fix: preserve interrupted Strix findings without Sentinel code loss

.jules/sentinel.md

@@ -107,3 +107,18 @@
 **Vulnerability:** Server-Side Request Forgery (SSRF) bypass due to `_is_safe_url` only checking `is_loopback` and `is_private`. This fails to correctly evaluate mapped IPv4 addresses disguised as IPv6 (e.g. `[::ffff:127.0.0.1]`) and misses restricted IP designations like `is_reserved` or non `is_global` IPs, allowing SSRF to `0.0.0.0` or `255.255.255.255`.
 **Learning:** Python's `ipaddress` objects for mapped IPv6 don't inherit properties of their IPv4 wrapped content directly. Using `is_loopback` without checking `.ipv4_mapped` leaves blind spots.
 **Prevention:** Always extract `getattr(ip, 'ipv4_mapped', None)` before evaluation, and combine checks spanning `is_reserved`, `not is_global`, `is_multicast`, `is_unspecified`, `is_private`, and `is_loopback` to fully protect endpoints.
+
+## 2026-07-28 - SSRF bypass via urllib.request.urlopen redirect following
+**Vulnerability:** Server-Side Request Forgery (SSRF) bypass due to `urllib.request.urlopen` automatically following HTTP redirects, allowing safe initial URLs to redirect to unsafe internal infrastructure.
+**Learning:** Checking the initial user-provided URL against `_is_safe_url` is insufficient if the HTTP client automatically follows redirects. An attacker can host a server on a public IP that returns a 3xx redirect to `http://127.0.0.1` or AWS metadata (`http://169.254.169.254`), effectively bypassing the validation check.
+**Prevention:** Always use `urllib.request.build_opener` with a custom `HTTPRedirectHandler` that explicitly validates the redirect target URL against your security constraints (e.g. `_is_safe_url`) before allowing the redirect to proceed. Do not rely on `urlopen` alone.
+
+## 2026-07-28 - Semgrep syntax failure on `importlib.resources` backport wrapper
+**Vulnerability:** Not a direct security vulnerability, but a toolchain issue where using `from importlib import resources` causes a Semgrep scanning error (`python.lang.compatibility.python37.python37-compatibility-importlib2`) indicating a backwards compatibility issue with Python < 3.7.
+**Learning:** CI static analysis engines like Semgrep can fail pipelines on seemingly safe, modern Python code if the import syntax matches strict backwards compatibility rules. `from importlib import resources` fails the check, whereas `import importlib.resources as resources` works, even when explicitly using a `# nosemgrep` directive, likely due to how Semgrep parses the AST for imports.
+**Prevention:** Always use the `import importlib.resources as resources` syntax rather than the `from ... import` syntax to prevent compatibility rule false positives and CI breakages on older Semgrep rule sets.
+
+## 2026-07-28 - Strix AI Agent Test Failures on Argument Parser Formatting
+**Vulnerability:** A CI failure caused by an external tool (`strix`) crashing with `ValueError: Invalid Context 3766:` when trying to apply patches to `scanner/cli/appguardrail.py`.
+**Learning:** `strix` attempts to use `apply_patch` based on line matching. If black reformats the Python code significantly, it alters the context that the LLM/diff-applier expects to see, causing patch failures during simulated attacks or reviews. Specifically, formatting `dashboard_parser.add_argument` over multiple lines breaks the strict context expectations.
+**Prevention:** Avoid running code formatters (`black`) that aggressively reformat existing code segments outside of the direct fix area, especially in files that external tools rely on for string matching or diff context. Only format the newly written code to maintain compatibility with test suites relying on fixed text locations.

appguardrail_core/autofix.py

@@ -16,9 +16,15 @@
 _A_TAG = re.compile(r"<a\b[^>]*>", re.IGNORECASE)
 _HAS_EXTERNAL_BLANK = re.compile(r"target\s*=\s*[\"']_blank[\"']", re.IGNORECASE)
 _HAS_EXTERNAL_HREF = re.compile(r"href\s*=\s*[\"']https?://", re.IGNORECASE)
-_HAS_REL_SAFE = re.compile(
-    r"rel\s*=\s*[\"'][^\"']*(?:noopener|noreferrer)", re.IGNORECASE
-)
+_REL_ATTR = re.compile(r"\brel\s*=\s*([\"'])([^\"']*)\1", re.IGNORECASE)
+
+
+def _safe_rel_tokens(tag: str) -> set[str]:
+    """Return exact space-separated rel tokens from the first rel attribute."""
+    match = _REL_ATTR.search(tag)
+    if not match:
+        return set()
+    return {token.casefold() for token in match.group(2).split()}
 
 
 def _fix_target_blank_noopener(text: str) -> "tuple[str, int]":
@@ -34,9 +40,14 @@ def repl(match: "re.Match[str]") -> str:
         if (
             _HAS_EXTERNAL_BLANK.search(tag)
             and _HAS_EXTERNAL_HREF.search(tag)
-            and not _HAS_REL_SAFE.search(tag)
+            and not (_safe_rel_tokens(tag) & {"noopener", "noreferrer"})
         ):
             count += 1
+            rel_match = _REL_ATTR.search(tag)
+            if rel_match:
+                existing = rel_match.group(2).strip()
+                replacement = f'rel="{existing} noopener noreferrer"'
+                return tag[: rel_match.start()] + replacement + tag[rel_match.end() :]
             return re.sub(
                 r"<a\b",
                 '<a rel="noopener noreferrer"',
@@ -76,15 +87,16 @@ def apply_safe_fixes(text: str, ext: str) -> "tuple[str, int]":
 
