fanhuadesenlinnn/strix
1
0
Fork 0
mirror of https://hubproxy.babadafafafafa.cn/https://github.com/usestrix/strix.git synced 2026-09-20 08:03:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(reporting): move the git blame hint to the end of the tool description

Browse Source
This commit is contained in:
Ahmed Allam
2026-09-18 18:32:38 +00:00
committed by Ahmed Allam
parent 77a0cf839b
commit 355a8bb437
2 changed files with 14 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
strix/tools/reporting/tool.py
View File

@@ -1123,12 +1123,7 @@ async def create_vulnerability_report(
but unverified follow-on risks separate; do not use them to but unverified follow-on risks separate; do not use them to
set CVSS metrics. set CVSS metrics.
target: Affected URL / domain / repository. target: Affected URL / domain / repository.
technical_analysis: The mechanism and root cause. For code findings, technical_analysis: The mechanism and root cause.
if the checkout has git history, a quick ``git blame`` (quote the
paths) on the vulnerable line is worth weaving into the analysis:
who last touched it, when, and in which commit — as part of the
prose, not a separate section. Skip it if the line is uncommitted
or the command fails.
poc_description: Step-by-step reproduction (steps only, no code). poc_description: Step-by-step reproduction (steps only, no code).
poc_script_code: Working PoC (Python preferred). poc_script_code: Working PoC (Python preferred).
remediation_steps: Specific, actionable fix (prose, no code). remediation_steps: Specific, actionable fix (prose, no code).
@@ -1328,6 +1323,12 @@ async def create_vulnerability_report(
A restrictive CSP that blocks inline script execution would A restrictive CSP that blocks inline script execution would
reduce impact and lower the severity. reduce impact and lower the severity.
fix_effort: "low" fix_effort: "low"
Nice to have: for code findings, if the checkout has git history, a quick
``git blame`` (quote the paths) on the vulnerable line is worth weaving into
``technical_analysis`` — who last touched it, when, and in which commit, as
part of the prose, not a separate section. Skip it if the line is
uncommitted or the command fails.
""" """
( (
http_exchange_ids, http_exchange_ids,

13
tests/test_reporting_fields.py
View File

@@ -1089,12 +1089,13 @@ def test_tool_descriptions_include_formatting_guidance() -> None:
assert "reachab" in dep_desc.lower() assert "reachab" in dep_desc.lower()
def test_git_blame_hint_lives_only_in_technical_analysis() -> None: def test_git_blame_hint_is_a_trailing_note() -> None:
summary, _, args = create_vulnerability_report.description.partition("Args:") desc = create_vulnerability_report.description
assert "blame" not in summary assert desc.count("blame") == 1
field = args.split("technical_analysis:", 1)[1].split("poc_description:", 1)[0] tail = desc[desc.index("Nice to have:") :]
assert "git blame" in field assert "git blame" in tail
assert "not a separate section" in field assert "technical_analysis" in tail
assert "Example" not in tail
assert "blame" not in update_vulnerability_report.description assert "blame" not in update_vulnerability_report.description