Design: Salesforce Advisories RSS Processor

Overview

Fetches Salesforce security advisories from the master RSS feed at security.salesforce.com/security-advisories/rss, parses CVE/GHSA aliases and bracketed product lists from each item, stores per-advisory rows under source="salesforce", and (when --emit-crit) stages CRIT candidate envelopes per (vulnID × Salesforce product).

Help articles (help.salesforce.com / kb.tableau.com / help.mulesoft.com) are SPA-rendered and not anonymously parseable; the RSS <description> is the canonical body — no per-article HTML enrichment fetch is needed.

Source identifier: salesforce Data type: rss ECS task name: go-salesforce-advisories-rss-processor Schedule: Runs weekly on Saturdays at 05:00 UTC (cron(0 5 ? * SAT *)). Pattern: A — inline per-record CRIT staging Phase: 1.7

Data Source

RSS item shape

<item>
  <title><![CDATA[[Vulnerability] CVE's for various vulnerabilities impacting some versions of Tableau Server and Tableau Desktop]]></title>
  <link>https://help.salesforce.com/s/articleView?id=005132575&amp;type=1</link>
  <guid>https://help.salesforce.com/s/articleView?id=005132575&amp;type=1</guid>
  <pubDate>Fri, 22 Aug 2025 00:00:00 GMT</pubDate>
  <description><![CDATA[[Tableau] We assigned the CVSSv3 score as 9.1. Affected CVE-2025-26496, CVE-2025-26497. We strongly encourage Tableau Server customers to apply the update. https://www.cve.org/CVERecord?id=CVE-2025-26496]]></description>
</item>

Article-ID extraction

Three URL shapes recur:

• help.salesforce.com/s/articleView?id=NNNNNNNNN&type=1 → NNNNNNNNN (numeric)
• status.salesforce.com/generalmessages/NNNNNNNNN → status-NNNNNNNNN
• kb.tableau.com/articles/Issue/{slug} → tableau-{slug}
• help.mulesoft.com/{slug} → mulesoft-{slug}
• Anything else → {host}-{lastPathSegment}

The article ID becomes CVEMetadata.cveId verbatim — no SFDC-YYYY-NNN scheme exists (precedent: AWS slug bulletins).

Architecture / Data Flow

Source → Database Mappings

CVEMetadata

CVEAlias

CVE-* and GHSA-* extracted from <title> + <description> via regex. Passed to db.InsertAliases. Empty list still triggers same-cveId backfill (per AGENTS.md alias contract).

GHSA canonicalisation: GHSA- prefix preserved in upper-case + body in lower-case (e.g. GHSA-5x4f-fvv8-wr65).

CVEMetadataReferences

• Always include the article URL as the first reference (advisory type).
• All https?://... URLs from <description> extracted via regex.
• Filtered against isDenyHost (analytics + asset CDNs).
• Deduped via urlSeen map.

Type classification:

• self-link → advisory
• contains cve.org / cve.mitre.org / /security/advisories/ghsa- / nvd.nist.gov/vuln/detail/cve- → advisory
• contains /releases/tag/ → patch
• everything else → web

CVEDescription

Body text truncated to 1500 chars → one row with containerType="cna", lang="en".

S3 archive

salesforce/files/{sha256}/{articleID}.json

Service Mapping

service_map.go:Resolve walks the bracketed product list and resolves to spec/extended dict tuples.

Bracket extraction (rss.go:ExtractProducts + parser.go:filterCategoryLeaders)

The leading [..] of title or description contains either a category leader or a product list:

• Category leaders (filtered out): Vulnerability, Security Advisory, Security Update, Security Notification, Security Enhancements, Tableau Security Advisory.
• Product lists (kept): [Tableau, Slack, Service Cloud, ...] comma-separated.

Resolution order (more-specific first):

Extended-dict layer (internal/critutil/dictionaries/extended/salesforce.json): 17 entries with template_format=salesforce_url. Spec dict salesforce.json covers SObject record-level entries (crm/account, tooling/apex_class) — disjoint from this layer.

Business Rules

Resume / re-fetch (main.go:entryHash)

RSS parsing (rss.go:ExtractProducts, parser.go:filterCategoryLeaders)

CVSS extraction (parser.go:CombineRSS)

Service mapping (service_map.go:Resolve)

fix_propagation inference (crit_mapper.go:inferFixPropagation)

Confidence ladder (crit_mapper.go:confidenceFor)

Reference filtering (parser.go:isDenyHost)

vex_status / shared_responsibility coupling

Same as ServiceNow R23–R24:

• R26 automatic ⇒ provider_only.
• R27 existing_deployments_remain_vulnerable is false iff provider_only + automatic.

Drain (main.go)

• R28 Drain skipped when CRIT_DISABLE_INPROCESS_DRAIN=true.
• R29 Drain skipped when len(stagedKeys) == 0.
• R30 Drain workers fixed at 4.

Verification Queries

SELECT count(*) FROM "CVEMetadata" WHERE source='salesforce';
-- expected: ~91-93

-- Article-ID primary keys (no CVE/GHSA pattern)
SELECT count(*) FROM "CVEMetadata"
 WHERE source='salesforce' AND "cveId" NOT LIKE 'CVE-%' AND "cveId" NOT LIKE 'GHSA-%';
-- expected: equal to row count

-- GHSA aliases extracted from body (recent advisories)
SELECT count(*) FROM "CVEAlias"
 WHERE "discoveredFrom"='salesforce' AND "aliasCveId" LIKE 'GHSA-%';
-- expected: non-zero

-- Reference coverage
SELECT count(*) FROM "CVEMetadataReferences"
 WHERE source='salesforce'
   AND "cveId" IN (SELECT "cveId" FROM "CVEMetadata" WHERE source='salesforce')
 GROUP BY "cveId" HAVING count(*) = 0;
-- expected: 0 rows

-- Service distribution (provider=salesforce)
SELECT service, count(*) FROM "CritRecord"
 WHERE provider='salesforce' GROUP BY 1 ORDER BY 2 DESC;
-- expected weighting: tableau dominant, then mulesoft / salesforce_platform / heroku / etc

-- Pending should be empty
SELECT "processingStatus", count(*) FROM "S3QueueObject"
 WHERE source='salesforce-advisories-rss-processor' GROUP BY 1;
-- expected: only `inserted`

Risk Surface

S3 Persistence

Not used. This processor does not currently archive payloads or quarantine failures to S3. Per the S3 Persistence Contract this is non-compliant — see the compliance matrix for the implementation roadmap.

⚠ Not in the compliance matrix — status needs verification.

Expected paths when implemented:

• Archive: salesforce-advisories/files/{sha256}/{filename}
• Quarantine: failed-feeds/salesforce-advisories-rss-processor/{YYYY-MM-DD}/{reason}/{filename}
• Likely reasons: (none documented)