From b72389dfb62dc2f6bd7bb821b3a30d9ef79e0c58 Mon Sep 17 00:00:00 2001 From: Amr-Saad Date: Wed, 10 Jun 2026 00:55:01 +0300 Subject: [PATCH] test(scoring): update stale empty-tags reachability expectations Two assertions in test_scoring.py still encode the old reachability default (requires_auth, x0.5) for findings with no reachability tags. scoring.py was intentionally changed so an empty tag set defaults to externally_reachable (x1.0) - documented in _reachability_multiplier: the old x0.5 default 'severely penalised every finding ... causing critical CWEs to score 2.5/10'. The file's other tests already use explicit reachability tags consistent with the new model; only these two lagged, leaving main red. - defaults_reachability_when_missing: 1.05 -> 2.1 (LOW 3.0 x SANITIZATION_BYPASSABLE 0.7 x externally_reachable 1.0) - reachability_multipliers_and_default_behavior[set()]: 2.5 -> 5.0 (MEDIUM 5.0 x FULL_EXPLOIT 1.0 x externally_reachable 1.0) Full suite now green (105 passed); ruff clean on the file. Tests-only change; no production code touched. Co-Authored-By: Claude Opus 4.8 --- tests/test_scoring.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/tests/test_scoring.py b/tests/test_scoring.py index c11e0f0..e90c270 100644 --- a/tests/test_scoring.py +++ b/tests/test_scoring.py @@ -92,7 +92,11 @@ def test_compute_exploitability_score_defaults_reachability_when_missing() -> No severity=Severity.LOW, evidence_level=EvidenceLevel.SANITIZATION_BYPASSABLE, ) - assert compute_exploitability_score(finding) == 1.05 + # With no reachability tags, scoring.py deliberately assumes the worst case + # (externally_reachable, x1.0) instead of under-scoring with requires_auth + # (x0.5) - see the comment in scoring._reachability_multiplier. + # LOW (3.0) x SANITIZATION_BYPASSABLE (0.7) x externally_reachable (1.0) = 2.1 + assert compute_exploitability_score(finding) == 2.1 def test_compute_exploitability_score_is_deterministic() -> None: @@ -111,8 +115,8 @@ def test_compute_exploitability_score_is_deterministic() -> None: ({"internally_reachable"}, 3.5), ({"requires_auth"}, 2.5), ({"requires_admin"}, 1.5), - ({"custom_tag"}, 2.5), - (set(), 2.5), + ({"custom_tag"}, 2.5), # non-reachability tag -> requires_auth fallback (x0.5) + (set(), 5.0), # empty tag set -> externally_reachable default (x1.0) ], ) def test_reachability_multipliers_and_default_behavior(tags: set[str], expected: float) -> None: