voidaccess 1.9.2__tar.gz → 1.9.3__tar.gz

{voidaccess-1.9.2 → voidaccess-1.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: voidaccess
-Version: 1.9.2
+Version: 1.9.3
 Summary: Dark web OSINT CLI — automated threat intelligence from query to report
 Author: VoidAccess
 License-Expression: MIT

{voidaccess-1.9.2 → voidaccess-1.9.3}/api/main.py

@@ -40,7 +40,7 @@ logging.basicConfig(level=logging.DEBUG)
 # Rate limiter setup
 # ---------------------------------------------------------------------------
 
-DISABLE_RATE_LIMIT = os.getenv("DISABLE_RATE_LIMIT", "false").lower() == "true"
+DISABLE_RATE_LIMIT = (os.getenv("DISABLE_RATE_LIMIT", "false") or "false").lower() == "true"
 
 if DISABLE_RATE_LIMIT:
     limiter = None

{voidaccess-1.9.2 → voidaccess-1.9.3}/api/routes/investigations.py

@@ -537,7 +537,7 @@ async def _check_cancelled(inv_uuid: uuid.UUID, investigation_id: str) -> bool:
 # Rate limiting (shared key_func with api/main.py; enforcement via app.state.limiter)
 # ---------------------------------------------------------------------------
 
-_DISABLE_RATE_LIMIT = os.getenv("DISABLE_RATE_LIMIT", "false").lower() == "true"
+_DISABLE_RATE_LIMIT = (os.getenv("DISABLE_RATE_LIMIT", "false") or "false").lower() == "true"
 
 if not _DISABLE_RATE_LIMIT:
     try:

{voidaccess-1.9.2 → voidaccess-1.9.3}/export/ioc_package.py

@@ -57,7 +57,7 @@ logger = logging.getLogger(__name__)
 # ---------------------------------------------------------------------------
 
 PACKAGE_FORMAT = "voidaccess-ioc-v1"
-PACKAGE_VERSION = "1.9.2"
+PACKAGE_VERSION = "1.9.3"
 SNORT_SID_BASE = 9000001  # 9xxxxxx reserved for VoidAccess-generated rules
 
 # Map extractor upper-case entity types to the per-file bucket they belong to.

{voidaccess-1.9.2 → voidaccess-1.9.3}/export/stix.py

@@ -18,6 +18,7 @@ from __future__ import annotations
 import json
 import logging
 import os
+import re
 import warnings
 from typing import Any, Optional
 import uuid
@@ -78,6 +79,114 @@ _STIX_PATTERNS: dict[str, str] = {
 # Entity types that map to STIX Malware objects
 _MALWARE_TYPES = frozenset({"MALWARE_FAMILY", "RANSOMWARE_GROUP"})
 
