fix: preserve findings with list severity conditions - #184
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 68e21719bf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| and all( | ||
| isinstance(condition, str) and condition.strip() | ||
| for condition in change_conditions |
There was a problem hiding this comment.
When an array entry is a JSON string containing an unpaired UTF-16 surrogate such as "\ud800", this predicate accepts it because it is a nonblank str, and the list is normalized instead of rejected. The later document-wide _require_safe_json_value call then raises outside the per-finding recovery handler, causing the entire scan completion to fail rather than discarding the malformed finding and marking coverage partial. Validate each condition with _require_safe_json_string while still inside this finding's try block.
Useful? React with 👍 / 👎.
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
1 participant
Summary
attack_path.change_conditionsto the schema-requiredseverity.changeConditionsstring.Why
Attack-path analysis can naturally emit several severity-change conditions as an array, while the canonical findings schema accepts only a non-empty string. Before this change, an otherwise valid finding with that producer shape was discarded during completion. If every finding had the same shape, the finished scan incorrectly reported zero findings and downgraded complete coverage to partial.
Recovery now joins valid condition entries into one prose string before validation, preserves every independently validated finding, records an explicit normalization warning, and retains complete coverage. Invalid arrays still follow the existing strict rejection path.
Validation
pnpm run types.pnpm run format.git diff --check.