mirror of
https://github.com/usestrix/strix.git
synced 2026-10-16 04:28:23 +00:00
525723c670
`_class_keyword` scans `_VULN_CLASS_KEYWORDS` in order and returns the first substring match, so a more specific class must precede any class whose name it contains — an invariant the surrounding comment spells out. "denial of service" was listed before "regex denial of service", so any finding titled "...Regex Denial of Service..." resolved to the generic "denial of service" class instead. For locationless (synthetic-anchored) findings this collapses the `synth_class` component of `_primary_fingerprint`, so a ReDoS finding and a generic DoS finding on the same CWE get the *same* `partialFingerprints.primaryLocationLineHash` — and a SARIF consumer such as GitHub code-scanning silently dedups one genuine finding away. Reorder so "regex denial of service" precedes "denial of service", and add regression tests at both the `_class_keyword` and `write_sarif` levels (the latter asserts the two findings no longer share a fingerprint). |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| test_config_loader.py | ||
| test_cost_tracking.py | ||
| test_execution.py | ||
| test_hooks.py | ||
| test_inputs.py | ||
| test_local_sources.py | ||
| test_notes.py | ||
| test_runner_rate_limit.py | ||
| test_sarif.py | ||
| test_session_entries.py | ||
| test_state_repo_context.py | ||