+# STIX 2.1's malware-type vocabulary is intentionally small.  Keep the
+# mapping here instead of treating every MALWARE_FAMILY as the generic
+# ``malware`` type: family names and enrichment metadata often carry enough
+# information for SIEM consumers to filter useful categories.
+_STIX_MALWARE_TYPE_ALIASES = {
+    "infostealer": "spyware",
+    "stealer": "spyware",
+    "remote_access_trojan": "remote-access-trojan",
+    "remote access trojan": "remote-access-trojan",
+    "rat": "remote-access-trojan",
+    "coinminer": "resource-exploitation",
+    "cryptominer": "resource-exploitation",
+    "crypto-miner": "resource-exploitation",
+    "miner": "resource-exploitation",
+}
+_STIX_MALWARE_TYPES = frozenset({
+    "adware",
+    "backdoor",
+    "bot",
+    "ddos",
+    "dropper",
+    "exploit-kit",
+    "keylogger",
+    "ransomware",
+    "remote-access-trojan",
+    "resource-exploitation",
+    "rootkit",
+    "screen-capture",
+    "spyware",
+    "wiper",
+    "malware",
+})
+
+# These are conservative, high-signal family/name hints.  Unknown families
+# retain the valid generic STIX type rather than being assigned a speculative
+# category.
+_MALWARE_NAME_PATTERNS = (
+    ("ransomware", re.compile(
+        r"\b(?:ransomware|lockbit|blackcat|alphv|clop|conti|ryuk|hive|revil|darkside|wannacry)\b",
+        re.IGNORECASE,
+    )),
+    ("remote-access-trojan", re.compile(
+        r"\b(?:remote\s+access\s+trojan|remcos|njrat|nanocore|quasar|darkcomet|xrat)\b",
+        re.IGNORECASE,
+    )),
+    ("spyware", re.compile(
+        r"\b(?:spyware|infostealer|stealer|redline|vidar|lumma|raccoon|agent\s+tesla|formbook)\b",
+        re.IGNORECASE,
+    )),
+    ("bot", re.compile(
+        r"\b(?:botnet|emotet|qakbot|qbot|trickbot|mirai|zeus|mozi)\b",
+        re.IGNORECASE,
+    )),
+    ("keylogger", re.compile(r"\bkeylogger\b", re.IGNORECASE)),
+    ("exploit-kit", re.compile(r"\bexploit[\s-]+kit\b", re.IGNORECASE)),
+    ("rootkit", re.compile(r"\brootkit\b", re.IGNORECASE)),
+    ("screen-capture", re.compile(r"\bscreen[\s-]+capture\b", re.IGNORECASE)),
+    ("dropper", re.compile(r"\bdropper\b", re.IGNORECASE)),
+    ("wiper", re.compile(r"\bwiper\b", re.IGNORECASE)),
+    ("adware", re.compile(r"\badware\b", re.IGNORECASE)),
+    ("resource-exploitation", re.compile(
+        r"\b(?:cryptominer|crypto[\s-]+miner|coinminer|cryptojacking)\b",
+        re.IGNORECASE,
+    )),
+    ("backdoor", re.compile(r"\bbackdoor\b", re.IGNORECASE)),
+)
+
+
+def _entity_attribute(entity: Any, name: str) -> Any:
+    """Read optional classification metadata from dicts and ORM-like rows."""
+    if isinstance(entity, dict):
+        return entity.get(name)
+    return getattr(entity, name, None)
+
+
+def _normalise_malware_type(value: Any) -> Optional[str]:
+    if not isinstance(value, str):
+        return None
+    key = value.strip().lower().replace("_", " ")
+    key = _STIX_MALWARE_TYPE_ALIASES.get(key, key)
+    key = key.replace(" ", "-")
+    return key if key in _STIX_MALWARE_TYPES else None
+
+
+def _classify_malware(entity: Any) -> list[str]:
+    """Return evidence-backed STIX malware types for an entity."""
+    entity_type = str(getattr(entity, "entity_type", "") or "").upper()
+    if isinstance(entity, dict):
+        entity_type = str(entity.get("entity_type") or "").upper()
+    if entity_type == "RANSOMWARE_GROUP":
+        return ["ransomware"]
+
+    for field_name in ("malware_types", "malware_type", "malware_category", "category", "family_type"):
+        raw = _entity_attribute(entity, field_name)
+        values = raw if isinstance(raw, (list, tuple, set)) else [raw]
+        classified = [item for item in (_normalise_malware_type(v) for v in values) if item]
+        if classified:
+            return list(dict.fromkeys(classified))
+
+    evidence = " ".join(
+        str(_entity_attribute(entity, field) or "")
+        for field in ("value", "context_snippet")
+    )
+    for malware_type, pattern in _MALWARE_NAME_PATTERNS:
+        if pattern.search(evidence):
+            return [malware_type]
+    return ["malware"]
+
 # ---------------------------------------------------------------------------
 # Confidence mapping: VoidAccess float → STIX integer (0-100)
 # ---------------------------------------------------------------------------
@@ -160,11 +269,7 @@ def entity_to_stix_malware(entity: Any) -> Optional[Any]:
         malware = stix2.Malware(
             name=entity.value,
             is_family=True,
-            malware_types=(
-                ["ransomware"]
-                if entity.entity_type == "RANSOMWARE_GROUP"
-                else ["malware"]
-            ),
+            malware_types=_classify_malware(entity),
             confidence=_to_stix_confidence(get_entity_confidence(entity)),
             allow_custom=True,
             x_voidaccess_source_quality=getattr(entity, "source_quality", 1.0),

