fix(scanners): parse ThreatCrush text output instead of non-existent --json - #895
Merged
Conversation
…--json
The adapter called `threatcrush scan <path> --json`, which the CLI rejects with
"unknown option '--json'". Its own comment flagged --json as assumed; it is
not. Verified against the published bundle (0.2.2), where scan is declared as:
.command("scan").argument("[path]", "Path to scan", ".")
A path and nothing else. Only `harden` accepts --json, so every scan failed
and parseJson never saw JSON.
Drops the flag and parses the CLI's block output: a severity and title line,
then File:, then Info:. Severity is bare for CRITICAL and bracketed for the
rest. Code: lines are skipped, being redacted excerpts rather than locations —
matching them double-counted every finding. Line :0 means a whole-file finding
and no longer produces a ':0' suffix. Paths are reported relative to the
scanned directory, so they are re-joined with the request path to stay
resolvable.
JSON is still tried first, so a future machine-readable scan mode is picked up
with no further change.
Adds test/scan-output.txt, captured verbatim from a live run, so the parser is
tested against observed behaviour rather than an assumption. 11 tests pass and
the package typechecks.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ThreatCrush security scan0 finding(s) in files changed by this PR (scanned 3 changed file(s); 88 further finding(s) elsewhere in the repository are not attributed to this PR). No new findings in the files this PR changes. ThreatCrush CLI ran locally in the runner ( |
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The adapter called
threatcrush scan <path> --json. That flag does not exist — the CLI rejects it withunknown option '--json', so every scan failed andparseJson()never saw JSON. The adapter's own comment already flagged--jsonas assumed.Verified against the published bundle (
@profullstack/threatcrush0.2.2):A path and nothing else. Only
hardenaccepts--json.What changed
Drops the flag and parses the CLI's actual block output:
Four details, each of which caused a bug when I first wrote this parser elsewhere:
CRITICAL, bracketed for[HIGH]/[MEDIUM]/[LOW]req.pathso they stay resolvable:0:0Code:lines are redacted excerptsJSON is still tried first, so if
scanever gains a machine-readable mode the adapter picks it up with no further change. The existing JSON mapping and its test are untouched.Verified
test/scan-output.txt, captured verbatim from a live scan, so the parser is tested against observed behaviour rather than an assumption. It parses all 9 findings with correct severities and paths.tscerror (string | undefined) surfaced during review and is fixed.Note:
README.mdis generated byscripts/gen-module-readmes.mjs, so I left it alone rather than have edits overwritten.🤖 Generated with Claude Code