Sharang ParnerkarandClaude Opus 4.8
7bba3518d1
CI / Check (pull_request) Successful in 6m2s
CI / Detect Changes (pull_request) Has been skipped
CI / Deploy Agent (pull_request) Has been skipped
CI / Deploy Dashboard (pull_request) Has been skipped
CI / Deploy Docs (pull_request) Has been skipped
CI / Deploy MCP (pull_request) Has been skipped
Demo C surfaced this: a PlcSps target whose only live URL is an industrial
endpoint (modbus://plc-sim:502) still marked DAST applicable, so it could be
enabled and then failed at reconnaissance — DAST is an HTTP crawler and the
endpoint speaks raw Modbus.
- Add ArtifactRequirement::HttpUrl (a live URL with an http(s) scheme) and
point the three DAST rules (WebApp/BackendService, EmbeddedLinuxYocto,
PlcSps) at it. The ICS probe keeps RunningUrl — it works off host:port of
any scheme. A modbus:// endpoint now blocks DAST with a clear reason
("no http(s) live URL — DAST needs a web endpoint") so the wizard no longer
offers it as an opt-in.
- Gate the PLC-path DAST trigger on plan.has(Dast), not just plc||ics, so a
DAST target left over from an earlier run can't re-trigger against a
non-web device.
Tests: PlcSps + modbus:// offers ICS probe but blocks DAST; PlcSps + http
WebVisu offers both.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>