scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-11-14 09:01:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(skill): walk every introducing chain before not_reached

Browse source 
For a transitive package the caller of the affected API is the package one
hop above it on each chain (body-parser for express > body-parser > qs),
not the direct dependency. Inspect that package on every chain; any chain
left unclear keeps the finding at imported.
This commit is contained in:
yoni 2026-11-08 19:27:15 +00:00
parent 7c490203ab
commit 0b78002686
1 changed files with 9 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
strix/skills/custom/dependency_cve_scanning.md
View file

@ -152,12 +152,15 @@ fi
`PyYAML` → `yaml`). No hits ⇒ `not_imported`, with the search scope stated
in `reachability_evidence`. For a **transitive** dependency, the check is
whether application code imports it directly; if not, it is reachable only
through the direct dependency — inspect the direct dependency's own code
(its installed sources, or the class references of its jar) for the
affected API. Never referenced ⇒ `not_reached` (below), citing the
artifact you inspected; referenced ⇒ the direct dependency's call is the
usage site, continue with the symbol match from there; unclear ⇒
`imported` when the direct dep is used at all.
through the packages that depend on it — walk every introducing chain
from the lockfile (e.g. `express > body-parser > qs`) and inspect the code
of the package one hop above the vulnerable one on each chain
(`body-parser`, not just `express`; its installed sources, or the class
references of its jar) for the affected API. No chain references it ⇒
`not_reached` (below), citing every artifact you inspected; referenced ⇒
that package's call is the usage site, continue the trace upward from
there; any chain unclear or not inspected ⇒ `imported` when the direct
dep is used at all.
2. **Symbol match — per CVE, not per package.** Read each CVE's own advisory
(GHSA/NVD/OSV `affected[].ecosystem_specific.imports` or the advisory
text) for the affected functions/classes/APIs. Search application code for