{voidaccess-1.9.2 → voidaccess-1.9.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "voidaccess"
-version = "1.9.2"
+version = "1.9.3"
 description = "Dark web OSINT CLI — automated threat intelligence from query to report"
 readme = "README.md"
 license = "MIT"

{voidaccess-1.9.2 → voidaccess-1.9.3}/sources/email_reputation.py

@@ -555,8 +555,10 @@ def _update_email_entities_in_db(
                             existing.append(tag)
                     db_entity.corroborating_sources = json.dumps(existing)
             session.commit()
-    except Exception as exc:
-        logger.warning("email_reputation: DB update failed: %s", exc)
+    except Exception:
+        # Do not log the raw SQLAlchemy exception: its parameter dump can
+        # contain the full email address being enriched.
+        logger.warning("email_reputation: DB update failed")
 
 
 # ---------------------------------------------------------------------------

{voidaccess-1.9.2 → voidaccess-1.9.3}/tests/test_api.py

@@ -38,15 +38,21 @@ def _make_client():
     """Create a FastAPI TestClient. Import deferred so pytest collection doesn't fail without fastapi."""
     from fastapi.testclient import TestClient  # noqa: PLC0415
     from api.main import app  # noqa: PLC0415
-    from api.auth import get_current_user
+    from api.auth import CurrentUser, get_current_user, require_password_not_reset_pending
+    from db.models import User
     from unittest.mock import MagicMock
 
-    mock_user = MagicMock()
-    mock_user.id = 1
-    mock_user.email = "test@example.com"
-    mock_user.is_active = True
+    mock_user = User(
+        id=1,
+        email="test@example.com",
+        hashed_password="test-hash",
+        is_active=True,
+        must_reset_password=False,
+    )
 
-    app.dependency_overrides[get_current_user] = lambda: mock_user
+    current = CurrentUser(user=mock_user, jti="test-jti")
+    app.dependency_overrides[get_current_user] = lambda: current
+    app.dependency_overrides[require_password_not_reset_pending] = lambda: current
     client = TestClient(app, raise_server_exceptions=False)
     return client
 
@@ -68,19 +74,20 @@ class TestHealth(unittest.TestCase):
         resp = client.get("/health")
         data = resp.json()
         self.assertIn("status", data)
-        self.assertIn("db", data)
-        self.assertIn("tor", data)
-        self.assertEqual(data["status"], "ok")
+        self.assertIn("checks", data)
+        self.assertIn("database", data["checks"])
+        self.assertIn("tor", data["checks"])
+        self.assertEqual(data["status"], "degraded")
 
     def test_health_db_is_bool(self):
         client = _make_client()
         data = client.get("/health").json()
-        self.assertIsInstance(data["db"], bool)
+        self.assertIsInstance(data["checks"]["database"], str)
 
     def test_health_tor_is_bool(self):
         client = _make_client()
         data = client.get("/health").json()
-        self.assertIsInstance(data["tor"], bool)
+        self.assertIsInstance(data["checks"]["tor"], str)
 
 
 # ===========================================================================
@@ -148,7 +155,7 @@ class TestInvestigationsPost(unittest.TestCase):
     def test_request_model_defaults_to_none(self):
         from api.routes.investigations import InvestigationRequest
         req = InvestigationRequest(query="test")
-        self.assertIsNone(req.model)
+        self.assertEqual(req.model, "openrouter/deepseek/deepseek-chat")
 
