fix(scoring): clamp fraction scorers to [0, 1]

scoreFingerprint and MatchSignatures divide matched weight by total
weight with no bound on the result. validation rejects negative
weights on real configs, but the math itself has no invariant, so any
caller that skips validation gets a score outside [0, 1] used directly
as reported confidence. clamp both to guard the pathological path;
normal validated inputs already fall inside [0, 1] and are unaffected.

Author: TBX3D

internal/modules/fingerprint.go

@@ -165,7 +165,7 @@ func scoreFingerprint(cfg *FingerprintConfig, body string, headers http.Header)
 	if total == 0 {
 		return 0, ""
 	}
-	score := matched / total
+	score := clampUnit(matched / total)
 
 	version := ""
 	if cfg.Version != nil && score > 0 {
@@ -178,6 +178,25 @@ func scoreFingerprint(cfg *FingerprintConfig, body string, headers http.Header)
 	return score, version
 }
 
+// clampUnit bounds a fraction to [0, 1]. Weights are validated non-negative
+// and finite at load time so this is a no-op on any real config; it only
+// guards a caller that skips validation and feeds scoreFingerprint a
+// negative or NaN weight. NaN needs its own check: every ordered comparison
+// against NaN is false, so the < 0 and > 1 checks below would silently let
+// it through otherwise.
+func clampUnit(f float32) float32 {
+	if math.IsNaN(float64(f)) {
+		return 0
+	}
+	if f < 0 {
+		return 0
+	}
+	if f > 1 {
+		return 1
+	}
+	return f
+}
+
 // headerContains reports whether pattern appears in any header name or value,
 // case-insensitively, matching the framework detector's header semantics.
 func headerContains(headers http.Header, pattern string) bool {

internal/modules/fingerprint_clamp_test.go

@@ -0,0 +1,70 @@
+/*
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+:                                                                               :
+:   █▀ █ █▀▀   ·   Blazing-fast pentesting suite                                :
+:   ▄█ █ █▀    ·   BSD 3-Clause License                                         :
+:                                                                               :
+:   (c) 2022-2026 vmfunc, xyzeva,                                               :
+:                 lunchcat alumni & contributors                                :
+:                                                                               :
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+*/
+
+package modules
+
+import (
+	"math"
+	"net/http"
+	"testing"
+)
+
+// scoreFingerprint trusts validateFingerprint to keep weights non-negative;
+// fed a negative weight directly (as any caller bypassing load validation
+// would), the matched fraction must still be clamped to [0, 1] rather than
+// escaping it.
+func TestScoreFingerprintClampsOutOfRangeWeights(t *testing.T) {
+	// weights 1 and -0.9 -> total 0.1; only the +1 sig matches: raw 1/0.1 = 10.
+	cfgHigh := &FingerprintConfig{Signatures: []FPSignature{
+		{Pattern: "yes", Weight: 1},
+		{Pattern: "absent", Weight: -0.9},
+	}}
+	if score, _ := scoreFingerprint(cfgHigh, "yes only", make(http.Header)); score != 1 {
+		t.Fatalf("score = %v, want clamped to 1", score)
+	}
+
+	// only the -0.9 sig matches: raw -0.9/0.1 = -9.
+	cfgLow := &FingerprintConfig{Signatures: []FPSignature{
+		{Pattern: "absent", Weight: 1},
+		{Pattern: "neg", Weight: -0.9},
+	}}
+	if score, _ := scoreFingerprint(cfgLow, "neg only", make(http.Header)); score != 0 {
+		t.Fatalf("score = %v, want clamped to 0", score)
+	}
+}
+
+// a NaN weight (unreachable through validateFingerprint, but reachable by
+// any caller that builds a FingerprintConfig directly) must clamp to 0, not
+// pass through: every ordered comparison against NaN is false, so a naive
+// clamp of "< 0 -> 0, > 1 -> 1" silently returns NaN unchanged.
+func TestScoreFingerprintClampsNaNWeight(t *testing.T) {
+	cfg := &FingerprintConfig{Signatures: []FPSignature{
+		{Pattern: "yes", Weight: float32(math.NaN())},
+	}}
+	score, _ := scoreFingerprint(cfg, "yes only", make(http.Header))
+	if score != 0 {
+		t.Fatalf("score = %v, want NaN clamped to 0", score)
+	}
+}
+
+// the clamp must be a no-op on the validated domain: any signature set that
+// validateFingerprint would accept already scores within [0, 1].
+func TestScoreFingerprintClampIsNoopOnValidatedScore(t *testing.T) {
+	cfg := &FingerprintConfig{Signatures: []FPSignature{
+		{Pattern: "alpha", Weight: 1},
+		{Pattern: "beta", Weight: 1},
+	}}
+	score, _ := scoreFingerprint(cfg, "only alpha here", make(http.Header))
+	if score != 0.5 {
+		t.Fatalf("score = %v, want unchanged 0.5", score)
+	}
+}

