Render a patch's vulnerability labels through one ui helper: scan, get and list each write the CVE-else-advisory rule, and their order, dedup and severity case drifted
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Read ui/mod.rs and the referenced helpers in scan/render.rs, get.rs, and list.rs to trace the current label, ordering, deduplication, and severity behavior. Update the render byte tests in scan/render.rs and tests/cli/list_render.rs, and add a unit test for a CVE shared by two advisories. Done means all three commands use the shared UI helpers and the acceptance criteria pass.
由索引模型根据 Issue 内容生成。
描述
[agent] Filed by the scheduled architecture audit (audit-cli-tests). Register: register comment.
Kind: refactor. Register ID: T28 (its JSON sibling is T02, #1836; its severity sibling is T10).
Problem
The human label of a vulnerability follows one rule: its CVE ids sorted, otherwise the advisory id. That rule is written four times:
- scan: scan/render.rs
vuln_labelL385-L393,`` sorted worst-severity-first bysorted_vulnsL371-L381; - get: get.rs L372-L382, the same body;
- get again:
vuln_labelsL222-L236, which flattens and dedups; - list: list.rs L284-L288, which prints the advisory id with its CVEs in parentheses, unsorted, and sanitized.
The copies have drifted (verified by reading):
- Order. scan orders the
Fixes:list by severity; get orders it by label. - Dedup. scan doesn't dedup, so a CVE shared by two advisories prints twice; get dedups.
- Severity label. get prints it uppercased (get.rs L289). scan's preview prints the raw API label through
ui::severity, which passes unknown labels through unchanged. scan's policy line prints core's canonicalseverity_name, so "medium" appears where the API said "moderate" (policy.rs L752). - Sanitizing. Only list filters the API text (T23).
Proposed change
- Add
ui::vuln_labels(&HashMap<String, VulnerabilityResponse>) -> Vec<String>: CVEs else the id, deduped, in one documented order. - Add one
ui::severity_label(&str)that uses core'sseverity_name. - scan, get and list call these helpers. Delete
render::vuln_label/sorted_vulns, get's two copies and list's inline format.
Size
4 files (ui/mod.rs, scan/render.rs, get.rs, list.rs). Roughly −50 / +25.
Acceptance criteria
- The render byte tests in
scan/render.rsandtests/cli/list_render.rsare updated deliberately, once, to the chosen order and case. - A new unit test shows a CVE shared by two advisories printed once.
- No CLI file keeps its own CVE-else-id closure.
- 主要语言
- Rust
- 星标
- 8
- 派生
- 2
- 平均合并
- 18 小时 47 分钟
- 30 天内合并 PR
- 637
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
SocketDev/socket-patch 的其他 Issue
-
agent:triaged arch-audit priority:p3 refactor
难度 2/5 1-3 小时 新手友好度 83/100
SocketDev/socket-patch#1860 ·
维护者通常 1 天内回复
-
agent:triaged arch-audit priority:p3 refactor
难度 2/5 1-3 小时 新手友好度 78/100
SocketDev/socket-patch#1838 ·
维护者通常 1 天内回复
-
arch-audit refactor
难度 4/5 3-5 天 新手友好度 35/100
SocketDev/socket-patch#1987 ·
维护者通常 1 天内回复
-
agent:triaged arch-audit priority:p3 refactor
难度 4/5 3-5 天 新手友好度 35/100
SocketDev/socket-patch#1983 · 1 条评论 ·
维护者通常 1 天内回复
-
agent:triaged arch-audit bug priority:p3
难度 3/5 半天 新手友好度 55/100
SocketDev/socket-patch#1982 · 1 条评论 ·
维护者通常 1 天内回复
查看 SocketDev/socket-patch 的全部 Issue
相似的 Issue
-
难度 1/5 1-3 小时 新手友好度 70/100
OpenZeppelin/openzeppelin-relayer#967 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
src/runs.rs:1987: a missing --source-run-id now answers 400 "Source run ... does not exist", not 404未关闭nightly-audit
难度 2/5 1-3 小时 新手友好度 62/100
antithesishq/snouty#602 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 70/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 70/100
libnativeapi/nativeapi#21 ·