forkless/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-08-23 19:32:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

reporting: drop per-metric contextual CVSS reasoning, keep the summary

Browse Source
This commit is contained in:
Ahmed Allam
2026-08-17 13:03:41 +03:00
committed by Ahmed Allam
parent 310f310e28
commit 99e2d5d826
3 changed files with 1 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_reporting_fields.py
+1 -3
View File
@@ -884,7 +884,6 @@ def test_dep_tool_exposes_contextual_cvss_params() -> None:
for field in (
"contextual_cvss_metrics",
"contextual_cvss_reasoning",
"contextual_cvss_metric_reasoning",
):
assert field in dep_props
assert "source-to-sink" in dep_props["contextual_cvss_metrics"]["description"].lower()
@@ -914,13 +913,12 @@ async def test_dependency_report_keeps_only_valid_contextual_metrics(
manifest_path="package-lock.json",
contextual_cvss_metrics={"MAC": "H", "MC": "L", "AV": "N", "MPR": "Z"},
contextual_cvss_reasoning="Only scripts/import.py reaches the sink.",
contextual_cvss_metric_reasoning={"MAC": "Needs a build flag.", "MPR": "dropped"},
)
assert result["success"] is True, result
metadata = report_state.vulnerability_reports[0]["dependency_metadata"]
assert metadata["contextual_cvss_metrics"] == {"MAC": "H", "MC": "L"}
assert metadata["contextual_cvss_reasoning"] == "Only scripts/import.py reaches the sink."
assert metadata["contextual_cvss_metric_reasoning"] == {"MAC": "Needs a build flag."}
assert "contextual_cvss_metric_reasoning" not in metadata
@pytest.mark.asyncio