DSL Engine #1587
Open
Aarush289 wants to merge 31 commits into
Open
Conversation
create pr
Document all modules ( fix OWASP#1269 ) (OWASP#1270)
Signed-off-by: Aarush <cs24b064@smail.iitm.ac.in>
Removed entry for FortiWeb authentication bypass vulnerability. Signed-off-by: Aarush <cs24b064@smail.iitm.ac.in>
Signed-off-by: Aarush <cs24b064@smail.iitm.ac.in>
Signed-off-by: Aarush <cs24b064@smail.iitm.ac.in>
Merge new changes
Merge new modules
Pull the changes
merge the changes
Add the new changes
MERGE NEW changes
Merge changes
Merge the changes
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
Summary by CodeRabbitRelease Notes
WalkthroughAdds a new ChangesVersion DSL Engine and HTTP Integration
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
pyproject.toml (1)
46-69:⚠️ Potential issue | 🔴 CriticalAdd missing
packagingruntime dependency to resolve import error in execution paths.
nettacker/core/utils/dsl_matcher.pyimportsfrom packaging.version import Version, InvalidVersionat line 12. This module is imported bycommon.py(line 17), which is in turn imported across all core entry points (config.py,app.py,graph.py,http.py, etc.). Thepackaginglibrary is not declared in[tool.poetry.dependencies], causing aModuleNotFoundErrorwhen these execution paths are triggered.Suggested fix
[tool.poetry.dependencies] python = "^3.10, <3.13" aiohttp = "^3.9.5" @@ zipp = "^3.19.1" semver = "^3.0.0" +packaging = "^24.0"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pyproject.toml` around lines 46 - 69, The packaging library is missing from the runtime dependencies in pyproject.toml. Add the packaging dependency to the [tool.poetry.dependencies] section with an appropriate version constraint. This will ensure that when dsl_matcher.py imports from packaging.version (which is transitively required by common.py and used across all core entry points), the module will be available at runtime.Source: Pipeline failures
🧹 Nitpick comments (1)
nettacker/core/utils/common.py (1)
456-493: ⚡ Quick winAdd type hints to the new public wrapper APIs.
Lines 456 and 482 expose public helpers in
nettacker/core/utils/common.pybut currently omit practical type hints.Suggested update
+from typing import Iterable, Optional @@ -def version_matches_dsl(detected_version, dsl_expression): +def version_matches_dsl(detected_version: str, dsl_expression: str) -> bool: @@ -def extract_version_from_content(content, patterns): +def extract_version_from_content( + content: str, patterns: Iterable[str] +) -> Optional[str]:As per coding guidelines,
nettacker/**/*.py: "Keep functions small, use type hints where practical, and add docstrings for public APIs."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@nettacker/core/utils/common.py` around lines 456 - 493, The functions version_matches_dsl and extract_version_from_content lack type hints for their parameters and return types. Add proper type hints to both functions: for version_matches_dsl, add type hints indicating both detected_version and dsl_expression are strings, and the return type is bool; for extract_version_from_content, add type hints indicating content is a string, patterns is a list, and the return type is an optional string. This aligns with the coding guidelines requiring type hints for public APIs in the nettacker module.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@nettacker/core/lib/http.py`:
- Around line 96-121: In the version_match condition block, the code lowercases
the header_name variable but fails to normalize the response headers dictionary
itself, causing case-sensitive lookup failures. When extracting the header from
response.get("headers", {}), first convert the headers dictionary to have all
lowercase keys before accessing it with header_name.lower(), so that the lookup
succeeds regardless of the original casing in the response headers (e.g.,
"Server" vs "server").
In `@nettacker/core/utils/dsl_matcher.py`:
- Around line 447-454: The exception handling in the try-except block (lines
453-454) silently catches all exceptions without logging, which hides debugging
information about invalid regex patterns or configuration issues. Add logging to
the except block that captures the actual exception details and relevant context
(such as the pattern being attempted) before executing the continue statement.
This will make it easier to diagnose why pattern matching fails during
extraction.
- Around line 442-446: The issue in the extract_version_from_response method is
that line 445 unconditionally wraps patterns in a list with patterns =
[patterns], which creates a nested list structure when callers already pass a
list of patterns. This causes re.search to receive a list instead of a string
regex pattern, breaking the matching logic. Fix this by conditionally wrapping
patterns only if it is not already a list; check if patterns is a string and
only then wrap it in a list, otherwise leave it as-is.
---
Outside diff comments:
In `@pyproject.toml`:
- Around line 46-69: The packaging library is missing from the runtime
dependencies in pyproject.toml. Add the packaging dependency to the
[tool.poetry.dependencies] section with an appropriate version constraint. This
will ensure that when dsl_matcher.py imports from packaging.version (which is
transitively required by common.py and used across all core entry points), the
module will be available at runtime.
---
Nitpick comments:
In `@nettacker/core/utils/common.py`:
- Around line 456-493: The functions version_matches_dsl and
extract_version_from_content lack type hints for their parameters and return
types. Add proper type hints to both functions: for version_matches_dsl, add
type hints indicating both detected_version and dsl_expression are strings, and
the return type is bool; for extract_version_from_content, add type hints
indicating content is a string, patterns is a list, and the return type is an
optional string. This aligns with the coding guidelines requiring type hints for
public APIs in the nettacker module.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 45891a2c-51a7-4c9d-b836-c097700375d7
⛔ Files ignored due to path filters (1)
poetry.lockis excluded by!**/*.lock
📒 Files selected for processing (5)
nettacker/api/database.sqlite3nettacker/core/lib/http.pynettacker/core/utils/common.pynettacker/core/utils/dsl_matcher.pypyproject.toml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed change
This PR introduces DSL (Domain Specific Language) support for service/version extraction in Nettacker.
(This work is derived from the DSL PR by Rishi after minor changes)
Fixes #1586
Type of change
Checklist
make pre-commitand confirm it didn't generate any warnings/changesmake testand I confirm all tests passed locallydocs/folder