fix(tools): correct CISA KEV detection in get_nvd_data + 55 tests - #176
Open
manus-use wants to merge 1 commit into
Open
fix(tools): correct CISA KEV detection in get_nvd_data + 55 tests#176manus-use wants to merge 1 commit into
manus-use wants to merge 1 commit into
Conversation
The CISA KEV detection logic checked whether "cisaExploitAdd" appeared inside the vulnStatus *string* (e.g. "Analyzed"), which could never match. NVD API v2.0 exposes CISA KEV fields as top-level keys in the cve object — the fix checks for the key in the dictionary instead. Also adds graceful .get() defaults for cisaRequiredAction and cisaActionDue so partial KEV metadata does not raise KeyError. Includes a comprehensive 55-test suite (tests/test_get_nvd_data.py) covering: TOOL_SPEC metadata, input validation, CVE ID normalisation, successful response parsing, CISA KEV detection (the fixed bug), empty vulnerabilities, HTTP errors, JSON decode errors, unexpected exceptions, log_tool_output_size invocation, and edge cases.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a real bug in the CISA KEV detection logic within
get_nvd_dataand adds a comprehensive 55-test suite for the tool function.The Bug
The existing code checked:
This performs a substring search inside the
vulnStatusstring (which holds values like"Analyzed","Modified","Awaiting Analysis"). The string"cisaExploitAdd"will never appear insidevulnStatus, so CISA KEV information was never detected — even for CVEs actively in the KEV catalog.The Fix
NVD API v2.0 exposes CISA KEV fields as top-level keys in the
cvedictionary object:{ "cve": { "id": "CVE-2024-1234", "vulnStatus": "Analyzed", "cisaExploitAdd": "2024-01-20", "cisaRequiredAction": "Apply mitigations per vendor instructions.", "cisaActionDue": "2024-02-10" } }The fix checks for the key in the dictionary:
Also adds
.get()with empty-string defaults forcisaRequiredActionandcisaActionDueso partial KEV metadata doesn't raiseKeyError.Test Suite (55 tests)
tests/test_get_nvd_data.py— comprehensive coverage of theget_nvd_datatool function:Test results
(Baseline 1158 + 55 new tests, 0 failures)
Duplicate check
Checked all 50 open PRs (#126–#175) — no existing open or merged PR fixes this bug or adds tool-level tests for the
get_nvd_datafunction. The closest is:_nvd_get_with_retry+ retry tests, but did NOT test the mainget_nvd_datafunction's response parsing or KEV detectiontest_nvd_retry.py— existing tests cover the retry helper only; theTestGetNvdDataToolclass has just 4 basic tests that don't cover KEV detection, empty responses, JSON errors, or edge cases