EAS-4405 - feat: whitelist endpoint for authz scanner (#85)

* feat: whitelist endpoint for authz scanner

* chore: fmt fix

* validate allowlist

---------

Co-authored-by: gladstone-9 <gabejgladstone@gmail.com>

Author: gladstone-9

crates/forge_analyzer/src/definitions.rs

@@ -933,6 +933,9 @@ enum ApiCallKind {
     Authorize,
 }
 
+/// Specific API path prefixes that are unconditionally safe (trivial) for AuthZ purposes.
+const TRIVIAL_API_PREFIXES: &[&str] = &["/wiki/api/v2/app/properties"];
+
 fn classify_api_call(expr: &Expr) -> ApiCallKind {
     use regex::Regex;
     use std::cell::OnceCell;
@@ -959,7 +962,10 @@ fn classify_api_call(expr: &Expr) -> ApiCallKind {
         fn check(&mut self, name: &str) {
             if name.contains("permission") {
                 self.kind = self.kind.max(ApiCallKind::Authorize);
-            } else if trivial_regex(name) || name.contains("group") {
+            } else if trivial_regex(name)
+                || name.contains("group")
+                || TRIVIAL_API_PREFIXES.iter().any(|p| name.contains(p))
+            {
                 self.kind = self.kind.max(ApiCallKind::Trivial);
             } else if name == "/rest/api/3/field" || name == "/rest/api/2/field" {
                 self.kind = ApiCallKind::Fields;

crates/fsrt/src/test.rs

@@ -578,6 +578,88 @@ fn authz_function_called_in_object() {
     assert!(scan_result.contains_vulns(1))
 }
 
+// Tests that calls to /wiki/api/v2/app/properties are in TRIVIAL_API_PREFIXES and
+// are not flagged by the AuthZ scanner even without a prior authorize() call.
+#[test]
+fn wiki_api_v2_app_properties_not_flagged_by_authz() {
+    let test_forge_project = MockForgeProject::files_from_string(
+        "// src/index.tsx
+        import ForgeUI, { render, Fragment, Macro, Text } from '@forge/ui';
+        import api, { route } from '@forge/api';
+
+        const App = async () => {
+            const res = await api.asApp().requestConfluence(route`/wiki/api/v2/app/properties`);
+            return (
+                <Fragment>
+                <Text>Hello world!</Text>
+                </Fragment>
+            );
+        };
+
+        export const run = render(<Macro app={<App />} />);
+
+        // manifest.yml
+        modules:
+            macro:
+              - key: basic-hello-world
+                function: main
+                title: basic
+                handler: nothing
+                description: Inserts Hello world!
+            function:
+              - key: main
+                handler: index.run
+        app:
+            id: ari:cloud:ecosystem::app/07b89c0f-949a-4905-9de9-6c9521035986
+        permissions:
+            scopes: []",
+    );
+
+    let scan_result = scan_directory_test(test_forge_project);
+    assert!(scan_result.contains_vulns(0))
+}
+
+// A non-allowlisted Confluence path without authorize() SHOULD be flagged,
+// confirming wiki_api_v2_app_properties_not_flagged_by_authzis is actually exercising the allowlist.
+#[test]
+fn non_allowlisted_confluence_path_flagged_by_authz() {
+    let test_forge_project = MockForgeProject::files_from_string(
+        "// src/index.tsx
+        import ForgeUI, { render, Fragment, Macro, Text } from '@forge/ui';
+        import api, { route } from '@forge/api';
+
+        const App = async () => {
+            const res = await api.asApp().requestConfluence(route`/wiki/api/v2/pages`);
+            return (
+                <Fragment>
+                <Text>Hello world!</Text>
+                </Fragment>
+            );
+        };
+
+        export const run = render(<Macro app={<App />} />);
+
+        // manifest.yml
+        modules:
+            macro:
+              - key: basic-hello-world
+                function: main
+                title: basic
+                handler: nothing
+                description: Inserts Hello world!
+            function:
+              - key: main
+                handler: index.run
+        app:
+            id: ari:cloud:ecosystem::app/07b89c0f-949a-4905-9de9-6c9521035986
+        permissions:
+            scopes: []",
+    );
+
+    let scan_result = scan_directory_test(test_forge_project);
+    assert!(scan_result.contains_vulns(1))
+}
+
 #[test]
 fn secret_vuln_fetch_header() {
     let test_forge_project = MockForgeProject::files_from_string(