Frame 1.1.3

Frame 1.1.3

Proof-carrying findings now reach across languages and close the loop on fixes, plus new report formats for CI. Everything here is additive and opt-in; no existing behaviour changes.

pip install -U "frame-security[scan]"

Proof-carrying findings, across languages

A finding Frame proved reachable becomes a runnable test that drives your own code to the sink, confirmed only when attacker-marked data arrives there through your project (calling the sink directly does not count). See docs/ai.md.

• Code taint flows, not just dependencies: frame exploit --deps reproduces SQL injection, command injection, XSS, path traversal, SSRF and the other source-to-sink injections from a scan's findings JSON.
• Four languages: Python, JavaScript/TypeScript, Java and C#. Java spies the injected sink interface with a core-JDK java.lang.reflect.Proxy (only a JDK needed, no Maven or Mockito); C# uses xUnit + Moq (the .NET SDK).
• The fix-loop: frame exploit --deps --check-fixed DIR re-runs a confirmed reproduction against a fixed copy of the project and verifies it no longer reaches the sink, so a proof of the vulnerability becomes a proof of the fix. It flips for fixes that remove the flow (validation, a safe-API swap, a dropped call); a sanitize-in-place is confirmed by a re-scan or frame verify.
• Every cross-language reproduction runs in CI on real toolchains (JDK 17, .NET 8, Node 20), with worked exemplars.

Reports and CI

• New formats: frame scan -f markdown (a pull-request comment or $GITHUB_STEP_SUMMARY report), -f gitlab (GitLab SAST report) and -f sonar (SonarQube generic issue import). SARIF results now carry code flows and proofs.
• frame diff OLD.json NEW.json shows which findings a change introduced, fixed or left unchanged, paired by fingerprint.
• --fail-on-evidence LEVEL breaks a build only on findings at or above an evidence level, for example --fail-on-evidence solver-verified to fail only on what Frame proved.

Fixes

• The findings JSON now includes each finding's sink_call, so frame exploit --deps can build a reproduction of a code taint finding from a real scan. Before, taint reproductions only ran from the exemplars.

Project

• New CONTRIBUTING.md, SECURITY.md (including exactly what Frame runs and sends: by default no project code executed, nothing fetched during a scan, no telemetry) and CHANGELOG.md; issue forms for false positives and missed vulnerabilities; Discussions are open, and vulnerabilities in Frame can be reported privately.

Released alongside

• GitHub Action: lambdasec/frame-action@v1 runs 1.1.3 now that the v1 tag has moved; nothing to change in your workflow.
• pre-commit: rev: v1.1.3.

CI is green on this commit (tests on Python 3.10 and 3.13, lint, the cross-language reproduction job, self-scan, sca-real, and the full benchmark sweep).