52 lines
2.1 KiB
Markdown
52 lines
2.1 KiB
Markdown
# PR#67: The Result Comment Names the Security Concern of the Model
|
|
|
|
> **WARNING:** This document describes only the change applied in this PR.
|
|
> It may already be outdated once the next PR is merged.
|
|
> Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.
|
|
|
|
## The Problem
|
|
|
|
PR-Agent answers `security_concerns` with "No" or with a text that describes the concern.
|
|
werkrevisor makes any other answer than "No" YELLOW, with the reason "model reports a security concern".
|
|
The text of the concern is lost: PR#63 got YELLOW for one, and neither the author nor the reviewer could see what it was.
|
|
|
|
## Non-Goals
|
|
|
|
- No change to the verdict: a security concern of the model stays YELLOW.
|
|
- No line comment for the concern: PR-Agent gives it no file and no line.
|
|
|
|
## The Scenarios
|
|
|
|
### Feature: the reason of a security concern holds its text
|
|
|
|
#### Scenario#67.01: the reason quotes the concern
|
|
|
|
So that the reviewer can judge the concern without a new model run.
|
|
|
|
- **Given** the model answers `security_concerns` with "SQL injection: the query concatenates the user name."
|
|
- **When** werkrevisor assesses the answer
|
|
- **Then** the verdict is YELLOW
|
|
- **And** the reason reads "model reports a security concern: SQL injection: the query concatenates the user name."
|
|
|
|
##### Verified by
|
|
|
|
- [test_verdict.ModelMappingTest.test_security_concern_is_yellow_and_quoted](../../tests/test_verdict.py)
|
|
|
|
#### Scenario#67.02: a long concern is shortened to one line
|
|
|
|
So that a long answer does not push the other reasons out of view.
|
|
|
|
- **Given** the model answers `security_concerns` with several lines and more than 400 characters
|
|
- **When** werkrevisor assesses the answer
|
|
- **Then** the reason holds the concern on one line, cut after 400 characters and marked with "…"
|
|
|
|
##### Verified by
|
|
|
|
- [test_verdict.ModelMappingTest.test_a_long_security_concern_is_one_shortened_line](../../tests/test_verdict.py)
|
|
|
|
## The Solution
|
|
|
|
- The reason `model_security` quotes the concern on one line, at most 400 characters.
|
|
- The README says so; the Werkbaum marks the item as done.
|
|
- Version 0.31.1.
|