Render a patch's vulnerability labels through one ui helper: scan, get and list each write the CVE-else-advisory rule, and their order, dedup and severity case drifted

Aperta
  • Qualcosa non va?
#1,880 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
58/100
Tipo di issue
Refactoring
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
cli

Direzione di ricerca

Read ui/mod.rs and the referenced helpers in scan/render.rs, get.rs, and list.rs to trace the current label, ordering, deduplication, and severity behavior. Update the render byte tests in scan/render.rs and tests/cli/list_render.rs, and add a unit test for a CVE shared by two advisories. Done means all three commands use the shared UI helpers and the acceptance criteria pass.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

agent:triaged arch-audit priority:p3 refactor

[agent] Filed by the scheduled architecture audit (audit-cli-tests). Register: register comment.

Kind: refactor. Register ID: T28 (its JSON sibling is T02, #1836; its severity sibling is T10).

Problem

The human label of a vulnerability follows one rule: its CVE ids sorted, otherwise the advisory id. That rule is written four times:

  • scan: scan/render.rs vuln_label L385-L393,`` sorted worst-severity-first by sorted_vulns L371-L381;
  • get: get.rs L372-L382, the same body;
  • get again: vuln_labels L222-L236, which flattens and dedups;
  • list: list.rs L284-L288, which prints the advisory id with its CVEs in parentheses, unsorted, and sanitized.

The copies have drifted (verified by reading):

  • Order. scan orders the Fixes: list by severity; get orders it by label.
  • Dedup. scan doesn't dedup, so a CVE shared by two advisories prints twice; get dedups.
  • Severity label. get prints it uppercased (get.rs L289). scan's preview prints the raw API label through ui::severity, which passes unknown labels through unchanged. scan's policy line prints core's canonical severity_name, so "medium" appears where the API said "moderate" (policy.rs L752).
  • Sanitizing. Only list filters the API text (T23).

Proposed change

  • Add ui::vuln_labels(&HashMap<String, VulnerabilityResponse>) -> Vec<String>: CVEs else the id, deduped, in one documented order.
  • Add one ui::severity_label(&str) that uses core's severity_name.
  • scan, get and list call these helpers. Delete render::vuln_label/sorted_vulns, get's two copies and list's inline format.

Size

4 files (ui/mod.rs, scan/render.rs, get.rs, list.rs). Roughly −50 / +25.

Acceptance criteria

  • The render byte tests in scan/render.rs and tests/cli/list_render.rs are updated deliberately, once, to the chosen order and case.
  • A new unit test shows a CVE shared by two advisories printed once.
  • No CLI file keeps its own CVE-else-id closure.
Lingua principale
Rust
Stelle
8
Fork
2
Merge medio
19h 24m
PR unite (30g)
669

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di SocketDev/socket-patch

Tutte le issue di SocketDev/socket-patch

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.