 
 # ===========================================================================
@@ -202,15 +209,15 @@ class TestEntities(unittest.TestCase):
         client = _make_client()
         resp = client.get("/entities")
         self.assertEqual(resp.status_code, 200)
-        self.assertIsInstance(resp.json(), list)
+        self.assertIsInstance(resp.json(), dict)
+        self.assertEqual(resp.json()["items"], [])
 
-    @patch("api.routes.entities.os.getenv", return_value="postgresql://test")
+    @patch("api.routes.entities.os.getenv", return_value=None)
     def test_get_entities_with_entity_type_filter(self, mock_env):
-        # Mock the DB session chain
-        with patch("api.routes.entities.Session", create=True):
-            client = _make_client()
-            resp = client.get("/entities?entity_type=BITCOIN_ADDRESS")
-            self.assertEqual(resp.status_code, 200)
+        client = _make_client()
+        resp = client.get("/entities?entity_type=BITCOIN_ADDRESS")
+        self.assertEqual(resp.status_code, 200)
+        self.assertEqual(resp.json()["items"], [])
 
     @patch("api.routes.entities._get_entity_value", return_value=None)
     @patch("api.routes.entities.os.getenv", return_value="postgresql://test")
@@ -268,15 +275,12 @@ class TestSearch(unittest.TestCase):
     def test_semantic_search_returns_list(self, mock_search):
         with patch.dict("sys.modules", {"vector.search": MagicMock(find_related_pages=mock_search)}):
             client = _make_client()
-            resp = client.post(
-                "/search/semantic",
-                json={"query": "ransomware payment", "n_results": 5},
-            )
+            resp = client.get("/search/semantic?q=ransomware%20payment&n=5")
             self.assertEqual(resp.status_code, 200)
             data = resp.json()
             self.assertIsInstance(data, dict)
-            self.assertIn("items", data)
-            self.assertIn("total", data)
+            self.assertIn("results", data)
+            self.assertIn("warnings", data)
 
     @patch("api.routes.search.os.getenv", return_value=None)
     def test_entity_search_returns_list(self, mock_env):
@@ -286,7 +290,8 @@ class TestSearch(unittest.TestCase):
             json={"query": "LockBit", "entity_types": ["MALWARE_FAMILY"]},
         )
         self.assertEqual(resp.status_code, 200)
-        self.assertIsInstance(resp.json(), list)
+        self.assertIsInstance(resp.json(), dict)
+        self.assertEqual(resp.json()["items"], [])
 
