scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-10-15 04:18:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix: recognize plural file upload coverage

Browse source
This commit is contained in:
dajiaohuang 2026-10-15 11:34:40 +08:00
parent e97112a88d
commit 1e93cce7da
2 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
strix/report/coverage.py
View file

@ -109,7 +109,7 @@ _SKILL_PHRASINGS: dict[str, tuple[str, ...]] = {
"data exposure",
),
"insecure_deserialization": ("deserialization",),
"insecure_file_uploads": ("file upload",),
"insecure_file_uploads": ("file upload", "file uploads"),
"llm_prompt_injection": ("prompt injection",),
"mass_assignment": ("mass assignment", "parameter binding"),
"nosql_injection": ("nosql",),

19
tests/test_report_coverage.py
View file

@ -100,6 +100,15 @@ def test_synonym_phrasing_counts_as_recorded_coverage() -> None:
assert not [gap for gap in doc["gaps"] if gap["kind"] == "unrecorded_risk_class"]
def test_plural_risk_phrase_counts_as_recorded_coverage() -> None:
doc = _document(
entries=[_entry(risk_area="File uploads")],
agent_graph=_graph(metadata={"agent-1": {"skills": ["insecure_file_uploads"]}}),
)
assert not [gap for gap in doc["gaps"] if gap["kind"] == "unrecorded_risk_class"]
def test_non_risk_skills_carry_no_coverage_obligation() -> None:
"""Tooling skills describe how an agent works, not what it hunts."""
doc = _document(agent_graph=_graph(metadata={"agent-1": {"skills": ["idor", "caido"]}}))
@ -154,6 +163,16 @@ def test_unfinished_agent_makes_the_record_partial() -> None:
assert "authz-tester" in doc["completeness"]["caveats"][0]
def test_failed_agent_makes_the_record_partial() -> None:
doc = _document(
agent_graph=_graph(statuses={"agent-1": "failed"}),
exit_reason="finished_by_tool",
)
assert doc["completeness"]["complete"] is False
assert "authz-tester" in doc["completeness"]["caveats"][0]
def test_failed_run_status_makes_the_record_partial() -> None:
doc = _document(
run_record={"run_id": "r1", "status": "failed"},