[patchstackdave]

Produces the map artifact the platform vendors for the cross-repo canary — one vertical slice through the product claim for CVE-2017-5941 (node-serialize's unserialize executes an embedded function expression, so a request body reaching it is remote code execution).

Public CVE, so the app, the rule and the request controls can all live in the open; the review rationale and detector recipe stay private in hub.

Why this belongs here

The platform commits the map and grades it into a verdict and a rule, which makes the map an artifact of this package. The ladder maps established the pattern and its one weakness, in their own README:

It does not stop these fixtures drifting from the extractor; nothing here can, because no job in this repository runs the extractor.

So this adds the two things that help:

• An emitter, run like the ladder one:

  PS_CANARY_EMIT_DIR=/path/to/back/tests/Fixtures/Canary npx vitest run tests/map/canary-emit
  

• A provenance file naming the commit that produced the artifact. The ladder maps carry that as a hand-maintained README line, which is only as fresh as whoever last remembered.

The platform's integration job then regenerates from this emitter and compares bytes, which turns that documented gap into an actual check.

The assertions do not skip

They run on every suite run, not only when emitting. A change to the app or the extractor that would invalidate a vendored copy fails here, with a message about the map — rather than three repositories away, as a rule that quietly stopped being generated.

Pinned: the endpoint, the coordinate (post.state), the sink (eval/node-serialize/unserialize), and the flow's tier, role, family and generatability. Plus that recognizedSinkKinds is non-empty — an empty list means "no model of this API", and the recipe's gate is dataflow, so an empty list would silently turn the whole canary into a needs-review case.

The app is minimal on purpose

A wrapper, a validation step or a rename would move the flow off exact-local — the one auto-promotable tier — and the canary would then be proving that a review-grade flow generates a rule. That is a different and weaker claim than the one it advertises.

canary-case.ts holds the app as data because two things consume it and must not drift: these assertions and the emitter, generated from one definition.

Full suite: 1665 passed, 7 skipped.

🤖 Generated with Claude Code

[coderbuds]

Well-structured, thorough canary tests with detailed documentation and clear assertions.

🎯 Quality: 100% Elite · 📦 Size: Medium

📈 This month: Your 144th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review