Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

src/Concelier/__Libraries/StellaOps.Concelier.Connector.StellaOpsMirror/StellaOps.Concelier.Connector.StellaOpsMirror.csproj

@@ -8,10 +8,11 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.0-rc.2.25502.107" />
     <ProjectReference Include="../StellaOps.Concelier.Connector.Common/StellaOps.Concelier.Connector.Common.csproj" />
     <ProjectReference Include="../StellaOps.Concelier.Models/StellaOps.Concelier.Models.csproj" />
     <ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
     <ProjectReference Include="../StellaOps.Concelier.Normalization/StellaOps.Concelier.Normalization.csproj" />
     <ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
   </ItemGroup>
-</Project>
+</Project>

src/Concelier/__Libraries/StellaOps.Concelier.Connector.StellaOpsMirror/StellaOpsMirrorConnector.cs

@@ -1,11 +1,10 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
-using System.Security.Cryptography;
-using System.Text;
-using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Options;
-using MongoDB.Bson;
+using System.Text;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using MongoDB.Bson;
 using StellaOps.Concelier.Connector.Common.Fetch;
 using StellaOps.Concelier.Connector.Common;
 using StellaOps.Concelier.Connector.StellaOpsMirror.Client;
@@ -15,9 +14,10 @@ using StellaOps.Concelier.Connector.StellaOpsMirror.Settings;
 using StellaOps.Concelier.Models;
 using StellaOps.Concelier.Storage.Mongo;
 using StellaOps.Concelier.Storage.Mongo.Advisories;
-using StellaOps.Concelier.Storage.Mongo.Documents;
-using StellaOps.Concelier.Storage.Mongo.Dtos;
-using StellaOps.Plugin;
+using StellaOps.Concelier.Storage.Mongo.Documents;
+using StellaOps.Concelier.Storage.Mongo.Dtos;
+using StellaOps.Plugin;
+using StellaOps.Cryptography;
 
 namespace StellaOps.Concelier.Connector.StellaOpsMirror;
 
@@ -30,12 +30,13 @@ public sealed class StellaOpsMirrorConnector : IFeedConnector
     private readonly MirrorSignatureVerifier _signatureVerifier;
     private readonly RawDocumentStorage _rawDocumentStorage;
     private readonly IDocumentStore _documentStore;
-    private readonly IDtoStore _dtoStore;
-    private readonly IAdvisoryStore _advisoryStore;
-    private readonly ISourceStateRepository _stateRepository;
-    private readonly TimeProvider _timeProvider;
-    private readonly ILogger<StellaOpsMirrorConnector> _logger;
-    private readonly StellaOpsMirrorConnectorOptions _options;
+    private readonly IDtoStore _dtoStore;
+    private readonly IAdvisoryStore _advisoryStore;
+    private readonly ISourceStateRepository _stateRepository;
+    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<StellaOpsMirrorConnector> _logger;
+    private readonly StellaOpsMirrorConnectorOptions _options;
+    private readonly ICryptoHash _hash;
 
     public StellaOpsMirrorConnector(
         MirrorManifestClient client,
@@ -45,20 +46,22 @@ public sealed class StellaOpsMirrorConnector : IFeedConnector
         IDtoStore dtoStore,
         IAdvisoryStore advisoryStore,
         ISourceStateRepository stateRepository,
-        IOptions<StellaOpsMirrorConnectorOptions> options,
-        TimeProvider? timeProvider,
-        ILogger<StellaOpsMirrorConnector> logger)
+        IOptions<StellaOpsMirrorConnectorOptions> options,
+        TimeProvider? timeProvider,
+        ICryptoHash cryptoHash,
+        ILogger<StellaOpsMirrorConnector> logger)
     {
         _client = client ?? throw new ArgumentNullException(nameof(client));
         _signatureVerifier = signatureVerifier ?? throw new ArgumentNullException(nameof(signatureVerifier));
         _rawDocumentStorage = rawDocumentStorage ?? throw new ArgumentNullException(nameof(rawDocumentStorage));
         _documentStore = documentStore ?? throw new ArgumentNullException(nameof(documentStore));
         _dtoStore = dtoStore ?? throw new ArgumentNullException(nameof(dtoStore));
-        _advisoryStore = advisoryStore ?? throw new ArgumentNullException(nameof(advisoryStore));
-        _stateRepository = stateRepository ?? throw new ArgumentNullException(nameof(stateRepository));
-        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
-        _timeProvider = timeProvider ?? TimeProvider.System;
-        _options = (options ?? throw new ArgumentNullException(nameof(options))).Value ?? throw new ArgumentNullException(nameof(options));
+        _advisoryStore = advisoryStore ?? throw new ArgumentNullException(nameof(advisoryStore));
+        _stateRepository = stateRepository ?? throw new ArgumentNullException(nameof(stateRepository));
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        _timeProvider = timeProvider ?? TimeProvider.System;
+        _hash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
+        _options = (options ?? throw new ArgumentNullException(nameof(options))).Value ?? throw new ArgumentNullException(nameof(options));
         ValidateOptions(_options);
     }
 
@@ -280,7 +283,7 @@ public sealed class StellaOpsMirrorConnector : IFeedConnector
         await _stateRepository.UpdateCursorAsync(Source, document, now, cancellationToken).ConfigureAwait(false);
     }
 
-    private static void VerifyDigest(string expected, ReadOnlySpan<byte> payload, string path)
+    private void VerifyDigest(string expected, ReadOnlySpan<byte> payload, string path)
     {
         if (string.IsNullOrWhiteSpace(expected))
         {
@@ -292,19 +295,16 @@ public sealed class StellaOpsMirrorConnector : IFeedConnector
             throw new InvalidOperationException($"Unsupported digest '{expected}' for '{path}'.");
         }
 
-        var actualHash = SHA256.HashData(payload);
-        var actual = "sha256:" + Convert.ToHexString(actualHash).ToLowerInvariant();
+        var actualHash = _hash.ComputeHashHex(payload, HashAlgorithms.Sha256);
+        var actual = "sha256:" + actualHash;
         if (!string.Equals(actual, expected, StringComparison.OrdinalIgnoreCase))
         {
             throw new InvalidOperationException($"Digest mismatch for '{path}'. Expected {expected}, computed {actual}.");
         }
     }
 
-    private static string ComputeSha256(ReadOnlySpan<byte> payload)
-    {
-        var hash = SHA256.HashData(payload);
-        return Convert.ToHexString(hash).ToLowerInvariant();
-    }
+    private string ComputeSha256(ReadOnlySpan<byte> payload)
+        => _hash.ComputeHashHex(payload, HashAlgorithms.Sha256);
 
     private static string NormalizeDigest(string digest)
     {