Repository navigation
fix: merge duplicate security models instead of failing the run - #99
Merged
Merged
Conversation
A second model for a symbol aborted the whole run with ModelError, so two plugins could not describe the same symbol. An identical model is now registered once, sinks merge their kinds and positions as ModelTable.extended already did, and a real conflict names both plugins. Closes #92
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #92.
What
SecurityModelRegistry.registerraisedModelErroron the second model of the same kind for a symbol, andengine.plugin_modelsmerged every plugin without catching it: two plugins describing the same symbol aborted the whole analysis.Sinkmodels on one symbol merge their kinds and positions — the ruleModelTable.extendedalready applied, now shared throughSink.merged.ModelErrornames both plugins (plugin_modelspasses the plugin name asorigin).Tests
test_registry_ignores_an_identical_modeltest_registry_merges_sinks_on_one_symboltest_plugin_models_names_both_plugins_of_a_conflicttest_registry_rejects_conflicting_modelsnow uses twoSourcemodels: two sinks on one symbol are no longer a conflict by decision of Plugin API: merge duplicate security models instead of failing the run #92.Full suite: 892 passed.
ruff checkandmypy srcclean.Docs
Plugin guide states the merge rule; changelog entry under Unreleased.