Skip to content

GrantTrace v2.5.0

Choose a tag to compare

View all tags
@ysc070528 ysc070528 released this 04 Oct 10:30
v2.5.0
151bab4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Export SARIF 2.1.0 alongside HTML and JSON reports with --export-sarif. Only CONFIRMED BOLA / IDOR and Mass Assignment findings become SARIF results (GT-BOLA-001 / CWE-639 and GT-MASS-001 / CWE-915).
  • Use a workspace-local OpenAPI specification as a safe relative artifact location for GitHub Code Scanning. No source lines are invented; workspace-external specs never expose absolute local paths.
  • Copy safe cURL reproduction templates from confirmed HTML findings, using the tested URL and confirmed payload where safe, Visitor credential placeholders, POSIX quoting and offline clipboard fallback.
  • Follow clearer configuration onboarding: generate and review a draft, validate it, inspect an offline dry-run, then start with a read-only scan. Configuration formats remain unchanged.

Safety

  • Scans of users' APIs remain read-only by default. Active PATCH testing requires explicit --allow-write-tests opt-in and an explicit write allowlist.
  • Independent GET readback, original-state snapshots, rollback and rollback verification remain required. Failed recovery blocks subsequent writes.
  • BOLA / IDOR and Mass Assignment verdict semantics and the TLS / HTTP / redirect / proxy boundaries are unchanged.
  • No active POST / PUT testing or automated login / OAuth lifecycle is added.
  • SARIF, cURL and onboarding output retain credential minimization. cURL templates keep credential placeholders even when sensitive report evidence is enabled; onboarding omits configured resource values.
  • Validation and dry-run stay offline; dry-run sends zero requests. The bundled demo uses a disposable dynamic 127.0.0.1 server without user credentials or an external target.

Quality

  • 486 tests across Python 3.9 / 3.12 / 3.14.
  • Branch-aware coverage is 82.77%–82.78%, with the existing minimum 80% gate.
  • Blocking mypy: 0 errors in 18 source files. Ruff, Runtime dependency audit and CodeQL checks pass.
  • Installed-wheel validation runs outside the source checkout: read-only demo sends 0 PATCH requests; active demo verifies rollback, full database restoration and server shutdown.

Upgrade

GrantTrace v2.5.0 is available on PyPI:

python -m pip install --upgrade granttrace
granttrace --version
granttrace demo

PyPI: granttrace 2.5.0

Assets 5
Loading