internal/scan/frameworks/detector.go

@@ -20,6 +20,7 @@
 package frameworks
 
 import (
+	"math"
 	"net/http"
 	"strings"
 	"sync"
@@ -128,7 +129,25 @@ func (b BaseDetector) MatchSignatures(body string, headers http.Header) float32
 		return 0
 	}
 
-	return weightedScore / totalWeight
+	return clampUnit(weightedScore / totalWeight)
+}
+
+// clampUnit bounds a fraction to [0, 1]. Signature weights are expected
+// non-negative and finite, so this is a no-op on any real detector; it only
+// guards a caller that feeds MatchSignatures a negative or NaN weight. NaN
+// needs its own check: every ordered comparison against NaN is false, so
+// the < 0 and > 1 checks below would silently let it through otherwise.
+func clampUnit(f float32) float32 {
+	if math.IsNaN(float64(f)) {
+		return 0
+	}
+	if f < 0 {
+		return 0
+	}
+	if f > 1 {
+		return 1
+	}
+	return f
 }
 
 // headerValueContains reports whether the named header's value contains the signature.

internal/scan/frameworks/detector_clamp_test.go

@@ -0,0 +1,66 @@
+/*
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+:                                                                               :
+:   █▀ █ █▀▀   ·   Blazing-fast pentesting suite                                :
+:   ▄█ █ █▀    ·   BSD 3-Clause License                                         :
+:                                                                               :
+:   (c) 2022-2026 vmfunc, xyzeva,                                               :
+:                 lunchcat alumni & contributors                                :
+:                                                                               :
+·━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━·
+*/
+
+package frameworks
+
+import (
+	"math"
+	"net/http"
+	"testing"
+)
+
+// MatchSignatures shares scoreFingerprint's math and the same trust-the-caller
+// gap: a negative weight must not push the score outside [0, 1].
+func TestMatchSignaturesClampsOutOfRangeWeights(t *testing.T) {
+	// weights 1 and -0.9 -> total 0.1; only the +1 sig matches: raw 1/0.1 = 10.
+	high := NewBaseDetector("x", []Signature{
+		{Pattern: "yes", Weight: 1},
+		{Pattern: "absent", Weight: -0.9},
+	})
+	if score := high.MatchSignatures("yes only", http.Header{}); score != 1 {
+		t.Fatalf("score = %v, want clamped to 1", score)
+	}
+
+	// only the -0.9 sig matches: raw -0.9/0.1 = -9.
+	low := NewBaseDetector("x", []Signature{
+		{Pattern: "absent", Weight: 1},
+		{Pattern: "neg", Weight: -0.9},
+	})
+	if score := low.MatchSignatures("neg only", http.Header{}); score != 0 {
+		t.Fatalf("score = %v, want clamped to 0", score)
+	}
+}
+
+// a NaN weight (unreachable through the validating custom-detector loader,
+// but reachable by any caller that builds a Signature directly, as the
+// exported BaseDetector/NewBaseDetector allow) must clamp to 0, not pass
+// through: every ordered comparison against NaN is false, so a naive clamp
+// of "< 0 -> 0, > 1 -> 1" silently returns NaN unchanged.
+func TestMatchSignaturesClampsNaNWeight(t *testing.T) {
+	d := NewBaseDetector("x", []Signature{
+		{Pattern: "yes", Weight: float32(math.NaN())},
+	})
+	if score := d.MatchSignatures("yes only", http.Header{}); score != 0 {
+		t.Fatalf("score = %v, want NaN clamped to 0", score)
+	}
+}
+
+// the clamp must not touch scores already inside [0, 1].
+func TestMatchSignaturesClampIsNoopOnValidatedScore(t *testing.T) {
+	d := NewBaseDetector("x", []Signature{
+		{Pattern: "alpha", Weight: 1},
+		{Pattern: "beta", Weight: 1},
+	})
+	if score := d.MatchSignatures("only alpha here", http.Header{}); score != 0.5 {
+		t.Fatalf("score = %v, want unchanged 0.5", score)
+	}
+}