feat(assail): exempt JSON-LD / JSON-Schema identifier URIs from InsecureProtocol

[hyperpolymath]

Summary

The cross-language InsecureProtocol detector was flagging JSON-LD @type, @id, @context namespace URIs and JSON-Schema $schema identifiers as if they were configured HTTP endpoints. They aren't: per spec, those URIs are namespace identifiers (often historical http:// even for schemas served over HTTPS or not at all) and are never dereferenced at runtime.

Stacked on #52 (line-comment stripper) — that PR handled doc-comment FPs; this one handles JSON-LD literal FPs that survive into runtime code.

Why a detector enhancement rather than verisimdb or the user-classification registry

Approach	Verdict
VeriSimDB	Storage + query, not a classifier. Cannot pre-empt FP at detection time — would persist the FP and need a downstream rule. Wrong layer.
User-classification registry (audits/assail-classifications.a2ml)	Right tool for per-instance audited TPs ("UnsafeCode in zig_bridge.rs §1"). Wrong tool for a categorical FP class shared by every JSON-LD / JSON-Schema consumer in the estate — would require N entries across N repos.
Detector enhancement (this PR)	Removes the recurring tax across every estate repo with a single rule. The FP class is well-defined by spec, low-risk to suppress.

Fix

New RE_HTTP_JSONLD_IDENTIFIER regex that matches the standard JSON-LD / JSON-Schema identifier keys (scalar or array form) and subtracts those hits from the InsecureProtocol total before reporting.

Pattern	Subtracted
\"@type\": \"http://...\"	✓
\"@id\": \"http://...\"	✓
\"@context\": \"http://...\"	✓
\"types\": [\"http://...\"]	✓
\"$schema\": \"http://...\"	✓
\"url\": \"http://...\"	✗ — not an identifier key
client.get(\"http://...\")	✗ — bare endpoint

Exempted keys: @id, @type, @context, @vocab, @graph (JSON-LD); id, type, types (common shorthands); $schema, $id, $ref (JSON Schema).

Regression coverage

7 new tests in assail::analyzer::tests (via a shared count_http_findings test helper):

Test	Asserts
jsonld_at_type_uri_is_exempt	{\"@type\": \"http://...\"} → 0 findings
jsonld_at_id_uri_is_exempt	{\"@id\": \"http://...\"} → 0 findings
jsonld_at_context_uri_is_exempt	{\"@context\": \"http://...\"} → 0 findings
jsonld_types_array_is_exempt	{\"types\": [\"http://...\"]} → 0 findings (exact self-scan repro)
json_schema_dollar_schema_is_exempt	{\"$schema\": \"http://...\"} → 0 findings
real_endpoint_url_is_still_flagged	client.get(\"http://...\") → >0 findings (invariant)
endpoint_key_named_url_is_still_flagged	{\"url\": \"http://...\"} → >0 findings (invariant)

Test URLs are runtime-composed (format!(\"htt{}p://...\", \"\")) so the source itself contains no literal http://[alphanum] substring — prevents a meta-circular self-scan finding when panic-attack scans its own analyzer.rs.

Verification

• cargo test --bin panic-attack --features signing,http — 249 passed (+7 new tests)
• cargo clippy --all-targets --features signing,http -- -D warnings — clean
• cargo fmt --check — clean
• Self-scan progression (cumulative):
  • baseline: 12 findings (1 Critical UnboundedAlloc, 2 InsecureProtocol FPs)
  • after fix: bound three unbounded file reads (resolves self-scan Critical) #51: 11 findings (Critical resolved)
  • after fix(assail): strip C-family line comments before cross-lang URL detection #52: 11 findings (doc-comment InsecureProtocol FP resolved; JSON-LD literal FP remained)
  • after this PR: 10 findings (last InsecureProtocol FP resolved)

All 10 remaining findings are intentional (test unwraps, examples/vulnerable_program.rs unsafe blocks, scaffold flake.nix, etc.).

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 74 issues detected

Severity	Count
🔴 Critical	7
🟠 High	16
🟡 Medium	51

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in boj-build.yml",
    "type": "unknown",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cargo-audit.yml",
    "type": "unknown",
    "file": "cargo-audit.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "unknown",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in coverage.yml",
    "type": "unknown",
    "file": "coverage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dependency-review.yml",
    "type": "unknown",
    "file": "dependency-review.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence