test(frameworks): pin cve bare-major + reference-url invariants

lock the bare-major boundary matrix in versionAffected (7 vs 70/17/7000,
4.20 vs 4.2, 4.1 vs 4.10) and assert every knownCVEs entry's references
exactly match its own CVE ID's nvd detail url, so a future edit can't
silently widen the boundary or misattribute a reference.

also pins Finding.Line() staying frozen to "[severity] target module title"
for a framework result once cve enrichment (version/cves/references) is
populated, guarding against enrichment fields leaking into the line.

Author: TBX3D

internal/finding/cve_regression_test.go

@@ -0,0 +1,56 @@
+/*
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+:                                                                               :
+:   █▀ █ █▀▀   ·   Blazing-fast pentesting suite                                :
+:   ▄█ █ █▀    ·   BSD 3-Clause License                                         :
+:                                                                               :
+:   (c) 2022-2026 vmfunc, xyzeva,                                               :
+:                 lunchcat alumni & contributors                                :
+:                                                                               :
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+*/
+
+package finding
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/vmfunc/sif/internal/scan/frameworks"
+)
+
+// a cve-enriched framework result must still collapse to the frozen
+// "[severity] target module title" line - version, cves and references stay
+// out of Line() even once cve enrichment is populated, so downstream
+// notify/grep/awk consumers never see the line shape shift under them.
+func TestFlattenFramework_LineFrozenWithCVEEnrichment(t *testing.T) {
+	fw := &frameworks.FrameworkResult{
+		Name:        "Drupal",
+		Version:     "10",
+		Confidence:  0.9,
+		CVEs:        []string{"CVE-2023-44487 (high)"},
+		Suggestions: []string{"Update to Drupal 10.1.4 or later"},
+		RiskLevel:   "high",
+		References:  []string{"https://nvd.nist.gov/vuln/detail/CVE-2023-44487"},
+	}
+
+	findings := Flatten(target, "framework", fw)
+	if len(findings) != 1 {
+		t.Fatalf("got %d findings, want 1", len(findings))
+	}
+
+	f := findings[0]
+	want := fmt.Sprintf("[%s] %s %s %s", f.Severity, target, "framework", "Drupal detected")
+	if got := f.Line(); got != want {
+		t.Errorf("Line() = %q, want %q", got, want)
+	}
+	if f.Severity != SeverityHigh {
+		t.Errorf("severity = %v, want %v (from RiskLevel=high)", f.Severity, SeverityHigh)
+	}
+	for _, leak := range []string{"CVE-2023-44487", "nvd.nist.gov"} {
+		if strings.Contains(f.Line(), leak) {
+			t.Errorf("Line() leaked enrichment detail %q: %q", leak, f.Line())
+		}
+	}
+}

internal/scan/frameworks/cve_internal_test.go

@@ -69,10 +69,10 @@ func TestResolveVersionFeedsCVELookup(t *testing.T) {
 // is "10"/"9". the cve lookup must still surface the matching CVE instead of
 // missing it because the affected entries are dotted.
 func TestGetVulnerabilitiesBareMajor(t *testing.T) {
-	if cves, _ := getVulnerabilities("Drupal", "10"); len(cves) == 0 {
+	if cves, _, _ := getVulnerabilities("Drupal", "10"); len(cves) == 0 {
 		t.Error("expected Drupal 10 to surface CVE-2023-44487, got none")
 	}
-	if cves, _ := getVulnerabilities("Drupal", "9"); len(cves) == 0 {
+	if cves, _, _ := getVulnerabilities("Drupal", "9"); len(cves) == 0 {
 		t.Error("expected Drupal 9 to surface CVE-2023-44487, got none")
 	}
 }

internal/scan/frameworks/cve_regression_test.go

@@ -0,0 +1,65 @@
+/*
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+:                                                                               :
+:   █▀ █ █▀▀   ·   Blazing-fast pentesting suite                                :
+:   ▄█ █ █▀    ·   BSD 3-Clause License                                         :
+:                                                                               :
+:   (c) 2022-2026 vmfunc, xyzeva,                                               :
+:                 lunchcat alumni & contributors                                :
+:                                                                               :
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+*/
+
+package frameworks
+
+import "testing"
+
+// bare-major boundary matrix: a coarse detected major ("7") must cover its own
+// dotted sub-versions but never a version that merely shares the same leading
+// digits ("70.0", "17.0", "7000.0"). this is the off-by-one guard for the
+// bare-major fix in versionAffected - it pins the exact boundary, not just one
+// example of it.
+func TestVersionAffected_BareMajorBoundary(t *testing.T) {
+	tests := []struct {
+		version  string
+		affected string
+		want     bool
+	}{
+		{"7", "7.0", true},
+		{"7", "7.4", true},
+		{"7", "7.9", true},
+		{"7", "70.0", false},
+		{"7", "17.0", false},
+		{"7", "7000.0", false},
+		{"7", "6.9", false},
+		{"4.20", "4.2", false},
+		{"4.1", "4.10", false},
+		{"4.10", "4.1", false},
+	}
+
+	for _, tt := range tests {
+		if got := versionAffected(tt.version, tt.affected); got != tt.want {
+			t.Errorf("versionAffected(%q, %q) = %v, want %v", tt.version, tt.affected, got, tt.want)
+		}
+	}
+}
+
+// every CVE entry must carry at least one reference, and that reference must
+// be exactly the NVD detail link derived from the entry's own CVE ID - no
+// stale/typo'd/borrowed reference from a neighboring entry.
+func TestKnownCVEs_ReferencesMatchOwnCVEID(t *testing.T) {
+	for framework, entries := range knownCVEs {
+		for _, entry := range entries {
+			if len(entry.References) == 0 {
+				t.Errorf("%s %s: no references", framework, entry.CVE)
+				continue
+			}
+			want := "https://nvd.nist.gov/vuln/detail/" + entry.CVE
+			for _, ref := range entry.References {
+				if ref != want {
+					t.Errorf("%s %s: reference %q, want %q", framework, entry.CVE, ref, want)
+				}
+			}
+		}
+	}
+}