     @patch("api.routes.search.os.getenv", return_value=None)
     def test_entity_search_without_type_filter(self, mock_env):
@@ -313,9 +318,11 @@ class TestExportStix(unittest.TestCase):
         "api.routes.export._resolve_internal_investigation_id",
         return_value=uuid.UUID(_VALID_UUID),
     )
+    @patch("api.routes.export._check_investigation_owner")
+    @patch("export.stix._load_entities_for_investigation", return_value=[MagicMock()])
     @patch("api.routes.export.investigation_to_stix_bundle", create=True)
     @patch("api.routes.export.bundle_to_json", return_value='{"type":"bundle","id":"bundle--1","objects":[]}', create=True)
-    def test_stix_returns_200(self, mock_json, mock_bundle, _mock_resolve):
+    def test_stix_returns_200(self, mock_json, mock_bundle, _mock_entities, _mock_owner, _mock_resolve):
         mock_bundle.return_value = self._mock_bundle()
         with patch.dict("sys.modules", {
             "export.stix": MagicMock(
@@ -365,9 +372,11 @@ class TestExportMisp(unittest.TestCase):
         "api.routes.export._resolve_internal_investigation_id",
         return_value=uuid.UUID(_VALID_UUID),
     )
+    @patch("api.routes.export._check_investigation_owner")
+    @patch("export.stix._load_entities_for_investigation", return_value=[MagicMock()])
     @patch("export.misp.investigation_to_misp_event")
     @patch("export.misp.misp_event_to_json")
-    def test_misp_returns_200(self, mock_json, mock_event, _mock_resolve):
+    def test_misp_returns_200(self, mock_json, mock_event, _mock_entities, _mock_owner, _mock_resolve):
         mock_event.return_value = {"Event": {"info": "VoidAccess Investigation: test", "Attribute": []}}
         mock_json.return_value = '{"Event": {"info": "VoidAccess Investigation: test", "Attribute": []}}'
         client = _make_client()
@@ -378,9 +387,11 @@ class TestExportMisp(unittest.TestCase):
         "api.routes.export._resolve_internal_investigation_id",
         return_value=uuid.UUID(_VALID_UUID),
     )
+    @patch("api.routes.export._check_investigation_owner")
+    @patch("export.stix._load_entities_for_investigation", return_value=[MagicMock()])
     @patch("export.misp.investigation_to_misp_event")
     @patch("export.misp.misp_event_to_json")
-    def test_misp_correct_structure(self, mock_json, mock_event, _mock_resolve):
+    def test_misp_correct_structure(self, mock_json, mock_event, _mock_entities, _mock_owner, _mock_resolve):
         event_dict = {
             "Event": {
                 "info": "VoidAccess Investigation: test",
@@ -450,14 +461,16 @@ class TestGraphConfidenceFilter(unittest.TestCase):
     @patch("db.session.get_session")
     @patch("db.queries.get_investigation_by_id_or_run")
     @patch("graph.builder.build_graph_from_db")
+    @patch("graph.build_graph_from_db_cached")
     @patch("graph.export.to_json")
-    def test_graph_confidence_filter(self, mock_to_json, mock_build, mock_get_inv, mock_session):
+    @patch("graph.export.summary_stats", return_value={})
+    def test_graph_confidence_filter(self, mock_summary, mock_to_json, mock_build_cached, mock_build, mock_get_inv, mock_session):
         from unittest.mock import MagicMock
         from datetime import datetime, timezone
 
         mock_inv = MagicMock()
         mock_inv.id = 1
-        mock_inv.graph_status = "completed"
+        mock_inv.graph_status = "built"
         mock_get_inv.return_value = mock_inv
 
         mock_session_instance = MagicMock()
@@ -466,7 +479,13 @@ class TestGraphConfidenceFilter(unittest.TestCase):
         mock_session.return_value = mock_session_instance
         mock_session_instance.query.return_value.filter.return_value.scalar.return_value = 10
 
-        mock_graph = MagicMock()
+        class _Graph:
+            @staticmethod
+            def degree(_node_id):
+                return 1
+
+        mock_graph = _Graph()
+        mock_build_cached.return_value = mock_graph
         mock_build.return_value = mock_graph
         mock_to_json.return_value = {
             "nodes": [
@@ -483,13 +502,8 @@ class TestGraphConfidenceFilter(unittest.TestCase):
         data = resp.json()
         self.assertIn("nodes", data)
         self.assertIn("edges", data)
-        self.assertIn("graph_status", data)
-        self.assertIn("total_entities", data)
-        self.assertIn("filtered_entities", data)
-        self.assertIn("min_confidence", data)
-        self.assertEqual(data["min_confidence"], 0.9)
-        self.assertEqual(data["total_entities"], 2)
-        self.assertEqual(data["filtered_entities"], 1)
+        self.assertEqual(data["status"], "complete")
+        self.assertIn("summary_stats", data)
 
