Repository navigation
feat: justify advisory entry points, keep their conditions and record evidence levels - #109
Merged
Merged
Conversation
… evidence levels An advisory now distinguishes the affected_symbols a fix changed from the public entry_points through which a project reaches them; each entry point carries the justification tying it to the fix and the conditions under which it is affected. A condition the engine cannot check is kept on the finding as pending review, never dropped. modules names what the package installs, so a required package can be told from an imported one. Every dependency finding records its evidence level: declared, imported, reachable or exploitable. Part of CoreTrace-Entreprise/coretrace-python-analyzer-plugins#2
4 tasks
The affected-symbol map kept the first advisory per symbol, so a call to yaml.load under a release affected by four CVEs reported one. The map now carries every advisory of the symbol; the reachable plugin and the correlation report one finding per advisory.
…ules Two contributions of the same advisory with different ranges both survived and produced two findings. The later contributor now replaces the earlier one, so a curated plugin refines the bundled sample and a local file wins over every plugin. The sample advisories say which modules pyyaml and pillow install.
This was referenced Sep 22, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Groundwork for the curated advisories (CoreTrace-Entreprise/coretrace-python-analyzer-plugins#2).
Schema (still
"schema": 1, every new field optional)affected_symbols: the internal functions the fix changed.entry_points: the public APIs through which a project reaches them, each with ajustification(the commit, or the call path) andconditions.conditions:{"kind": "argument", "argument", "values"}for what the engine can check,{"kind": "semantic", "text"}for what it cannot yet. Not one is dropped: both kinds are recorded on the finding, and every condition is listed asconditions_pending_reviewuntil checked (aponytail:note marks the ceiling; see the follow-up issue).modules: the top-level modules the package installs (pyyaml→yaml), defaulting to the package name.Evidence levels
Every dependency finding carries
level:declared(requirement allows a vulnerable version),imported(a module of the package is imported in the project — an internal state on the finding, not a new finding),reachable(a call to an entry point or affected symbol),exploitable(attacker input reaches it).reachable/exploitablealso carryentry_point,justification,conditions,conditions_pending_review; a direct call to an affected symbol is justified as "affected symbol, changed by the fix".correlation.evidence()owns the metadata; both bundled dependency plugins and the correlation use it.Tests
tests/test_advisory_evidence.py: schema round trip, module default, and the four transitions on one synthetic advisory — declared only, imported without a call, reachable through an entry point (with justification and conditions), reachable through the affected symbol itself, exploitable. 911 passed; ruff and mypy clean.