scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-10-13 03:57:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(reporting): drop unverified HTTP exchange IDs instead of storing them

Browse source 
When the proxy lookup itself fails, the finding is still filed but the
http_exchange_ids are omitted and the result carries a warning telling
the agent to attach them with update_vulnerability_report once the proxy
responds. Unverified IDs are never recorded as evidence.
This commit is contained in:
Ahmed Allam 2026-09-09 09:12:30 +00:00
parent 265df84048
commit 618261aa6a
2 changed files with 14 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
strix/tools/reporting/tool.py
View file

@ -222,8 +222,9 @@ def _normalize_http_exchange_ids(raw: Any) -> tuple[list[str] | None, list[str]]
return normalized, errors
_HTTP_EXCHANGE_UNVERIFIED_WARNING = (
"http_exchange_ids were stored unverified: the proxy project could not be reached"
_HTTP_EXCHANGE_DROPPED_WARNING = (
"http_exchange_ids were not stored: the proxy project could not be reached to verify "
"them. Attach them with update_vulnerability_report when the proxy responds again."
)
@ -234,8 +235,9 @@ async def _verify_http_exchange_ids(
"""Verify proxy exchange IDs against the current Caido project.
IDs the project does not know are rejected. When the proxy itself cannot be
queried the IDs are kept as given and a warning is returned instead, so a
proxy outage never blocks a finding from being filed.
queried the IDs are dropped and a warning is returned instead, so a proxy
outage never blocks a finding and unverified IDs are never recorded as
evidence.
"""
request_ids, errors = _normalize_http_exchange_ids(raw)
if request_ids is None or errors or not request_ids:
@ -248,7 +250,7 @@ async def _verify_http_exchange_ids(
"Could not verify HTTP exchange IDs against the current Caido project",
exc_info=True,
)
return request_ids, [], _HTTP_EXCHANGE_UNVERIFIED_WARNING
return None, [], _HTTP_EXCHANGE_DROPPED_WARNING
missing_ids = [request_id for request_id in request_ids if request_id not in existing_ids]
if missing_ids:
@ -1171,6 +1173,9 @@ async def create_vulnerability_report(
Omit only when the finding has no captured HTTP evidence (for
example a static-only code finding). Never invent IDs or drop
them to bypass a verification error; retry the capture instead.
If the result carries a ``warning`` that the IDs were not
stored, the finding is filed without them: attach them with
``update_vulnerability_report`` once the proxy responds.
Keep IDs out of ``evidence`` and all other report text.
**How ``fix_before`` / ``fix_after`` work**: they're used as

7
tests/test_reporting_fields.py
View file

@ -1462,7 +1462,7 @@ async def test_http_exchange_ids_must_exist_in_current_proxy_project(
assert warning is None
async def test_http_exchange_ids_are_kept_when_proxy_cannot_be_queried(
async def test_http_exchange_ids_are_dropped_when_proxy_cannot_be_queried(
monkeypatch: pytest.MonkeyPatch,
) -> None:
async def existing_request_ids(
@ -1478,10 +1478,11 @@ async def test_http_exchange_ids_are_kept_when_proxy_cannot_be_queried(
["1042", "1042", "1088"],
)
assert request_ids == ["1042", "1088"]
assert request_ids is None
assert errors == []
assert warning is not None
assert "unverified" in warning
assert "not stored" in warning
assert "update_vulnerability_report" in warning
async def test_create_reports_persistence_failure_as_tool_error(