Fix all 4 known OASB detection gaps

[thebenignhacker]

Summary

Fixes all 4 documented detection gaps in ARP, with 24 new tests.

Gap 1: Anomaly baseline persistence

AnomalyDetector.save() / .load() — serializes baselines to disk. 6 tests.

Gap 2: Connection rate burst detection

NetworkMonitor sliding window with EMA. Configurable burst threshold. 5 tests.

Gap 3: Cross-monitor event correlation

New CorrelationEngine — 60s window, 2+ source correlation, severity escalation. 9 tests.

Gap 4: HTTP response body scanning

Proxy passthrough routes responses through scanOutput(). 100KB limit. 4 tests.

Test plan

• 190 ARP tests pass (24 new)
• 1074 full HMA tests pass
• Build clean
• Updated HMA OASB tests for correlation events

[github-actions]

Claude Code Review

Security Review: PR #60 - Fix all 4 known OASB detection gaps

VERDICT: APPROVE

SUMMARY:

This PR introduces four new security capabilities to the ARP system: anomaly baseline persistence, network connection burst detection, cross-monitor event correlation, and HTTP response body scanning. All changes have been verified against the full source code. The implementations use appropriate input validation, bounds checking, and safe data handling patterns. No unmitigated security vulnerabilities were found in the new code.

VERIFICATION RESULTS:

Gap 1: Anomaly baseline persistence (src/arp/intelligence/anomaly.ts:87-132)

• ✅ Path traversal: path.join(dataDir, 'anomaly-baselines.json') with fs.mkdirSync(dataDir, { recursive: true }) at line 97 - safe, dataDir is provided by caller from trusted config
• ✅ JSON parsing: JSON.parse() at line 112 wrapped in try/catch (line 127) - safe error handling
• ✅ Prototype pollution: Not applicable - using Map data structures, not deserializing into object prototypes

Gap 2: Connection rate burst detection (src/arp/monitors/network.ts:36-184)

• ✅ Command injection: Uses execSync() with hardcoded shell commands (lines 208, 241, 322) - no user input interpolation
• ✅ Array bounds: Sliding window trimming at line 150 uses filter() - safe
• ✅ Division by zero: Threshold check at line 170 includes threshold > 0 guard - safe

Gap 3: Cross-monitor event correlation (src/arp/engine/correlation.ts:1-112)

• ✅ Resource exhaustion: emittedCorrelations Set cleared when size > 1000 (line 43-44) - bounded growth
• ✅ Array manipulation: recentEvents.shift() in while loop (line 33-39) with proper timestamp-based pruning - safe
• ✅ No ReDoS: No regex usage in correlation logic

Gap 4: HTTP response body scanning (src/arp/proxy/server.ts:196-217)

• ✅ DoS protection: 100KB size limit enforced before scanning (line 213) - prevents large response scanning attacks
• ✅ Safe delegation: Passes bodyStr to PromptInterceptor.scanOutput() which implements pattern matching (not shown in diff but pre-existing)
• ✅ Path traversal in proxy routing: Lines 107-114 validate forward path doesn't contain // or scheme prefixes - safe SSRF mitigation

Integration with EventEngine (src/arp/engine/event-engine.ts:101-114)

• ✅ Infinite loop prevention: correlationKey check at line 102 prevents correlation events from triggering more correlations - safe
• ✅ Recursive emit: Synthetic correlation event re-emitted through same pipeline, but loop guard prevents unbounded recursion

Test coverage

• 24 new tests cover edge cases including corrupted baseline files, burst threshold boundaries, correlation deduplication
• OASB integration tests updated to filter correlation events from assertions - maintains test accuracy

No security issues requiring changes.

---

Reviewed 17 files changed (53547 bytes)