[python] accept multiple cve_ids in SCA reachability tests#6985
Conversation
Make cve_id a list so the SCA reachability assertions match either the CVE identifier or the GHSA identifier emitted by the tracer, providing retrocompatibility across tracer versions. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a6e84eb6f9
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| _LANG_CONFIG: dict[str, dict[str, Any]] = { | ||
| "python": { | ||
| "cve_id": "CVE-2024-35195", | ||
| "cve_id": ["CVE-2024-35195", "GHSA-652x-xj99-gmcc"], |
There was a problem hiding this comment.
The newly accepted ID GHSA-652x-xj99-gmcc is not an alias of CVE-2024-35195; it refers to a different Requests advisory, so this change weakens the test oracle from “did we report the targeted CVE?” to “did we report either of two different advisories?”. Because the exercised endpoint is explicitly the CVE-2024-35195 target (utils/build/docker/python/flask/app.py), the test can now pass even when the tracer reports the wrong vulnerability identifier, masking real regressions in reachability matching.
Useful? React with 👍 / 👎.
2 participants
Summary
cve_idintests/appsec/test_sca_reachability.pya list so the assertions accept either the CVE id or the GHSA id emitted by the tracer.CVE-2024-35195vsGHSA-652x-xj99-gmcc)._get_dependency_cve_metadatanow matches viavalue.get("id") in cve_ids.Related PR
Test plan
runtime_sca_reachabilityscenario against Python tracer and passesCVE-2024-35195andGHSA-652x-xj99-gmccidentifiers are accepted🤖 Generated with Claude Code