Dedup logic #11
Dedup logic #11
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR is being reviewed by Cursor Bugbot
Details
You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
| @@ -1,2 +1,3 @@ | |||
| {"assetType": "library", "evidence": {"column": 1, "line": 1}, "identifier": "OpenSSL (PHP)", "path": "FIXME"} | |||
| {"assetType": "algorithm", "evidence": {"column": 15, "line": 7}, "identifier": "AES-GCM", "metadata": {"keySize": 256, "primitive": "symmetric"}, "path": "FIXME"} | |||
| {"assetType": "algorithm", "evidence": {"column": 16, "line": 11}, "identifier": "AES-GCM", "metadata": {"keySize": 256, "primitive": "symmetric"}, "path": "FIXME"} | |||
There was a problem hiding this comment.
PHP test expects wrong keySize for AES-128-GCM const
The expected test output specifies keySize: 256 for line 11, but the source code uses const AES_GCM_CIPHER = 'aes-128-gcm' which should result in keySize: 128. The cipher string explicitly specifies 128-bit AES, not 256-bit. This incorrect test expectation will mask a bug where the const eval for PHP string values isn't correctly extracting the key size from the resolved cipher algorithm name.
Additional Locations (1)
| {"assetType": "algorithm", "evidence": {"column": 16, "line": 62}, "identifier": "AES", "metadata": {"primitive": "symmetric"}, "path": "FIXME"} | ||
| {"assetType": "algorithm", "evidence": {"column": 16, "line": 66}, "identifier": "AES", "metadata": {"primitive": "symmetric"}, "path": "FIXME"} | ||
| {"assetType": "algorithm", "evidence": {"column": 13, "line": 71}, "identifier": "AES", "metadata": {"primitive": "symmetric"}, "path": "FIXME"} | ||
| {"assetType": "algorithm", "evidence": {"column": 10, "line": 46}, "identifier": "AES-CBC", "metadata": {"primitive": "symmetric"}, "path": "FIXME"} |
There was a problem hiding this comment.
Test expects inconsistent dedup for AES mode variants
The expected test output has inconsistent dedup behavior. On lines where AES-GCM is detected, generic AES is correctly removed per the documented dedup policy. However, on lines with AES-CBC, AES-CTR, AES-OFB, or AES-CFB, both the generic AES and the specific mode variant are kept. This violates the policy in DESIGN.md which states that when a more specific variant starting with the generic identifier plus - is present, the generic identifier should be dropped. The test expectations will pass despite incorrect dedup behavior for non-GCM modes.
Note
Introduces inventory-focused improvements to detection and output.
RSA-PKCS1overRSA,ECDSA-P256overECDSA), reducing duplicate/generic hitsRSAkey sizes,AES-GCMmode names)DESIGN.mdwith pipeline, data model, and dedupe policy; updatesREADMEto emphasize inventory-first design and link to the design docWritten by Cursor Bugbot for commit 6f9fab4. This will update automatically on new commits. Configure here.