From cdefefbfd88eee55ba1ec6e158daaf864f901d02 Mon Sep 17 00:00:00 2001 From: Alexandre Daubois Date: Mon, 2 Nov 2026 14:25:20 +0100 Subject: [PATCH] Look first at a located medium report too, and keep libmbfl as php-src's own code --- docs/setup.md | 2 +- internal/board/board.go | 2 +- internal/board/board_test.go | 4 +++- skill/packs/php-src.md | 2 +- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/setup.md b/docs/setup.md index ba973f8..f3dd598 100644 --- a/docs/setup.md +++ b/docs/setup.md @@ -97,7 +97,7 @@ Then set `project` to `your-org/NUMBER`. When the project is public, or a field The code sets `Priority`: -- `Look first` for a critical or high severity, a faulty statement found in the repository and no policy exclusion, +- `Look first` for a critical, high or medium severity, a faulty statement found in the repository and no policy exclusion, - `When possible` otherwise, - `Duplicate` behind the oldest high-confidence exact duplicate the comment shows, which `Duplicate of` names, - `Analysis pending` while tamis triages again an advisory it commented before the board, `Analysis failed, retrying` after a failed attempt with another to come, and `Analysis failed` once tamis gives up. The draft body then explains the status instead of holding the triage comment. diff --git a/internal/board/board.go b/internal/board/board.go index 4c1b6eb..3cbf395 100644 --- a/internal/board/board.go +++ b/internal/board/board.go @@ -376,7 +376,7 @@ func (t Triage) Priority() string { switch { case t.DuplicateOf != "": return Duplicate - case t.Severity != "critical" && t.Severity != "high" || t.Excluded || !t.Located: + case t.Severity != "critical" && t.Severity != "high" && t.Severity != "medium" || t.Excluded || !t.Located: return WhenPossible default: return LookFirst diff --git a/internal/board/board_test.go b/internal/board/board_test.go index e11a4ef..07c538a 100644 --- a/internal/board/board_test.go +++ b/internal/board/board_test.go @@ -54,7 +54,9 @@ func TestTriageOf(t *testing.T) { "severe": {report.Report{Severity: "high", Located: true}, LookFirst, ""}, "critical": {report.Report{Severity: "critical", Located: true}, LookFirst, ""}, "proof of concept": {report.Report{Severity: "high", Located: true, CodeReferences: []report.CodeReference{{Found: true}, {Path: "trigger.py"}}}, LookFirst, ""}, - "medium": {report.Report{Severity: "medium", Located: true}, WhenPossible, ""}, + "medium": {report.Report{Severity: "medium", Located: true}, LookFirst, ""}, + "low": {report.Report{Severity: "low", Located: true}, WhenPossible, ""}, + "excluded medium": {report.Report{Severity: "medium", Located: true, PolicyExclusions: []report.PolicyPoint{{Point: "p"}}}, WhenPossible, ""}, "no severity": {report.Report{Located: true}, WhenPossible, ""}, "not located": {report.Report{Severity: "high", CodeReferences: []report.CodeReference{{Found: true}}}, WhenPossible, ""}, "policy exclusion": {report.Report{Severity: "critical", Located: true, PolicyExclusions: []report.PolicyPoint{{Point: "p"}}}, WhenPossible, ""}, diff --git a/skill/packs/php-src.md b/skill/packs/php-src.md index 974c372..4ce42a7 100644 --- a/skill/packs/php-src.md +++ b/skill/packs/php-src.md @@ -19,7 +19,7 @@ A memory violation that needs malicious error handlers, destructors, `__toString - A crash or assertion that only fires on a debug build is a bug, not a security issue. - `run-tests.php --asan` sets `USE_ZEND_ALLOC=0`, so a report detected under AddressSanitizer with it is a standard reproduction. Only a bug that the Zend allocator prevents, and that therefore needs `USE_ZEND_ALLOC=0` to happen at all, falls under the non-standard environment variables. -- php-src bundles libraries from other projects, such as lexbor in `ext/lexbor/lexbor`, libgd in `ext/gd/libgd`, libmagic in `ext/fileinfo/libmagic`, uriparser in `ext/uri/uriparser`, PCRE2 in `ext/pcre/pcre2lib` and timelib in `ext/date/lib`. A bug there is upstream: name the library and check that php-src reaches the faulty code at all. +- php-src bundles libraries from other projects, such as lexbor in `ext/lexbor/lexbor`, libgd in `ext/gd/libgd`, libmagic in `ext/fileinfo/libmagic`, uriparser in `ext/uri/uriparser`, PCRE2 in `ext/pcre/pcre2lib` and timelib in `ext/date/lib`. libmbfl in `ext/mbstring/libmbfl` is php-src's own code, since php-src maintains it in its tree. A bug in a bundled library is upstream: name the library and check that php-src reaches the faulty code at all. ### Calibration