forkless/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-08-25 04:12:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(reporting): require contextual CVSS and usage evidence on dependency reports

Browse Source
This commit is contained in:
Ahmed Allam
2026-08-17 14:35:21 +03:00
committed by Ahmed Allam
parent 918442dbc8
commit a46a60cf6a
3 changed files with 133 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_reporting_fields.py
+72 -17
View File
@@ -37,6 +37,24 @@ _CVSS = {
}
_DEP_CONTEXT = {
"attack_vector": "N",
"attack_complexity": "L",
"privileges_required": "N",
"user_interaction": "N",
"scope": "U",
"confidentiality": "N",
"integrity": "N",
"availability": "H",
}
_DEP_CONTEXT_VECTOR = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
_DEP_EVIDENCE = "src/render.ts:14 imports the package."
_DEP_REASONING = "Only scripts/import.py reaches the sink, so the impact is availability only."
@pytest.fixture
def report_state(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> ReportState:
monkeypatch.chdir(tmp_path)
@@ -147,13 +165,17 @@ async def test_dependency_report_sets_class_and_metadata(report_state: ReportSta
advisory_cvss=7.2,
technical_analysis=None,
fix_effort="trivial",
reachability="imported",
reachability_evidence=_DEP_EVIDENCE,
contextual_cvss_breakdown=_DEP_CONTEXT,
contextual_cvss_reasoning=_DEP_REASONING,
)
assert result["success"] is True
report = report_state.vulnerability_reports[0]
assert report["finding_class"] == "dependency_cve"
assert report["cve"] == "CVE-2021-23337"
assert report["severity"] == "high"
assert report["evidence"] == (
assert report["evidence"].startswith(
"**Advisory evidence:** `CVE-2021-23337` applies to `lodash` "
"at installed version `4.17.20`. The advisory is fixed in `4.17.21`."
)
@@ -164,6 +186,12 @@ async def test_dependency_report_sets_class_and_metadata(report_state: ReportSta
"package_ecosystem": "npm",
"manifest_path": "package-lock.json",
"fixed_version": "4.17.21",
"reachability": "imported",
"reachability_evidence": _DEP_EVIDENCE,
"contextual_cvss_breakdown": _DEP_CONTEXT,
"contextual_cvss_score": pytest.approx(7.5, abs=0.05),
"contextual_cvss_vector": _DEP_CONTEXT_VECTOR,
"contextual_cvss_reasoning": _DEP_REASONING,
}
@@ -187,6 +215,10 @@ async def test_dependency_report_records_transitive_chain(report_state: ReportSt
fix_effort="trivial",
introduced_by="express@4.18.1",
dependency_path="express@4.18.1 > body-parser@1.20.0 > qs@6.10.2",
reachability="imported",
reachability_evidence=_DEP_EVIDENCE,
contextual_cvss_breakdown=_DEP_CONTEXT,
contextual_cvss_reasoning=_DEP_REASONING,
)
assert result["success"] is True
report = report_state.vulnerability_reports[0]
@@ -225,6 +257,10 @@ async def test_dependency_report_omits_blank_chain_fields(report_state: ReportSt
fix_effort="trivial",
introduced_by=" ",
dependency_path=None,
reachability="imported",
reachability_evidence=_DEP_EVIDENCE,
contextual_cvss_breakdown=_DEP_CONTEXT,
contextual_cvss_reasoning=_DEP_REASONING,
)
assert result["success"] is True
report = report_state.vulnerability_reports[0]
@@ -232,7 +268,7 @@ async def test_dependency_report_omits_blank_chain_fields(report_state: ReportSt
assert "dependency_path" not in report["dependency_metadata"]
async def test_dependency_report_with_zero_cvss_remains_low_severity(
async def test_dependency_report_with_no_contextual_impact_is_info(
report_state: ReportState,
) -> None:
result = await _do_create_dependency(
@@ -252,12 +288,16 @@ async def test_dependency_report_with_zero_cvss_remains_low_severity(
advisory_cvss=0.0,
technical_analysis=None,
fix_effort="low",
reachability="not_imported",
reachability_evidence="No file imports the package.",
contextual_cvss_breakdown={**_DEP_CONTEXT, "availability": "N"},
contextual_cvss_reasoning="No application code imports the package.",
)
assert result["success"] is True
assert result["severity"] == "low"
assert result["severity"] == "info"
report = report_state.vulnerability_reports[0]
assert report["severity"] == "low"
assert report["severity"] == "info"
assert report["cvss"] == 0.0
@@ -281,6 +321,8 @@ async def test_dependency_report_records_reachability(report_state: ReportState)
fix_effort="low",
reachability="vulnerable_symbol_used",
reachability_evidence="src/render.ts:14 calls `_.template()`.",
contextual_cvss_breakdown=_DEP_CONTEXT,
contextual_cvss_reasoning=_DEP_REASONING,
)
assert result["success"] is True
@@ -292,7 +334,8 @@ async def test_dependency_report_records_reachability(report_state: ReportState)
)
assert "**Usage analysis:**" in report["evidence"]
assert "not a proof of exploitability or of safety" in report["evidence"]
