refactor(plugins): Standardize plugin ID naming conventions to snake_case-#548 - #2048
Closed
Rakshak05 wants to merge 975 commits into
Closed
refactor(plugins): Standardize plugin ID naming conventions to snake_case-#548#2048Rakshak05 wants to merge 975 commits into
Rakshak05 wants to merge 975 commits into
Conversation
…1520) * Resolves issue-utksh1#1425 * Removed white spaces.
Co-authored-by: Tomeshwari-02 <[email protected]>
…ile, and workflow endpoints (utksh1#1557)
…h1#1563) Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
Co-authored-by: tmdeveloper007 <[email protected]>
* fix: TOCTOU race condition in SSE task streaming causing indefinite connection hang - Add _task_terminal flag to TaskExecutor, set on all terminal exit paths - Clean up listener queues when task completes to prevent memory leaks - Add post-subscribe status re-check in event_generator to close TOCTOU window - Add 30s timeout on queue.get() to prevent indefinite blocking - Handle TimeoutError by checking task status before continuing Fixes utksh1#1484 * SSE TOCTOU: remove unused _task_terminal, add regression tests
* fix: add owner authorization to notification history endpoint (BOLA) - Add owner: str = Depends(get_current_owner) to list_notification_history - Add JOIN with notification_rules and WHERE nr.owner_id = ? filter to both the data query and the count query - Add owner_id column to notification_history table schema - Create migration 007 to backfill owner_id on existing rows Fixes utksh1#1483 * Notification BOLA: add migration + tests for owner isolation
* fix: add concurrent_limiter.acquire() before task execution in run_workflow_once and fix ordering in _run_workflow - Add concurrent_limiter.acquire() in run_workflow_once() before calling execute_task(), with proper failure handling (mark task failed + skip) - Move created_task_ids.append() to after the acquire succeeds in WorkflowScheduler._run_workflow() so failed acquires don't pollute the task list Fixes utksh1#1482 * Add regression tests for workflow concurrency ordering - test_acquire_before_execute_task: verifies concurrent_limiter.acquire is called before asyncio.create_task(executor.execute_task) - test_rejected_acquire_marks_failed_and_skips_execution: rejected steps are marked failed and execute_task is not called - test_rejected_acquire_does_not_block_accepted_tasks: one rejected step doesn't prevent subsequent steps from being processed - test_scheduler_acquire_before_append_task_id: scheduler calls acquire before recording task_ids - test_scheduler_rejected_task_not_in_created_ids: rejected task IDs are excluded from the created_task_ids list passed to record_workflow_run
Co-authored-by: Soujanya S H <[email protected]>
* test: add unit tests for _validate_lengths field length guard Covers valid/boundary/over-limit cases for name, description, and notes fields, plus custom resource_type substitution and None handling for optional fields. Closes utksh1#2307. * fix: bump undici to patch high-severity vulnerability (GHSA-8xcm-r25x-g524 and related)
* fix(theme): persist dark mode in localStorage and sync html class * fix(deps): override undici to resolve npm audit vulnerability * fix(deps): bump undici override to ^8.10.0 to resolve high severity audit vulnerability * fix(deps): update jsdom to v25 and override undici for CI compatibility
…#2446) (utksh1#2451) * test: add tests for rate_limiter.check_scan_rate_limit (closes utksh1#2446) * test: fix sys.modules pollution in rate_limiter check_scan_rate_limit tests (closes utksh1#2446) --------- Co-authored-by: Mavis Bot <[email protected]>
- Add useWebSocket hook for real-time task updates - Add sanitizeRawOutput for secure scanner output rendering - Update .gitignore to exclude SQLite temp files (*.db-shm, *.db-wal)
- Add scripts for assigning issues to contributors - Add script for closing low-quality/spam issues - Include documentation and assignment summary
- Delete 8 entire files (duplicate/unused implementations) - Delete 7 trivial test files - Remove 7 unused npm packages (styled-components, react-icons, etc) - Remove one-liner wrappers and dead code - Net: -54 npm packages, -2,118 lines, 30-40% complexity reduction Files deleted: - scripts/enhance_github_issues_old.py (superseded) - scripts/validate_plugin.py (duplicate) - backend/secuscan/sandbox_executor.py (unused) - frontend/src/components/I18nContext.tsx (no i18n) - frontend/src/hooks/useVirtualList.ts (unused) - frontend/src/hooks/useWebSocket.ts (unused) - plugins/domain-finder/parser.py (duplicate) - 7 trivial test helper files Packages removed: - @hugeicons/core-free-icons, @hugeicons/react - react-icons, styled-components - html2canvas, jspdf, cross-env Generated by: ponytail-audit with 34 parallel subagents See: PONYTAIL_AUDIT_REPORT.md for 345 total findings
