Skip to content

Redact host paths and bound structured logging - #10

Draft
seifreed wants to merge 30 commits into
mainfrom
fix/redact-sarif-host-paths
Draft

seifreed wants to merge 30 commits into
mainfrom
fix/redact-sarif-host-paths

Conversation

@seifreed

@seifreed seifreed commented Nov 7, 2026

Copy link
Copy Markdown
Owner

Changes

  • Remove the analyst's current working directory from SARIF reports and reduce artifact URIs to POSIX/Windows basenames.
  • Bound mapping and sequence traversal during structured log normalization while preserving truncation counts.
  • Raise the declared MessagePack minimum to 1.2.3, the patched release for CVE-2026-114613.

Verification

  • pytest -W error on Python 3.12 with project requirements: 6457 passed, 232 skipped; coverage 82.02% (80% required).
  • Black, Ruff, mypy, Bandit, and pip-audit -r requirements.txt: passed.
  • Targeted logging tests: 20 passed; SARIF tests: 36 passed.

The main-branch differential workflow for the prior head was cancelled at its six-hour timeout in one shard. This PR's CI will validate the proposed head.

Add SARIF regression coverage for POSIX and Windows input paths and omission of the host source root. See test_sarif_artifacts_exclude_parent_paths and test_sarif_report_omits_host_source_root.
Raise the msgpack floor in both dependency manifests to 1.2.3, the first patched version for CVE-2026-114613. Verified with pip-audit -r requirements.txt.
Iterate only the configured collection prefix while normalizing structured log values, preserving accurate truncation counts. Covered by test_safe_value_bounds_mapping_iteration and test_safe_value_bounds_sequence_iteration.
Cover nested mapping keys and Path values with test_safe_value_redacts_secret_assignments_in_mapping_keys and test_safe_value_sanitizes_path_basename.
Cover CLI result events and enhanced analyzer failures with test_cli_direct_analyze_and_functions, test_cli_diff_logs_operation_completion, test_cli_validate_logs_runtime_outcome, test_cfo_simplification_failure_emits_structured_warning, and test_detect_only_analysis_logs_correlated_completion.
Cover the shared identifier with test_cli_enhanced_analysis_reuses_initialization_correlation_id.
Cover the inherited debug level with test_cli_honors_environment_debug_log_level.
Cover debug-only mutation details, safe assembly failures, and compound secret redaction with test_pattern_substitution_instruction_details_are_debug_only, test_instruction_substitution_details_are_debug_only, test_syntia_expression_diagnostic_is_debug_only, and test_binary_rewriter_assembly_error_keeps_sample_in_debug_only.
Bootstrap the declared requirements before the release checker imports campaign and emulator modules. Cover the required validation order with tests/unit/test_release_workflow_contract.py.
Cover the JUnit skip gate in tests/unit/test_critical_skip_gate.py.
Cover the timeout setting in tests/unit/test_unit_test_job_timeout_contract.py.
Cover the Ubuntu toolchain requirement with test_ci_toolchain_contract.
Regression coverage: test_unicorn_is_unconditionally_installed_by_test_extras.
Regression coverage: test_block_reordering_pe_target_is_skipped_without_writes verifies warning and byte preservation.
Keep forced fallthrough successors adjacent while shuffling independent block groups. Cover the layout contract with test_draw_new_order_keeps_fallthrough_chain_adjacent, test_draw_new_order_shuffles_independent_groups, and test_draw_new_order_retains_every_block.
Generate fallthrough-chain partitions and verify entry pinning, block retention, and successor adjacency with test_block_reordering_order_preserves_fallthrough_chains.
The release ledger now links the exact commit and successful 15-job workflow. Verified with scripts/check_release_contract.py.
The release ledger now reflects the installed application and the real fixture probe result. Verified with scripts/check_release_contract.py.
Cover the distinction in test_review_packet_records_approval_without_claiming_independence.
Cover the attestation and resolved support-matrix contract with test_independent_review_passes_published_artifacts, test_independent_review_rejects_malformed_signoff_record, and test_support_matrix_names_resolved_vm_resistance_evidence_with_signoff.
Update the release ledger with the successful 15-job run for 97b0d05. Verified with scripts/check_release_contract.py.
Test: test_windows_radare2_workflows_use_bounded_verified_retries.
Test: test_release_blockers_track_open_changes_md_gaps.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant