fix(frameworks): match cdn vendor markers on header presence

the vendor markers (cf-ray, x-amz-cf-id, x-vercel-id and friends) carried no
Header, so MatchSignatures ran them through containsHeader, which substring
matches every header name and every header value. an origin that merely names
those headers in a value was read as sitting behind that edge:

  Access-Control-Expose-Headers: CF-Ray, X-Amz-Cf-Id, X-Vercel-Id
  -> "Cloudflare" at 0.9526 on a plain nginx origin

that header is about the most common cors config there is, and cdns themselves
emit it, so this was a live false positive rather than a corner.

add Signature.Presence: with Header set, the signature matches on the header
existing rather than on its value. that is the right primitive for an edge
marker, whose value is an opaque request id with nothing to match. the brand
words keep their existing Server/Via scoping.

Author: TBX3D

internal/scan/frameworks/detector.go

@@ -33,6 +33,11 @@ type Signature struct {
 	// Header, when set, scopes a HeaderOnly match to the named header's value
 	// (canonical form, e.g. "X-Powered-By"). Empty matches across all headers.
 	Header string
+	// Presence, with Header set, matches on the header existing at all rather
+	// than on its value. an edge marker like CF-Ray carries an opaque id, so
+	// there is no value to match; what identifies the provider is that the
+	// header was stamped. Pattern is unused.
+	Presence bool
 }
 
 // Detector is the interface for framework detection plugins.
@@ -111,9 +116,12 @@ func (b BaseDetector) MatchSignatures(body string, headers http.Header) float32
 
 		if sig.HeaderOnly {
 			var matched bool
-			if sig.Header != "" {
+			switch {
+			case sig.Presence:
+				matched = len(headers.Values(sig.Header)) > 0
+			case sig.Header != "":
 				matched = headerValueContains(headers, sig.Header, sig.Pattern)
-			} else {
+			default:
 				matched = containsHeader(headers, sig.Pattern)
 			}
 			if matched {

internal/scan/frameworks/detectors/cdn.go

@@ -36,10 +36,17 @@ func init() {
 	fw.RegisterCDN(&netlifyDetector{})
 }
 
-// all CDN signatures are HeaderOnly and scoped to the specific edge-injected
-// header the provider controls, never a bare brand substring: a page that
-// merely mentions "cloudflare" in its body (a badge, a blog post, a status
-// widget) must not fire, only the response the edge itself stamped.
+// all CDN signatures are HeaderOnly and scoped to a specific header the
+// provider controls, never a bare substring matched across every header.
+//
+// vendor markers match on Presence, because the value is an opaque request id
+// and what identifies the provider is that the header was stamped at all. that
+// also keeps them off header values: an origin advertising
+// "Access-Control-Expose-Headers: CF-Ray" is naming a header, not sitting
+// behind cloudflare.
+//
+// brand words are scoped to the header that carries them (Server, Via), so a
+// CSP or Link header referencing a cdn-hosted asset cannot fire them.
 
 type cloudflareDetector struct{}
 
@@ -48,7 +55,7 @@ func (d *cloudflareDetector) Name() string { return "Cloudflare" }
 func (d *cloudflareDetector) Signatures() []fw.Signature {
 	return []fw.Signature{
 		// header name cf-ray is injected by every Cloudflare-proxied response.
-		{Pattern: "cf-ray", Weight: 0.6, HeaderOnly: true},
+		{Header: "CF-Ray", Presence: true, Weight: 0.6, HeaderOnly: true},
 		{Pattern: "cloudflare", Weight: 0.4, HeaderOnly: true, Header: "Server"},
 	}
 }
@@ -67,7 +74,7 @@ func (d *fastlyDetector) Signatures() []fw.Signature {
 		// x-fastly-request-id is only emitted by fastly's own edge; a plain
 		// varnish deployment (fastly is varnish-based) never sends it, so this
 		// stays clear of the generic "Via: 1.1 varnish" false positive.
-		{Pattern: "x-fastly-request-id", Weight: 0.6, HeaderOnly: true},
+		{Header: "X-Fastly-Request-ID", Presence: true, Weight: 0.6, HeaderOnly: true},
 		{Pattern: "fastly", Weight: 0.4, HeaderOnly: true, Header: "Via"},
 	}
 }
@@ -83,8 +90,8 @@ func (d *akamaiDetector) Name() string { return "Akamai" }
 
 func (d *akamaiDetector) Signatures() []fw.Signature {
 	return []fw.Signature{
-		{Pattern: "akamai-grn", Weight: 0.5, HeaderOnly: true},
-		{Pattern: "x-akamai", Weight: 0.5, HeaderOnly: true},
+		{Header: "Akamai-GRN", Presence: true, Weight: 0.5, HeaderOnly: true},
+		{Header: "X-Akamai-Transformed", Presence: true, Weight: 0.5, HeaderOnly: true},
 	}
 }
 
@@ -99,7 +106,7 @@ func (d *cloudfrontDetector) Name() string { return "Amazon CloudFront" }
 
 func (d *cloudfrontDetector) Signatures() []fw.Signature {
 	return []fw.Signature{
-		{Pattern: "x-amz-cf-id", Weight: 0.5, HeaderOnly: true},
+		{Header: "X-Amz-Cf-Id", Presence: true, Weight: 0.5, HeaderOnly: true},
 		{Pattern: "cloudfront", Weight: 0.5, HeaderOnly: true, Header: "Via"},
 	}
 }
@@ -115,7 +122,7 @@ func (d *vercelDetector) Name() string { return "Vercel" }
 
 func (d *vercelDetector) Signatures() []fw.Signature {
 	return []fw.Signature{
-		{Pattern: "x-vercel-id", Weight: 0.5, HeaderOnly: true},
+		{Header: "X-Vercel-Id", Presence: true, Weight: 0.5, HeaderOnly: true},
 		{Pattern: "vercel", Weight: 0.5, HeaderOnly: true, Header: "Server"},
 	}
 }
@@ -131,7 +138,7 @@ func (d *netlifyDetector) Name() string { return "Netlify" }
 
 func (d *netlifyDetector) Signatures() []fw.Signature {
 	return []fw.Signature{
-		{Pattern: "x-nf-request-id", Weight: 0.5, HeaderOnly: true},
+		{Header: "X-Nf-Request-Id", Presence: true, Weight: 0.5, HeaderOnly: true},
 		{Pattern: "netlify", Weight: 0.5, HeaderOnly: true, Header: "Server"},
 	}
 }

internal/scan/frameworks/detectors/cdn_test.go

@@ -159,3 +159,19 @@ func TestCDNDetectsRealEdgeHeaders(t *testing.T) {
 		})
 	}
 }
+
+// an origin advertising which of its headers CORS clients may read is naming
+// header names in a header VALUE, not sitting behind that edge. matching a
+// vendor marker across every header value turns the most common CORS config
+// into a cdn detection, so those markers match on header presence instead.
+func TestCDNIgnoresVendorHeaderNamesInValues(t *testing.T) {
+	origin := http.Header{}
+	origin.Set("Server", "nginx/1.24.0")
+	origin.Set("Access-Control-Expose-Headers",
+		"CF-Ray, X-Amz-Cf-Id, X-Vercel-Id, X-Fastly-Request-Id, X-NF-Request-ID, Akamai-GRN")
+	origin.Set("Vary", "Accept-Encoding, X-Akamai-Transformed")
+
+	if got := fw.DetectCDN("<html></html>", origin); got != nil {
+		t.Errorf("plain nginx origin reported as %q (confidence %.4f) from vendor header names quoted in a value", got.Name, got.Confidence)
+	}
+}