mirror of
https://github.com/usestrix/strix.git
synced 2026-10-16 04:28:23 +00:00
c0cc1a82c9
Resolve the "changes required" review on the CSPT PR: - SARIF: add a shared `_class_token` helper preferring the structured `finding_class` over a title keyword, used in BOTH `_class_fingerprint` and the synthetic branch of `_primary_fingerprint`, so a locationless CSPT finding no longer collapses onto a server-side traversal's primary fingerprint. Require CSPT reports to carry a discriminator (endpoint/method or a code location) so multiple locationless CSPT findings stay distinct. - Dedup: include `finding_class` in the candidate and in `_prepare_report_for_comparison`; teach the judge that a differing finding_class under a shared CWE is not a duplicate. - Skill/runbook: correct the %2f guidance — the browser does not decode `%2f` during normalization; only literal-slash dot-segments traverse, and `%2f`-based traversal is an app-layer decode. Switch fragment examples to raw `../../`. Split confirmation into a CSPT *primitive* (path steered) vs. an *impact* level (credentials/reach/chain) to stop false negatives. Fix non-loadable skill names to the underscore keys (`client_side_path_traversal`, `path_traversal_lfi_rfi`), including the skill frontmatter. - Fixtures: drive `positive_normalized` from the fragment so it serves under a plain static server. - Tests: add `test_cspt_browser_capture.py` — headless Chromium (Playwright) + a local request-capture server asserting the exact outbound path per positive and no traversal per negative, plus WHATWG ground-truth tests proving raw `../../` and `%2e%2e/` collapse while un-decoded `..%2f..%2f` does not. Add `test_cspt_dataflow.py` — a deterministic taint tracker that fails when a fixture's source and sink are present but unconnected. Add primary-fingerprint and dedup regressions. Add playwright to dev deps. - Docs: list the CSPT skill in the public skills catalog. Known follow-up (not blocking): `uv.lock` is left at format revision 2; run `uv lock` with the repo's pinned uv to add the playwright dev dep without the unrelated revision-2->3 rewrite. There is no test CI workflow yet; when one is added it should run `uv run playwright install chromium` so the browser tests execute (they importorskip otherwise). |
||
|---|---|---|
| .. | ||
| fixtures/cspt | ||
| __init__.py | ||
| test_agent_factory_shell.py | ||
| test_agent_tool_registration.py | ||
| test_cli_target_list.py | ||
| test_config_loader.py | ||
| test_cost_tracking.py | ||
| test_cspt_browser_capture.py | ||
| test_cspt_dataflow.py | ||
| test_cspt_skill.py | ||
| test_docker_client_delete.py | ||
| test_execution.py | ||
| test_hooks.py | ||
| test_inputs.py | ||
| test_local_dir_staging.py | ||
| test_local_sources.py | ||
| test_model_retry.py | ||
| test_models.py | ||
| test_notes.py | ||
| test_optional_deps.py | ||
| test_provider_hints.py | ||
| test_proxy_client.py | ||
| test_proxy_renderer.py | ||
| test_report_writer.py | ||
| test_reporting_fields.py | ||
| test_runner_rate_limit.py | ||
| test_runner_root_prompt.py | ||
| test_sarif.py | ||
| test_sarif_stride.py | ||
| test_session_entries.py | ||
| test_skill_dir_extension.py | ||
| test_state_repo_context.py | ||