# The level must never influence the rating — that stays advisory_cvss only.
# The level must never influence the rating — that comes from the contextual
# breakdown, or from advisory_cvss when no breakdown applies.
assert report["severity"] == "high"
@@ -353,7 +396,7 @@ async def test_dependency_report_rejects_unknown_reachability_level(
assert not report_state.vulnerability_reports
async def test_dependency_report_omits_unknown_reachability(report_state: ReportState) -> None:
async def test_dependency_report_records_unknown_reachability(report_state: ReportState) -> None:
result = await _do_create_dependency(
title="CVE-2024-0001 in sample 1.0.0",
description="Published advisory affects the pinned version.",
@@ -371,12 +414,15 @@ async def test_dependency_report_omits_unknown_reachability(report_state: Report
advisory_cvss=5.0,
technical_analysis=None,
fix_effort="low",
reachability_evidence="Grep for the package found no import.",
contextual_cvss_breakdown=_DEP_CONTEXT,
contextual_cvss_reasoning=_DEP_REASONING,
)
assert result["success"] is True, result
metadata = report_state.vulnerability_reports[0]["dependency_metadata"]
assert "reachability" not in metadata
assert "reachability_evidence" not in metadata
assert metadata["reachability"] == "unknown"
assert metadata["reachability_evidence"] == "Grep for the package found no import."
async def test_dependency_report_requires_advisory_cvss(report_state: ReportState) -> None:
@@ -453,6 +499,10 @@ async def test_dependency_report_dedupe_candidate_includes_dependency_metadata(
advisory_cvss=0.0,
technical_analysis=None,
fix_effort="low",
reachability="imported",
reachability_evidence=_DEP_EVIDENCE,
contextual_cvss_breakdown=_DEP_CONTEXT,
contextual_cvss_reasoning=_DEP_REASONING,
)
assert result["success"] is True
@@ -468,6 +518,12 @@ async def test_dependency_report_dedupe_candidate_includes_dependency_metadata(
"package_ecosystem": "npm",
"manifest_path": "package-lock.json",
"fixed_version": "1.0.1",
"reachability": "imported",
"reachability_evidence": _DEP_EVIDENCE,
"contextual_cvss_breakdown": _DEP_CONTEXT,
"contextual_cvss_score": pytest.approx(7.5, abs=0.05),
"contextual_cvss_vector": _DEP_CONTEXT_VECTOR,
"contextual_cvss_reasoning": _DEP_REASONING,
},
"technical_analysis": None,
}
@@ -926,6 +982,8 @@ async def test_dependency_report_computes_contextual_cvss(
cwe="CWE-94",
fix_effort="trivial",
manifest_path="package-lock.json",
reachability="vulnerable_symbol_used",
reachability_evidence="scripts/import.py:88 calls `_.template()`.",
contextual_cvss_breakdown=_CONTEXTUAL_BREAKDOWN,
contextual_cvss_reasoning="Only scripts/import.py reaches the sink.",
)
@@ -944,7 +1002,7 @@ async def test_dependency_report_computes_contextual_cvss(
@pytest.mark.asyncio
async def test_dependency_report_rates_from_advisory_without_contextual(
async def test_dependency_report_requires_contextual_breakdown(
report_state: ReportState,
) -> None:
result = await _do_create_dependency(
@@ -964,15 +1022,12 @@ async def test_dependency_report_rates_from_advisory_without_contextual(
cwe="CWE-94",
fix_effort="trivial",
manifest_path="package-lock.json",
reachability="imported",
reachability_evidence=_DEP_EVIDENCE,
)
assert result["success"] is True, result
report = report_state.vulnerability_reports[0]
assert report["cvss"] == 7.2
assert report["severity"] == "high"
metadata = report["dependency_metadata"]
assert metadata["advisory_cvss"] == 7.2
assert "contextual_cvss_breakdown" not in metadata
assert "contextual_cvss_score" not in metadata
assert result["success"] is False
assert any("contextual_cvss_breakdown is required" in error for error in result["errors"])
assert report_state.vulnerability_reports == []
@pytest.mark.asyncio