforces that the resulting path is strictly contained
-    within _POLICY_DIR to prevent directory traversal or access to arbitrary
-    files on the filesystem.
+    Only built-in presets (``strict``, ``balanced``, ``permissive``) are
+    accepted.  Arbitrary file paths are **not** supported via the API to
+    prevent path-injection attacks.  Use the CLI for file-based policies.
     """
     if not policy_name:
         return ScanPolicy.default()
 
-    # Normalize simple whitespace-only or empty strings to default behavior.
-    if isinstance(policy_name, str):
-        policy_name = policy_name.strip()
-        if not policy_name:
-            return ScanPolicy.default()
-    else:
-        # Reject non-string values for policy names.
-        logger.warning("Invalid non-string policy name %r", policy_name)
-        return ScanPolicy.default()
-
-    # Basic validation: reject absolute paths or any path separators to
-    # ensure policy_name is treated as a simple file name/key rather than a path.
-    if os.path.isabs(policy_name) or os.sep in policy_name or (
-        os.altsep is not None and os.altsep in policy_name
-    ):
-        logger.warning("Rejected invalid policy name %r", policy_name)
+    name = policy_name.strip() if isinstance(policy_name, str) else ""
+    if not name:
         return ScanPolicy.default()
 
-    # First, try resolving the policy as a named preset.
     try:
-        return ScanPolicy.from_preset(policy_name)
+        return ScanPolicy.from_preset(name)
     except ValueError:
-        # Fall back to treating the policy name as a file within the
-        # configured policy directory, with path traversal protection.
-        pass
-
-    # For file-based policies, enforce that the user cannot supply an
-    # absolute path and only YAML files under _POLICY_DIR are allowed.
-    # This defends against directory traversal and access to arbitrary files.
-    if os.path.isabs(policy_name):
-        logger.warning("Rejected absolute policy path %r", policy_name)
+        logger.warning("Unknown policy preset %r; falling back to default", name)
         return ScanPolicy.default()
 
-    # Avoid obviously dangerous or nonsensical names (null bytes, only separators).
-    if "\x00" in policy_name or all(ch in (os.sep, os.altsep or "") for ch in policy_name):
-        logger.warning("Rejected malformed policy path %r", policy_name)
-        return ScanPolicy.default()
-
-    # Optionally, restrict to YAML/YML extensions to narrow what can be loaded.
-    if not policy_name.lower().endswith((".yaml", ".yml")):
-        logger.warning("Rejected non-YAML policy path %r", policy_name)
-        return ScanPolicy.default()
-
-    # Treat the policy name as a relative path under _POLICY_DIR and
-    # ensure the resulting path cannot escape that directory.
-    try:
-        candidate = (_POLICY_DIR / policy_name).resolve()
-        # Enforce that the resolved candidate remains within the allowed policy directory.
-        if candidate != _POLICY_DIR and _POLICY_DIR not in candidate.parents:
-            logger.warning(
-                "Rejected policy path %r: resolved path %s is outside of %s",
-                policy_name,
-                candidate,
-                _POLICY_DIR,
-            )
-            return ScanPolicy.default()
-    except Exception:
-        logger.warning("Failed to resolve policy path %r", policy_name, exc_info=True)
-        return ScanPolicy.default()
-
-    try:
-        # Ensure candidate is within the policy directory. Using relative_to
-        # provides a clear containment check and prevents directory traversal.
-        candidate.relative_to(_POLICY_DIR)
-    except ValueError:
-        logger.warning(
-            "Rejected policy path outside of policy directory: %s", candidate
-        )
-        return ScanPolicy.default()
-
-    try:
-        if candidate.is_file():
-            return ScanPolicy.from_yaml(candidate)
-    except Exception:
-        # Any issues reading or parsing the policy file fall through
-        # to the default policy.
-        logger.warning(
-            "Failed to load policy file %s safely", candidate, exc_info=True
-        )
-
-    return ScanPolicy.default()
-
 
