Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs/CccsConnector.cs

@@ -25,17 +25,18 @@ namespace StellaOps.Concelier.Connector.Cccs;
 
 public sealed class CccsConnector : IFeedConnector
 {
-    private static readonly JsonSerializerOptions RawSerializerOptions = new(JsonSerializerDefaults.Web)
-    {
-        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
-    };
-
-    private static readonly JsonSerializerOptions DtoSerializerOptions = new(JsonSerializerDefaults.Web)
-    {
-        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
-    };
-
-    private const string DtoSchemaVersion = "cccs.dto.v1";
+    private static readonly JsonSerializerOptions RawSerializerOptions = new(JsonSerializerDefaults.Web)
+    {
+        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+    };
+
+    private static readonly JsonSerializerOptions DtoSerializerOptions = new(JsonSerializerDefaults.Web)
+    {
+        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+    };
+
+    private static readonly Uri CanonicalBaseUri = new("https://www.cyber.gc.ca", UriKind.Absolute);
+    private const string DtoSchemaVersion = "cccs.dto.v1";
 
     private readonly CccsFeedClient _feedClient;
     private readonly RawDocumentStorage _rawDocumentStorage;
@@ -482,24 +483,37 @@ public sealed class CccsConnector : IFeedConnector
         }
     }
 
-    private static string BuildDocumentUri(CccsFeedItem item, CccsFeedEndpoint feed)
-    {
-        if (!string.IsNullOrWhiteSpace(item.Url))
-        {
-            if (Uri.TryCreate(item.Url, UriKind.Absolute, out var absolute))
-            {
-                return absolute.ToString();
-            }
-
-            var baseUri = new Uri("https://www.cyber.gc.ca", UriKind.Absolute);
-            if (Uri.TryCreate(baseUri, item.Url, out var combined))
-            {
-                return combined.ToString();
-            }
-        }
-
-        return $"https://www.cyber.gc.ca/api/cccs/threats/{feed.Language}/{item.Nid}";
-    }
+    private static string BuildDocumentUri(CccsFeedItem item, CccsFeedEndpoint feed)
+    {
+        var candidate = item.Url?.Trim();
+        if (!string.IsNullOrWhiteSpace(candidate))
+        {
+            if (Uri.TryCreate(candidate, UriKind.Absolute, out var absolute))
+            {
+                if (IsHttpScheme(absolute.Scheme))
+                {
+                    return absolute.ToString();
+                }
+
+                candidate = absolute.PathAndQuery;
+                if (!string.IsNullOrEmpty(absolute.Fragment))
+                {
+                    candidate += absolute.Fragment;
+                }
+            }
+
+            if (!string.IsNullOrWhiteSpace(candidate) && Uri.TryCreate(CanonicalBaseUri, candidate, out var combined))
+            {
+                return combined.ToString();
+            }
+        }
+
+        return new Uri(CanonicalBaseUri, $"/api/cccs/threats/{feed.Language}/{item.Nid}").ToString();
+    }
+
+    private static bool IsHttpScheme(string? scheme)
+        => string.Equals(scheme, Uri.UriSchemeHttp, StringComparison.OrdinalIgnoreCase)
+        || string.Equals(scheme, Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase);
 
     private static CccsRawAdvisoryDocument CreateRawDocument(CccsFeedItem item, CccsFeedEndpoint feed, IReadOnlyDictionary<int, string> taxonomy)
     {

src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs/Configuration/CccsOptions.cs

@@ -125,11 +125,16 @@ public sealed class CccsFeedEndpoint
             throw new InvalidOperationException("Feed endpoint URI must be configured before building taxonomy URI.");
         }
 
-        var language = Uri.GetQueryParameterValueOrDefault("lang", Language);
-        var builder = $"https://www.cyber.gc.ca/api/cccs/taxonomy/v1/get?lang={language}&vocabulary=cccs_alert_type";
-        return new Uri(builder, UriKind.Absolute);
-    }
-}
+        var language = Uri.GetQueryParameterValueOrDefault("lang", Language);
+        var taxonomyBuilder = new UriBuilder(Uri)
+        {
+            Path = "/api/cccs/taxonomy/v1/get",
+            Query = $"lang={language}&vocabulary=cccs_alert_type"
+        };
+
+        return taxonomyBuilder.Uri;
+    }
+}
 
 internal static class CccsUriExtensions
 {

src/Concelier/__Libraries/StellaOps.Concelier.Connector.Cccs/Internal/CccsHtmlParser.cs

@@ -348,19 +348,21 @@ public sealed class CccsHtmlParser
 
     private static string? NormalizeReferenceUrl(string? href, Uri? baseUri, string language)
     {
-        if (string.IsNullOrWhiteSpace(href))
-        {
-            return null;
-        }
-
-        if (!Uri.TryCreate(href, UriKind.Absolute, out var absolute))
-        {
-            if (baseUri is null || !Uri.TryCreate(baseUri, href, out absolute))
-            {
-                return null;
-            }
-        }
-
+        if (string.IsNullOrWhiteSpace(href))
+        {
+            return null;
+        }
+
+        var candidate = href.Trim();
+        var hasAbsolute = Uri.TryCreate(candidate, UriKind.Absolute, out var absolute);
+        if (!hasAbsolute || string.Equals(absolute.Scheme, Uri.UriSchemeFile, StringComparison.OrdinalIgnoreCase))
+        {
+            if (baseUri is null || !Uri.TryCreate(baseUri, candidate, out absolute))
+            {
+                return null;
+            }
+        }
+
         var builder = new UriBuilder(absolute)
         {
             Fragment = string.Empty,