From 618261aa6af7933434872905b050e9c3a036f7a0 Mon Sep 17 00:00:00 2001 From: Ahmed Allam Date: Wed, 9 Sep 2026 09:12:30 +0000 Subject: [PATCH] fix(reporting): drop unverified HTTP exchange IDs instead of storing them When the proxy lookup itself fails, the finding is still filed but the http_exchange_ids are omitted and the result carries a warning telling the agent to attach them with update_vulnerability_report once the proxy responds. Unverified IDs are never recorded as evidence. --- strix/tools/reporting/tool.py | 15 ++++++++++----- tests/test_reporting_fields.py | 7 ++++--- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/strix/tools/reporting/tool.py b/strix/tools/reporting/tool.py index 25ce269a..c490e47c 100644 --- a/strix/tools/reporting/tool.py +++ b/strix/tools/reporting/tool.py @@ -222,8 +222,9 @@ def _normalize_http_exchange_ids(raw: Any) -> tuple[list[str] | None, list[str]] return normalized, errors -_HTTP_EXCHANGE_UNVERIFIED_WARNING = ( - "http_exchange_ids were stored unverified: the proxy project could not be reached" +_HTTP_EXCHANGE_DROPPED_WARNING = ( + "http_exchange_ids were not stored: the proxy project could not be reached to verify " + "them. Attach them with update_vulnerability_report when the proxy responds again." ) @@ -234,8 +235,9 @@ async def _verify_http_exchange_ids( """Verify proxy exchange IDs against the current Caido project. IDs the project does not know are rejected. When the proxy itself cannot be - queried the IDs are kept as given and a warning is returned instead, so a - proxy outage never blocks a finding from being filed. + queried the IDs are dropped and a warning is returned instead, so a proxy + outage never blocks a finding and unverified IDs are never recorded as + evidence. """ request_ids, errors = _normalize_http_exchange_ids(raw) if request_ids is None or errors or not request_ids: @@ -248,7 +250,7 @@ async def _verify_http_exchange_ids( "Could not verify HTTP exchange IDs against the current Caido project", exc_info=True, ) - return request_ids, [], _HTTP_EXCHANGE_UNVERIFIED_WARNING + return None, [], _HTTP_EXCHANGE_DROPPED_WARNING missing_ids = [request_id for request_id in request_ids if request_id not in existing_ids] if missing_ids: @@ -1171,6 +1173,9 @@ async def create_vulnerability_report( Omit only when the finding has no captured HTTP evidence (for example a static-only code finding). Never invent IDs or drop them to bypass a verification error; retry the capture instead. + If the result carries a ``warning`` that the IDs were not + stored, the finding is filed without them: attach them with + ``update_vulnerability_report`` once the proxy responds. Keep IDs out of ``evidence`` and all other report text. **How ``fix_before`` / ``fix_after`` work**: they're used as diff --git a/tests/test_reporting_fields.py b/tests/test_reporting_fields.py index 30e0c28e..4a62a90d 100644 --- a/tests/test_reporting_fields.py +++ b/tests/test_reporting_fields.py @@ -1462,7 +1462,7 @@ async def test_http_exchange_ids_must_exist_in_current_proxy_project( assert warning is None -async def test_http_exchange_ids_are_kept_when_proxy_cannot_be_queried( +async def test_http_exchange_ids_are_dropped_when_proxy_cannot_be_queried( monkeypatch: pytest.MonkeyPatch, ) -> None: async def existing_request_ids( @@ -1478,10 +1478,11 @@ async def test_http_exchange_ids_are_kept_when_proxy_cannot_be_queried( ["1042", "1042", "1088"], ) - assert request_ids == ["1042", "1088"] + assert request_ids is None assert errors == [] assert warning is not None - assert "unverified" in warning + assert "not stored" in warning + assert "update_vulnerability_report" in warning async def test_create_reports_persistence_failure_as_tool_error(