 # Request models
 class AgentCardScanRequest(BaseModel):
     """Request model for agent card scan."""
 
-    agent_card_url: Optional[str] = Field(None, description="URL to agent card")
-    agent_card_json: Optional[str] = Field(None, description="Agent card JSON string")
-    agent_card_data: Optional[Dict[str, Any]] = Field(
+    agent_card_url: str | None = Field(None, description="URL to agent card")
+    agent_card_json: str | None = Field(None, description="Agent card JSON string")
+    agent_card_data: dict[str, Any] | None = Field(
         None, description="Agent card as dict"
     )
-    analyzers: Optional[List[str]] = Field(
+    analyzers: list[str] | None = Field(
         None,
         description="Analyzers to use; omit for all applicable analyzers (except endpoint)",
     )
-    policy: Optional[str] = Field(
+    policy: str | None = Field(
         None,
         description="Policy preset: strict, balanced, permissive; omit for default",
     )
@@ -179,11 +100,11 @@ class SourceCodeScanRequest(BaseModel):
     """Request model for source code scan."""
 
     directory: str = Field(..., description="Path to source code directory")
-    analyzers: Optional[List[str]] = Field(
+    analyzers: list[str] | None = Field(
         None,
         description="Analyzers to use; omit for default selection per file type",
     )
-    policy: Optional[str] = Field(
+    policy: str | None = Field(
         None,
         description="Policy preset: strict, balanced, permissive; omit for default",
     )
@@ -193,7 +114,7 @@ class EndpointScanRequest(BaseModel):
     """Request model for endpoint scan."""
 
     endpoint_url: str = Field(..., description="Endpoint URL to scan")
-    policy: Optional[str] = Field(
+    policy: str | None = Field(
         None,
         description="Policy preset: strict, balanced, permissive; omit for default",
     )
@@ -203,13 +124,13 @@ class FullScanRequest(BaseModel):
     """Request model for full scan."""
 
     directory: str = Field(..., description="Path to source code directory")
-    agent_card_url: Optional[str] = Field(None, description="URL to agent card")
-    endpoint_url: Optional[str] = Field(None, description="Endpoint URL to test")
-    analyzers: Optional[List[str]] = Field(
+    agent_card_url: str | None = Field(None, description="URL to agent card")
+    endpoint_url: str | None = Field(None, description="Endpoint URL to test")
+    analyzers: list[str] | None = Field(
         None,
         description="Analyzers to use; omit for default selection per file type",
     )
-    policy: Optional[str] = Field(
+    policy: str | None = Field(
         None,
         description="Policy preset: strict, balanced, permissive; omit for default",
     )
@@ -219,11 +140,11 @@ class FileContentScanRequest(BaseModel):
     """Request model for scanning raw text content as a file."""
 
     content: str = Field(..., description="Raw text content to scan")
-    analyzers: Optional[List[str]] = Field(
+    analyzers: list[str] | None = Field(
         None,
         description="Analyzers to use; omit for default selection per content type",
     )
-    policy: Optional[str] = Field(
+    policy: str | None = Field(
         None,
         description="Policy preset: strict, balanced, permissive; omit for default",
     )
@@ -235,7 +156,7 @@ class ScanResponse(BaseModel):
 
     success: bool
     message: str
-    result: Optional[Dict[str, Any]] = None
+    result: dict[str, Any] | None = None
 
 
 # Routes

a2ascanner/cli/wizard.py

@@ -33,6 +33,7 @@
 # Registry keys returned by :meth:`Scanner.get_available_analyzers` / ``--analyzers``.
 _KNOWN_ANALYZERS = frozenset(
     (
+        "yara",
         "static_analyzer",
         "spec",
         "endpoint",
@@ -82,7 +83,7 @@ def run_wizard() -> int:
 
     console.print(
         "\n[dim]Analyzers: leave empty to run all enabled by policy; "
-        "or comma-separated registry keys: static_analyzer, spec, endpoint, llm, heuristic.[/dim]"
+        "or comma-separated registry keys: yara, spec, endpoint, llm, heuristic.[/dim]"
     )
     analyzers_raw = Prompt.ask("Restrict analyzers (optional)", default="").strip()
     if analyzers_raw:

a2ascanner/core/reporters/html_reporter.py

@@ -26,7 +26,7 @@
 from ..models import ScanResult
 
 
-_SEVERITY_ORDER = ("HIGH", "CRITICAL", "MEDIUM", "LOW", "UNKNOWN", "SAFE")
+_SEVERITY_ORDER = ("CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN", "SAFE")
 
