Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ru.Nkcki/RuNkckiConnector.cs

@@ -4,23 +4,23 @@ using System.IO;
 using System.IO.Compression;
 using System.Net;
 using System.Linq;
-using System.Security.Cryptography;
-using System.Text;
-using System.Text.Json;
-using System.Text.Json.Serialization;
-using AngleSharp.Html.Parser;
-using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Options;
-using MongoDB.Bson;
-using StellaOps.Concelier.Connector.Common;
-using StellaOps.Concelier.Connector.Common.Fetch;
-using StellaOps.Concelier.Connector.Ru.Nkcki.Configuration;
-using StellaOps.Concelier.Connector.Ru.Nkcki.Internal;
-using StellaOps.Concelier.Storage.Mongo;
-using StellaOps.Concelier.Storage.Mongo.Advisories;
-using StellaOps.Concelier.Storage.Mongo.Documents;
-using StellaOps.Concelier.Storage.Mongo.Dtos;
-using StellaOps.Plugin;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using AngleSharp.Html.Parser;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using MongoDB.Bson;
+using StellaOps.Concelier.Connector.Common;
+using StellaOps.Concelier.Connector.Common.Fetch;
+using StellaOps.Concelier.Connector.Ru.Nkcki.Configuration;
+using StellaOps.Concelier.Connector.Ru.Nkcki.Internal;
+using StellaOps.Concelier.Storage.Mongo;
+using StellaOps.Concelier.Storage.Mongo.Advisories;
+using StellaOps.Concelier.Storage.Mongo.Documents;
+using StellaOps.Concelier.Storage.Mongo.Dtos;
+using StellaOps.Plugin;
+using StellaOps.Cryptography;
 
 namespace StellaOps.Concelier.Connector.Ru.Nkcki;
 
@@ -55,11 +55,12 @@ public sealed class RuNkckiConnector : IFeedConnector
     private readonly ISourceStateRepository _stateRepository;
     private readonly RuNkckiOptions _options;
     private readonly TimeProvider _timeProvider;
-    private readonly RuNkckiDiagnostics _diagnostics;
-    private readonly ILogger<RuNkckiConnector> _logger;
-    private readonly string _cacheDirectory;
-
-    private readonly HtmlParser _htmlParser = new();
+    private readonly RuNkckiDiagnostics _diagnostics;
+    private readonly ILogger<RuNkckiConnector> _logger;
+    private readonly string _cacheDirectory;
+    private readonly ICryptoHash _hash;
+
+    private readonly HtmlParser _htmlParser = new();
 
     public RuNkckiConnector(
         SourceFetchService fetchService,
@@ -69,9 +70,10 @@ public sealed class RuNkckiConnector : IFeedConnector
         IAdvisoryStore advisoryStore,
         ISourceStateRepository stateRepository,
         IOptions<RuNkckiOptions> options,
-        RuNkckiDiagnostics diagnostics,
-        TimeProvider? timeProvider,
-        ILogger<RuNkckiConnector> logger)
+        RuNkckiDiagnostics diagnostics,
+        TimeProvider? timeProvider,
+        ILogger<RuNkckiConnector> logger,
+        ICryptoHash cryptoHash)
     {
         _fetchService = fetchService ?? throw new ArgumentNullException(nameof(fetchService));
         _rawDocumentStorage = rawDocumentStorage ?? throw new ArgumentNullException(nameof(rawDocumentStorage));
@@ -79,12 +81,13 @@ public sealed class RuNkckiConnector : IFeedConnector
         _dtoStore = dtoStore ?? throw new ArgumentNullException(nameof(dtoStore));
         _advisoryStore = advisoryStore ?? throw new ArgumentNullException(nameof(advisoryStore));
         _stateRepository = stateRepository ?? throw new ArgumentNullException(nameof(stateRepository));
-        _options = (options ?? throw new ArgumentNullException(nameof(options))).Value ?? throw new ArgumentNullException(nameof(options));
-        _options.Validate();
-        _diagnostics = diagnostics ?? throw new ArgumentNullException(nameof(diagnostics));
-        _timeProvider = timeProvider ?? TimeProvider.System;
-        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
-        _cacheDirectory = ResolveCacheDirectory(_options.CacheDirectory);
+        _options = (options ?? throw new ArgumentNullException(nameof(options))).Value ?? throw new ArgumentNullException(nameof(options));
+        _options.Validate();
+        _diagnostics = diagnostics ?? throw new ArgumentNullException(nameof(diagnostics));
+        _timeProvider = timeProvider ?? TimeProvider.System;
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        _hash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
+        _cacheDirectory = ResolveCacheDirectory(_options.CacheDirectory);
         EnsureCacheDirectory();
     }
 
@@ -597,7 +600,7 @@ public sealed class RuNkckiConnector : IFeedConnector
         }
 
         var payload = JsonSerializer.SerializeToUtf8Bytes(dto, SerializerOptions);
-        var sha = Convert.ToHexString(SHA256.HashData(payload)).ToLowerInvariant();
+        var sha = _hash.ComputeHashHex(payload);
         var documentUri = BuildDocumentUri(dto);
 
         var existing = await _documentStore.FindBySourceAndUriAsync(SourceName, documentUri, cancellationToken).ConfigureAwait(false);

src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ru.Nkcki/StellaOps.Concelier.Connector.Ru.Nkcki.csproj

@@ -18,6 +18,7 @@
     <ProjectReference Include="../StellaOps.Concelier.Connector.Common/StellaOps.Concelier.Connector.Common.csproj" />
     <ProjectReference Include="../StellaOps.Concelier.Models/StellaOps.Concelier.Models.csproj" />
     <ProjectReference Include="../StellaOps.Concelier.Storage.Mongo/StellaOps.Concelier.Storage.Mongo.csproj" />
+    <ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
   </ItemGroup>
 
-</Project>
+</Project>