Fix Snyk Issue API reachability rendering; pin parser output surfaces#15219
Draft
devGregA wants to merge 1 commit into
Draft
Fix Snyk Issue API reachability rendering; pin parser output surfaces#15219devGregA wants to merge 1 commit into
devGregA wants to merge 1 commit into
Conversation
The parser collapsed Snyk's per-coordinate reachability into a broken
boolean: 'reachability != "not-applicable"' counted 'no-path-found' (Snyk
affirmatively found NO path to the vulnerable code) and even a missing value
as reachable, so those findings rendered 'Reachable: Yes' in the impact
text. Render the raw values Snyk reported instead ('Reachability:
reachable / package / no-path-found / not-applicable'), and say nothing when
Snyk reports nothing.
Also pins existing observable output surfaces with tests so future changes
to them are deliberate rather than incidental:
- govulncheck V2: the '**Reachability:** <level> (<severity> severity)'
description line and the '**Traces:**' block
- sysdig_reports: the 'InUse:<bool>' tag format
New fixture exercises all four Snyk reachability cases including the
previously-misrendered no-path-found and missing-value cases.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes the Snyk Issue API parser's reachability rendering. The parser collapsed Snyk's per-coordinate
reachabilityvalues into a single boolean viareachability != "not-applicable", sono-path-found— Snyk affirmatively reporting that no path to the vulnerable code exists — and even a completely missing value both rendered asReachable: Yesin the impact field.The impact text now renders the raw values Snyk reported (
Reachability: reachable/package/no-path-found/not-applicable, deduped and sorted for determinism), and renders nothing when Snyk reports nothing.This PR also adds output-stability assertions for existing parser output surfaces that users and downstream tooling rely on, so future changes to these formats are deliberate rather than incidental:
**Reachability:** <level> (<severity> severity)description line and the**Traces:**blockInUse:<bool>tag formatTest results
unittests/scans/snyk_issue_api/snyk_sca_scan_api_reachability.jsonexercises all four Snyk cases (reachable,package,no-path-found, and a coordinate with no reachability value) with assertions on the rendered impact text — including that the previously-misrenderedno-path-foundand missing-value cases no longer claim reachability.Reachable: Notext.Documentation
No documentation changes needed — output rendering fix and test hardening only.
🤖 Generated with Claude Code