 _CSS = """
 :root {

a2ascanner/core/reporters/markdown_reporter.py

@@ -25,7 +25,7 @@
 from ..models import ScanResult
 
 
-_SEVERITY_ORDER = ("HIGH", "CRITICAL", "MEDIUM", "LOW", "UNKNOWN", "SAFE")
+_SEVERITY_ORDER = ("CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN", "SAFE")
 
 
 class MarkdownReporter:

a2ascanner/core/reporters/sarif_reporter.py

@@ -24,6 +24,8 @@
 from typing import Any, Dict, List
 from urllib.parse import quote
 
+import a2ascanner
+
 from ..models import ScanResult
 
 
@@ -122,7 +124,7 @@ def generate_report(self, data: ScanResult) -> str:
                         "driver": {
                             "name": "a2a-scanner",
                             "informationUri": "https://github.com/cisco-ai-defense/a2a-scanner",
-                            "version": "1.0.0",
+                            "version": a2ascanner.__version__,
                             "rules": rule_list,
                         }
                     },

a2ascanner/core/reporters/table_reporter.py

@@ -125,13 +125,13 @@ def _render_security_table(
         table.add_column("Severity", style="bold", width=8)
         table.add_column("Summary", width=26)
 
-        severity_order = {"HIGH": 0, "MEDIUM": 1, "LOW": 2}
+        severity_order = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
         sorted_findings = sorted(
-            findings, key=lambda t: severity_order.get(t[1].severity, 3)
+            findings, key=lambda t: severity_order.get(t[1].severity, 4)
         )
 
         for idx, finding in sorted_findings:
-            if finding.severity == "HIGH":
+            if finding.severity in ("CRITICAL", "HIGH"):
                 severity_style = "bold red"
             elif finding.severity == "MEDIUM":
                 severity_style = "bold yellow"
@@ -244,13 +244,13 @@ def _render_spec_table(
         table.add_column("Severity", style="bold", width=8)
         table.add_column("Description", width=45)
 
-        severity_order = {"HIGH": 0, "MEDIUM": 1, "LOW": 2}
+        severity_order = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
         sorted_findings = sorted(
-            findings, key=lambda t: severity_order.get(t[1].severity, 3)
+            findings, key=lambda t: severity_order.get(t[1].severity, 4)
         )
 
         for idx, finding in sorted_findings:
-            if finding.severity == "HIGH":
+            if finding.severity in ("CRITICAL", "HIGH"):
                 severity_style = "bold red"
             elif finding.severity == "MEDIUM":
                 severity_style = "bold yellow"

a2ascanner/core/scan_policy.py

@@ -144,22 +144,11 @@ def preset_names(cls) -> list[str]:
     def from_yaml(cls, path: str | Path) -> ScanPolicy:
         """Load policy from a YAML file, merged on top of defaults.
 
-        This method is sometimes called with paths that may be influenced by
-        user input (for example via API policy selection). To avoid unsafe
-        filesystem access when it is used directly, we defensively reject
-        obviously dangerous paths here. Callers that need more advanced
-        policies (such as directory-based allowlists) should perform those
-        checks before calling this method.
+        Callers that accept user-supplied paths **must** validate and
+        constrain them before calling this method (e.g. restrict to a
+        known directory or an allowlist of preset names).
         """
         path = Path(path)
-
-        # Basic hardening: reject absolute paths, parent-directory traversal,
-        # or embedded null bytes, which are not expected for policy files and
-        # could be used to target unexpected locations.
-        if path.is_absolute() or ".." in path.parts or "\x00" in str(path):
-            logger.warning("Rejected unsafe policy path %r", str(path))
-            return cls.default()
-
         with open(path, encoding="utf-8") as f:
             data = yaml.safe_load(f) or {}
         return cls._from_dict(data)