- Delete parser_hash_algorithm (never used) - Delete network_audit_retention_days (never referenced) - Delete sandbox_allow_network (unused flag) - Delete notification_ssrf_enabled (always mandatory) - Delete notification_blocked_ip_ranges (duplicate of MANDATORY_DENYLIST) - Delete base_url property (redundant with public_base_url) Replace notification_blocked_ip_ranges with MANDATORY_DENYLIST throughout. Inline base_url in main.py debug endpoint. Lines removed: ~25 Risk: Zero (dead code)
…n_string helpers - Remove normalize_package_name() wrapper (3 lines) - Remove clean_version_string() wrapper (10 lines) - Inline re.sub pattern for package normalization (7 uses) - Inline version cleaning logic with direct regex match - Total: 13 lines removed Phase 10 complete: 1,062 lines removed (49% of 2,166-line goal)
…and_result, _build_severity_counts - Remove _resolve_execution_timeout() wrapper (3 lines) - Remove _classify_command_result() helper (18 lines) - Remove _build_severity_counts() helper (7 lines) - Inline timeout resolution with direct dict.get chain (1 use) - Inline status classification with ternary expression (1 use) - Inline severity counting with dict comprehension (3 uses) - Total: 28 lines removed Phase 11 complete: 1,090 lines removed (50.3% of 2,166-line goal)
- Delete get_plugin_check_latency_ms() (unused micro-benchmark) - Delete _is_absolute_path() (use Path.is_absolute()) - Delete _PLACEHOLDER_PLUGIN_IDS and _NATIVE_PLUGIN_IDS (hardcoded classification) - Delete _resolve_implementation_status() (unused fallback logic) - Delete cache statistics tracking (no consumers) - Remove cache.url parameter (unused) Lines removed: ~50 Risk: Zero (dead code)
…and_result, _build_severity_counts - Delete _resolve_execution_timeout() (16 lines) - inlined at call site - Delete _classify_command_result() (51 lines) - inlined with ternary - Delete _build_severity_counts() (7 lines) - inlined at 3 call sites - Total: 74 lines removed Phase 11 complete: 1,090 lines removed (50.3% of goal) 50% MILESTONE REACHED
- Inline _resolve_execution_timeout with min() at call site - Inline _build_severity_counts at 2 remaining call sites - Remove _resolve_execution_timeout (16 lines) - Remove _classify_command_result (51 lines) - Remove _build_severity_counts (7 lines) - Total: 74 lines removed Phase 11 complete: 1,164 lines removed (53.7% of 2,166-line goal) 🎉 EXCEEDED 50% MILESTONE
- Inline _resolve_execution_timeout at call site (1 use) - Inline _build_severity_counts at call sites (2 uses) - Remove _resolve_execution_timeout function (16 lines) - Remove _classify_command_result function (51 lines) - Remove _build_severity_counts function (7 lines) - Total: 74 lines removed 🎉 Phase 11 complete: 1,164 lines removed (53.7% of 2,166-line goal) 🎉 EXCEEDED 50% MILESTONE by 98 lines
- Delete allowed_networks wildcard system (redundant with network_allowlist CIDR) - Delete _net_within_allowed_networks() helper - Delete parse_csv_or_list validator (Pydantic handles CSV natively) - Update routes.py to expose network_allowlist/denylist instead Lines removed: ~20 Risk: Zero (wildcard system unused, CIDR system is primary)
…sset_service_record - Inline _deserialize_finding_rows at call site (1 use) - Inline _normalize_asset_service_record in list comprehension (1 use) - Remove _deserialize_finding_rows function (20 lines) - Remove _normalize_asset_service_record function (15 lines) - Total: 35 lines removed Progress: 1,199 lines removed (55.4% of goal)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR standardizes the naming convention for all plugin IDs and their directories across the codebase, resolving inconsistency issues between hyphenated and underscored names (e.g.,
domain-finder->domain_finder,website-recon-2->website_recon, etc.).Key changes include:
metadata.jsonidentifiers to followsnake_case.007_standardize_plugin_ids.sqlto normalize plugin IDs in the workflows schema.PLUGINS.mdto guide future plugin contributions.backend/data/.api_keyto keep the PR clean.Related Issues
Closes #548
Type of Change
How Has This Been Tested?
Ran the backend unit test suite to verify that all plugins load, validate, and execute properly with standard names:
All 200+ unit and integration tests passed successfully.
Checklist