Serialize patch vulnerabilities through one helper; get's selectionRequired options[] are unsorted and drop description
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
Start with crates/socket-patch-cli/src/commands/agent_download.rs, list.rs, get.rs, and json_envelope.rs; compare the three vulnerability serializers and inspect select_json_mode_multi_free_options_serialize_vulnerabilities in get.rs. Run that test, then update it to assert that options contain vulnerabilities sorted by id with descriptions; confirm the other JSON outputs stay unchanged except for any deliberate severity field addition.
由索引模型根據 Issue 內容生成。
描述
[agent] Filed by the scheduled architecture audit (audit-cli-tests). Register: register comment.
Kind: refactor (with a small output fix). Register ID: T02.
Problem
The per-vulnerability JSON object {id, cves, severity, summary, description} is built by hand in three places, and the copies have drifted:
agent_download::patch_event_metadataL119-L141 includesdescriptionand sorts by id. Its comment notes that "HashMap iteration is otherwise nondeterministic and consumers diff this output".list.rsL172-L192 builds the same shape from aPatchRecord, sorted and withdescription, but it omits the top-levelseveritythatpatch_event_metadataemits.get.rsL767-L790, theselectionRequiredoptions[], iteratesp.vulnerabilities(aHashMap) unsorted and omitsdescription.
So get --json <CVE> with several free options lists each option's vulnerabilities in a different order from run to run. The test that claims to cover this, select_json_mode_multi_free_options_serialize_vulnerabilities (get.rs L4898), only asserts Err(1), so the drift went unnoticed.
Proposed change
- Add one
#[derive(Serialize)]vulnerability view, or a singlevuln_json(id, &v)helper, injson_envelope.rs. It returns the list sorted by id. - Use it from all three sites.
- Decide in the PR whether
listgains the top-levelseverity, and say so in the PR description.
Size
3 to 4 files. About −40 / +30 lines.
Acceptance criteria
scan/geteventdetailsandlist --jsonare byte-identical before and after, apart from any field the PR deliberately adds.get'soptions[].vulnerabilitiesis sorted by id and carriesdescription.- The fake test above captures the envelope and asserts the sorted
options[].vulnerabilities.
- 主要語言
- Rust
- 星號
- 9
- 分支
- 2
- 平均合併
- 20 小時 20 分鐘
- 30 天內合併 PR
- 659
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
SocketDev/socket-patch 的其他 Issue
-
agent:triaged arch-audit priority:p3 refactor
難度 2/5 1-3 小時 新手友好度 83/100
SocketDev/socket-patch#1860 ·
維護者通常 1 天內回覆
-
agent:triaged arch-audit priority:p3 refactor
難度 2/5 1-3 小時 新手友好度 78/100
SocketDev/socket-patch#1838 ·
維護者通常 1 天內回覆
-
Nightly gem e2e red on bundler 1.17/2.1: CRLF source-block rollback unattributable可能已有人在做 @mikolalysenko 於 1 天前認領。 未關閉ci-janitor
難度 4/5 3-5 天 新手友好度 35/100
SocketDev/socket-patch#1997 ·
維護者通常 1 天內回覆
-
arch-audit refactor
難度 4/5 3-5 天 新手友好度 54/100
SocketDev/socket-patch#1993 ·
維護者通常 1 天內回覆
-
arch-audit refactor
難度 3/5 1-2 天 新手友好度 66/100
SocketDev/socket-patch#1992 ·
維護者通常 1 天內回覆
查看 SocketDev/socket-patch 的全部 Issue
相似的 Issue
-
bug file-compat priority: high
難度 2/5 1-3 小時 新手友好度 76/100
storytold/photocraft#11330 · 1 則留言 ·
維護者通常 1 天內回覆
-
redis-compat
難度 2/5 1-3 小時 新手友好度 72/100
維護者通常 1 天內回覆
-
say: name hint should only fire on @tags, not bare words or text inside links可能已有人在做 @morganparadis 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 72/100
CakeRepository/agentshangout#501 ·
-
area:ui could docs good first issue
難度 1/5 1-3 小時 新手友好度 79/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 68/100