 
 if __name__ == "__main__":  # pragma: no cover - self-check
+    # Executable module self-checks; these assertions do not validate user input.
     src = '<a href="https://x.com" target="_blank">x</a>\n<a href="/local" target="_blank">l</a>\n<a href="https://y.com" target="_blank" rel="noopener">y</a>'
     out, n = apply_safe_fixes(src, ".html")
-    assert n == 1, n  # only the external, rel-less one is fixed
-    assert 'rel="noopener noreferrer"' in out
-    assert out.count("rel=") == 2  # original rel preserved, one added
+    assert n == 1, n  # noqa: S101  # nosec B101
+    assert 'rel="noopener noreferrer"' in out  # noqa: S101  # nosec B101
+    assert out.count("rel=") == 2  # noqa: S101  # nosec B101
     # idempotent: running again fixes nothing
     _, n2 = apply_safe_fixes(out, ".html")
-    assert n2 == 0
+    assert n2 == 0  # noqa: S101  # nosec B101
     # non-matching extension is a no-op
     _, n3 = apply_safe_fixes(src, ".py")
-    assert n3 == 0
+    assert n3 == 0  # noqa: S101  # nosec B101
     print("autofix self-check OK")

appguardrail_core/config.py

@@ -21,6 +21,53 @@
 from .findings import SEVERITIES, severities_at_or_above
 
 CONFIG_NAME = ".appguardrail.json"
+MAX_CONFIG_BYTES = 1024 * 1024
+MAX_CONFIG_DEPTH = 128
+
+
+def _load_bounded_json(path: Path) -> Any:
+    """Decode bounded JSON after rejecting excessive object/array nesting."""
+    try:
+        raw = path.read_bytes()
+    except OSError as exc:
+        raise RuntimeError(f"Invalid {CONFIG_NAME} at {path}: {exc}") from exc
+    if len(raw) > MAX_CONFIG_BYTES:
+        raise RuntimeError(
+            f"Invalid {CONFIG_NAME} at {path}: exceeds {MAX_CONFIG_BYTES} bytes"
+        )
+    try:
+        text = raw.decode("utf-8")
+    except UnicodeDecodeError as exc:
+        raise RuntimeError(f"Invalid {CONFIG_NAME} at {path}: not UTF-8") from exc
+
+    depth = 0
+    in_string = False
+    escaped = False
+    for char in text:
+        if in_string:
+            if escaped:
+                escaped = False
+            elif char == "\\":
+                escaped = True
+            elif char == '"':
+                in_string = False
+            continue
+        if char == '"':
+            in_string = True
+        elif char in "[{":
+            depth += 1
+            if depth > MAX_CONFIG_DEPTH:
+                raise RuntimeError(
+                    f"Invalid {CONFIG_NAME} at {path}: exceeds maximum JSON nesting "
+                    f"depth {MAX_CONFIG_DEPTH}"
+                )
+        elif char in "]}":
+            depth = max(0, depth - 1)
+
+    try:
+        return json.loads(text)
+    except (ValueError, RecursionError) as exc:
+        raise RuntimeError(f"Invalid {CONFIG_NAME} at {path}: {exc}") from exc
 
 
 def find_config(search_dirs: "list[Path]") -> "Path | None":
@@ -46,10 +93,7 @@ def load_config(search_dirs: "list[Path]") -> dict[str, Any]:
     path = find_config(search_dirs)
     if path is None:
         return {}
-    try:
-        data = json.loads(path.read_text(encoding="utf-8"))
-    except (OSError, ValueError) as exc:
-        raise RuntimeError(f"Invalid {CONFIG_NAME} at {path}: {exc}") from exc
+    data = _load_bounded_json(path)
     if not isinstance(data, dict):
         raise RuntimeError(f"{CONFIG_NAME} at {path} must be a JSON object.")
 
@@ -76,13 +120,20 @@ def load_config(search_dirs: "list[Path]") -> dict[str, Any]:
 if __name__ == "__main__":  # pragma: no cover - self-check
     import tempfile
 
+    # Executable module self-checks; these assertions do not validate user input.
     with tempfile.TemporaryDirectory() as d:
         (Path(d) / CONFIG_NAME).write_text(
             '{"fail_on": "WARNING", "exclude_rules": ["noisy-rule"]}'
         )
         cfg = load_config([Path(d)])
-        assert cfg["fail_on"] == "WARNING"
-        assert cfg["blocking_severities"] == {"CRITICAL", "HIGH", "WARNING"}
-        assert cfg["exclude_rules"] == {"noisy-rule"}
-        assert load_config([Path(d) / "nope"]) == {}
+        assert cfg["fail_on"] == "WARNING"  # noqa: S101  # nosec B101
+        assert cfg["blocking_severities"] == {  # noqa: S101  # nosec B101
+            "CRITICAL",
+            "HIGH",
+            "WARNING",
+        }
+        assert cfg["exclude_rules"] == {  # noqa: S101  # nosec B101
+            "noisy-rule"
+        }
+        assert load_config([Path(d) / "nope"]) == {}  # noqa: S101  # nosec B101
     print("config self-check OK")