@@ -2902,7 +2949,7 @@ function extrasCounts(x) {
async function extrasRefresh(x, extras, force) {
if (!x) return;
const id = x.getRunId();
- if (x.lastId !== id) { x.lastId = id; x.graphData = null; x.view = { k: 1, tx: 20, ty: 20, sel: null }; }
+ if (x.lastId !== id) { x.lastId = id; x.graphData = null; x.view = { k: 1, tx: 20, ty: 20, sel: null, filterFinding: null }; }
x.extras = extras || {};
try { await extrasGraph(x, force); } catch { /* no graph yet */ }
extrasCounts(x);
@@ -3055,16 +3102,42 @@ function gmName(n) {
return p.title || p.name || p.category || p.path || p.type || p.address || n.key;
}
+function renderGraphFindingList(x) {
+ const data = x.graphData?.graph;
+ const list = x.q('gflist');
+ if (!list || !data) return;
+ const findings = (data.nodes || []).filter(n => n.label === 'Finding');
+ findings.sort((a, b) => sevRank(a.props?.local_severity) - sevRank(b.props?.local_severity));
+ const sel = x.view.filterFinding || 'overview';
+ list.innerHTML = `
+
Overview (${findings.length})
+ ${findings.map(f => {
+ const sev = f.props?.local_severity || 'info';
+ return `
+ ${esc(sev.charAt(0).toUpperCase())}
+ ${esc(gmName(f))}
+ `;
+ }).join('')}`;
+ $$('[data-gf]', list).forEach(btn => btn.addEventListener('click', () => {
+ x.view.filterFinding = btn.dataset.gf === 'overview' ? null : btn.dataset.gf;
+ x.view.sel = null;
+ x.drawnSig = null;
+ renderGraphMemory(x);
+ }));
+}
+
function renderGraphMemory(x) {
const data = x.graphData?.graph;
const stage = x.q('stage');
const has = !!(data && (data.nodes || []).length);
show(x.q('graph-empty'), !has);
show(x.q('wrap'), has);
+ renderGraphFindingList(x);
x.q('legend').innerHTML = [['asset', 'asset / host'], ['surface', 'service / endpoint'], ['weak', 'vulnerability / finding'], ['step', 'attack step'], ['cred', 'credential / identity'], ['impact', 'impact']]
.map(([k, l]) => `
${esc(l)} `).join('') +
'
confirmed needs validation hypothesis ';
if (!has) { stage.innerHTML = ''; return; }
+ const filterFid = x.view.filterFinding || null;
const full = x.q('full').checked;
const id = (n) => `${n.label}|${n.key}`;
@@ -3104,6 +3177,60 @@ function renderGraphMemory(x) {
}
}
+ // Per-finding filter: show only the selected finding's attack path
+ const descBox = x.q('fdesc');
+ if (filterFid) {
+ const fNode = data.nodes.find(n => n.label === 'Finding' && n.key === filterFid);
+ const fid = fNode ? id(fNode) : `Finding|${filterFid}`;
+ // Only keep edges directly involving this finding, then walk outward
+ // from connected non-Finding nodes (hosts, impacts, steps).
+ // Exclude edges connecting OTHER findings to shared hosts.
+ const findingEdges = edges.filter(e => eid(e.from) === fid || eid(e.to) === fid);
+ const reachable = new Set([fid]);
+ for (const e of findingEdges) { reachable.add(eid(e.from)); reachable.add(eid(e.to)); }
+ // Walk traversal edges from those seeds, but never bridge to other findings
+ let changed = true;
+ while (changed) {
+ changed = false;
+ for (const e of edges) {
+ const from = eid(e.from), to = eid(e.to);
+ if (from === fid || to === fid) continue; // already handled
+ const fromIn = reachable.has(from), toIn = reachable.has(to);
+ if (!fromIn && !toIn) continue;
+ // Don't bridge to other finding nodes
+ if (fromIn && !toIn && e.to.label === 'Finding') continue;
+ if (toIn && !fromIn && e.from.label === 'Finding') continue;
+ if (fromIn && !toIn) { reachable.add(to); changed = true; }
+ if (toIn && !fromIn) { reachable.add(from); changed = true; }
+ }
+ }
+ nodes = nodes.filter(n => reachable.has(id(n)));
+ keep = new Set(nodes.map(id));
+ edges = edges.filter(e => keep.has(eid(e.from)) && keep.has(eid(e.to)));
+ if (fNode && descBox) {
+ const f = gmFinding(x, fNode.props?.finding_id);
+ const props = fNode.props || {};
+ descBox.innerHTML = `
+
${props.description ? `
${esc(props.description)}
` : ''}
+ ${props.category ? `
Category: ${esc(props.category)}
` : ''}
+ ${props.cwe ? `
CWE: ${esc(Array.isArray(props.cwe) ? props.cwe.join(', ') : props.cwe)}
` : ''}
+ ${props.stage ? `
Stage: ${esc(props.stage)}
` : ''}
+
+
+ ${props.status ? `Status: ${esc(props.status)} ` : ''}
+ ${f ? 'Open finding details ' : ''}
+
`;
+ show(descBox, true);
+ const openBtn = descBox.querySelector('[data-openfinding]');
+ if (openBtn && f) openBtn.addEventListener('click', () => openFindingModal(f.f, f.pocs, f.runId));
+ }
+ } else if (descBox) {
+ show(descBox, false);
+ }
+
// Columns by entity kind; a long column wraps into sub-columns.
const W = 220, H = 54, GX = 90, GY = 12, PER = 12;
const cols = new Map();
@@ -3451,9 +3578,16 @@ async function loadIssues() {
if (!data.length) { body.innerHTML = '
No findings across any engagement yet.
'; return; }
const rows = data.map(f => {
const sc = sevClass(f.severity);
- return `
${esc(f.severity)} ${esc(f.title)} ${esc(f.target || '')} ${esc(f.run || '')} ${esc(f.status || 'open')} `;
+ return `
${esc(f.severity)} ${esc(f.title)} ${esc(f.target || '')} ${esc(f.run || '')} ${esc(f.status || 'open')} `;
}).join('');
body.innerHTML = `
Severity Title Target Run Status ${rows}
`;
+ $$('.issue-row', body).forEach(row => {
+ row.addEventListener('click', () => {
+ const runId = row.dataset.run;
+ if (!runId) return;
+ openContributorFinding(runId, row.dataset.title, row.dataset.cwe);
+ });
+ });
} catch (e) { body.innerHTML = `
Failed to load: ${esc(e.message)}
`; }
}
@@ -3478,10 +3612,11 @@ async function loadDomains() {
try {
const domains = await api('/api/config/domains');
if (!domains.length) { body.innerHTML = '
No domains configured yet. Click + Add Domain to add one.
'; return; }
+ const typeLabel = { web: 'Web', api: 'API', llm: 'LLM', mobile: 'Mobile', other: 'Other' };
body.innerHTML = '
' + domains.map(d => `
${esc(d.domain)}
${esc(d.description || 'Target domain')}
-
${d.subdomains ? d.subdomains.length + ' subdomains' : 'No subdomains'} · ${esc(d.scope || 'in-scope')}
+
${esc(typeLabel[d.type] || d.type || 'Web')} · ${d.subdomains ? d.subdomains.length + ' subdomains' : 'No subdomains'} · ${esc(d.scope || 'in-scope')}
Remove
`).join('') + '
';
} catch { body.innerHTML = '
No domains configured yet. Click + Add Domain to add one.
'; }
@@ -3560,11 +3695,12 @@ async function loadSettings() {
Save