Skip to content

Look first at a located medium report too, and keep libmbfl as php-src's own code #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alexandre-daubois merged 1 commit into from
Nov 2, 2026
Merged

Look first at a located medium report too, and keep libmbfl as php-src's own code #42

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ Then set `project` to `your-org/NUMBER`. When the project is public, or a field

The code sets `Priority`:

- `Look first` for a critical or high severity, a faulty statement found in the repository and no policy exclusion,
- `Look first` for a critical, high or medium severity, a faulty statement found in the repository and no policy exclusion,
- `When possible` otherwise,
- `Duplicate` behind the oldest high-confidence exact duplicate the comment shows, which `Duplicate of` names,
- `Analysis pending` while tamis triages again an advisory it commented before the board, `Analysis failed, retrying` after a failed attempt with another to come, and `Analysis failed` once tamis gives up. The draft body then explains the status instead of holding the triage comment.
Expand Down
2 changes: 1 addition & 1 deletion internal/board/board.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -376,7 +376,7 @@ func (t Triage) Priority() string {
switch {
case t.DuplicateOf != "":
return Duplicate
case t.Severity != "critical" && t.Severity != "high" || t.Excluded || !t.Located:
case t.Severity != "critical" && t.Severity != "high" && t.Severity != "medium" || t.Excluded || !t.Located:
return WhenPossible
default:
return LookFirst
Expand Down
4 changes: 3 additions & 1 deletion internal/board/board_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,9 @@ func TestTriageOf(t *testing.T) {
"severe": {report.Report{Severity: "high", Located: true}, LookFirst, ""},
"critical": {report.Report{Severity: "critical", Located: true}, LookFirst, ""},
"proof of concept": {report.Report{Severity: "high", Located: true, CodeReferences: []report.CodeReference{{Found: true}, {Path: "trigger.py"}}}, LookFirst, ""},
"medium": {report.Report{Severity: "medium", Located: true}, WhenPossible, ""},
"medium": {report.Report{Severity: "medium", Located: true}, LookFirst, ""},
"low": {report.Report{Severity: "low", Located: true}, WhenPossible, ""},
"excluded medium": {report.Report{Severity: "medium", Located: true, PolicyExclusions: []report.PolicyPoint{{Point: "p"}}}, WhenPossible, ""},
"no severity": {report.Report{Located: true}, WhenPossible, ""},
"not located": {report.Report{Severity: "high", CodeReferences: []report.CodeReference{{Found: true}}}, WhenPossible, ""},
"policy exclusion": {report.Report{Severity: "critical", Located: true, PolicyExclusions: []report.PolicyPoint{{Point: "p"}}}, WhenPossible, ""},
Expand Down
2 changes: 1 addition & 1 deletion skill/packs/php-src.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ A memory violation that needs malicious error handlers, destructors, `__toString

- A crash or assertion that only fires on a debug build is a bug, not a security issue.
- `run-tests.php --asan` sets `USE_ZEND_ALLOC=0`, so a report detected under AddressSanitizer with it is a standard reproduction. Only a bug that the Zend allocator prevents, and that therefore needs `USE_ZEND_ALLOC=0` to happen at all, falls under the non-standard environment variables.
- php-src bundles libraries from other projects, such as lexbor in `ext/lexbor/lexbor`, libgd in `ext/gd/libgd`, libmagic in `ext/fileinfo/libmagic`, uriparser in `ext/uri/uriparser`, PCRE2 in `ext/pcre/pcre2lib` and timelib in `ext/date/lib`. A bug there is upstream: name the library and check that php-src reaches the faulty code at all.
- php-src bundles libraries from other projects, such as lexbor in `ext/lexbor/lexbor`, libgd in `ext/gd/libgd`, libmagic in `ext/fileinfo/libmagic`, uriparser in `ext/uri/uriparser`, PCRE2 in `ext/pcre/pcre2lib` and timelib in `ext/date/lib`. libmbfl in `ext/mbstring/libmbfl` is php-src's own code, since php-src maintains it in its tree. A bug in a bundled library is upstream: name the library and check that php-src reaches the faulty code at all.

### Calibration

Expand Down
Loading