Repository navigation
Conversation
…hing deterministic (GenAI-Security-Project#125) When a README matched more than one limitations pattern, the extractor returned a list and _create_model_card_section() wrapped it in another list, producing technicalLimitations: [[...]], which fails CycloneDX 1.6 validation (items must be strings). useCases and ethicalConsiderations used the same wrapping. _find_pattern_matches() also returned list(set(matches)), so the order of the matches, and the "first match" used for model_type, changed with PYTHONHASHSEED. - extractor.py: de-duplicate with dict.fromkeys() so matches keep the order of the patterns. - service.py: add _as_string_list() and use it for useCases, technicalLimitations and ethicalConsiderations so lists are flattened to non-empty strings and scalars are wrapped once. - tests: schema-valid flat output for multiple matches, scalar wrapping, empty values skipped, pattern order, de-duplication, and identical output across six PYTHONHASHSEED values. Fixes GenAI-Security-Project#125 Signed-off-by: Raghuvar Karthik Durga <177662415+drk-ram@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #125.
A README with more than one limitations-style statement made
EnhancedExtractorreturn a list, which_create_model_card_section()wrapped in another list (technicalLimitations: [[...]]). That is invalid against the CycloneDX 1.6 schema. Separately,_find_pattern_matches()usedlist(set(...)), so match order, and the first match used formodel_type, varied withPYTHONHASHSEED.Changes
extractor.py:_find_pattern_matches()de-duplicates withdict.fromkeys(), keeping pattern order.service.py: new_as_string_list()flattens a scalar or list into non-empty strings.useCases,technicalLimitationsandethicalConsiderations(one{"name": ...}per item) use it, so lists are never nested and empty values are not emitted.Tests (
tests/test_limitations_extraction.py)technicalLimitationslist andvalidate_aibom()passesintendedUse/ethicalConsiderationsare flattened and schema-validmodel_typeandtechnicalLimitationsoutput is identical acrossPYTHONHASHSEED0 to 5 (subprocess per seed)Five of the seven tests fail on
origin/main.Validation
pytest -q --no-cov: all passedpytest tests/test_limitations_extraction.py --no-covonorigin/mainsources: 5 failed, 2 passed; with this change: 7 passed