Fix crypto_usage false positives and failing hook test - #50
Fix crypto_usage false positives and failing hook test#50google-labs-jules[bot] wants to merge 1 commit into
Conversation
* Refined WEAK_PW_HASH and TIMING_UNSAFE regexes in crypto_usage.py to avoid matching unrelated boolean/status/hash logic. * Constrained PW_CONTEXT_FAST_HASH to look for specific common password-like variable names to avoid triggering on file uploads or non-auth context. * Added 6 new regression tests in test_recon.py to prevent false positives from regressing. * Fixed the `test_end_to_end_post_commit_runs` hook test to pass despite global config. * Updated CHANGELOG.md as required.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
What changed:
src/websec_validator/extractors/crypto_usage.pyfor thecrypto_usageextractor.TIMING_UNSAFE: Restricted LHS matching to avoid arbitrary headers or boolean variables likeisMatchor state likecurrentStatus.WEAK_PW_HASH: Tightly constrained the.update()match to the identified_PWvariable rather than matching arbitrary variables far away.PW_CONTEXT_FAST_HASH: Replaced the over-broad wildcard regex with specific match targets (likeinput,password,key) and short identifiers, eliminating false positives on things likesomeOtherData.tests/test_recon.py.test_end_to_end_post_commit_runsby enforcinggit config core.hooksPath .git/hooksin the temporary testing directory before making a commit.CHANGELOG.mdunder[Unreleased].Why:
The
crypto_usageextractor was falsely flagging legitimate, benign idiomatic usage as vulnerabilities (such as boolean assertions, enum state checks that happen to use the word "Auth", and unrelatedcreateHash()commands located nearcheckPasswordfunctions). Additionally, a test checking post-commit hooks randomly failed due to lack of localcore.hooksPathconfiguration.Risk:
Low. The regex refinements keep all existing (15+) security findings tests passing while squashing the FPs. The repo cleanliness was preserved and tests/docguard are completely green.
PR created automatically by Jules for task 17287384905726647658 started by @raccioly