 
 # ===========================================================================
@@ -506,7 +520,7 @@ class TestGraphOverflow(unittest.TestCase):
 
         mock_inv = MagicMock()
         mock_inv.id = 1
-        mock_inv.graph_status = "skipped_overflow"
+        mock_inv.graph_status = "pending"
         mock_get_inv.return_value = mock_inv
 
         mock_session_instance = MagicMock()
@@ -520,11 +534,7 @@ class TestGraphOverflow(unittest.TestCase):
 
         self.assertEqual(resp.status_code, 200)
         data = resp.json()
-        self.assertEqual(data["graph_status"], "skipped_overflow")
-        self.assertEqual(data["nodes"], [])
-        self.assertEqual(data["edges"], [])
-        self.assertIn("message", data)
-        self.assertIn("total_entities", data)
+        self.assertEqual(data["status"], "pending")
 
 
 # ===========================================================================
@@ -536,16 +546,19 @@ class TestCsvExport(unittest.TestCase):
 
     @patch("db.session.get_session")
     @patch("db.queries.get_investigation_by_id_or_run")
-    def test_csv_export(self, mock_get_inv, mock_session):
+    @patch("api.routes.investigations.os.getenv", return_value="postgresql://test")
+    def test_csv_export(self, mock_getenv, mock_get_inv, mock_session):
         from unittest.mock import MagicMock
 
         mock_inv = MagicMock()
         mock_inv.id = 1
+        mock_inv.user_id = 1
         mock_get_inv.return_value = mock_inv
 
         mock_ent = MagicMock()
         mock_ent.entity_type = "EMAIL_ADDRESS"
-        mock_ent.canonical_value = "test@example.com"
+        mock_ent.value = "test@example.com"
+        mock_ent.canonical_value = None
         mock_ent.confidence = 0.95
         mock_ent.context_snippet = "Test context"
         mock_ent.page = MagicMock(url="http://example.com/page")
@@ -577,7 +590,8 @@ class TestCsvExport(unittest.TestCase):
 
     def test_csv_export_auth(self):
         from fastapi import HTTPException
-        with patch("db.session.get_session") as mock_session:
+        with patch("api.routes.investigations.os.getenv", return_value="postgresql://test"), \
+             patch("db.session.get_session") as mock_session:
             mock_session.side_effect = HTTPException(status_code=401, detail="Invalid or expired token")
             client = _make_client()
             resp = client.get(f"/investigations/{_VALID_UUID}/entities/export/csv")

{voidaccess-1.9.2 → voidaccess-1.9.3}/tests/test_confidence_calibration.py

@@ -18,17 +18,17 @@ def test_confidence_tiers_assign_expected_base_scores():
 def test_normalize_entities_uses_base_tier():
     entities = normalize_entities(
         {
-            "BITCOIN_ADDRESS": ["bc1qtestaddress0000000000000000000000000"],
+            "BITCOIN_ADDRESS": ["1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2"],
             "THREAT_ACTOR_HANDLE": ["shadowfox"],
         },
         page_url="https://example.com/post",
         page_id=None,
-        page_text="shadowfox and bc1qtestaddress0000000000000000000000000",
+        page_text="shadowfox and 1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2",
     )
 
     scores = {entity.entity_type: entity.confidence for entity in entities}
-    assert scores["BITCOIN_ADDRESS"] == 1.0
-    assert scores["THREAT_ACTOR_HANDLE"] == 0.82
+    assert scores["BITCOIN_ADDRESS"] == 0.94
+    assert scores["THREAT_ACTOR_HANDLE"] == 0.717
 
 
 def test_placeholder_entities_stay_at_or_below_threshold():
@@ -62,8 +62,8 @@ def test_occurrence_boost_caps_at_five_hundredths():
 
     assert original_count == 8
     assert len(capped) == 8
-    assert {round(entity.confidence, 2) for entity in capped} == {0.87}
-    assert max(entity.confidence for entity in capped) <= 0.87
+    assert {round(entity.confidence, 2) for entity in capped} == {0.97}
+    assert max(entity.confidence for entity in capped) <= 0.97
 
 
 def test_apply_entity_cap_culls_low_confidence_and_placeholders():
@@ -102,7 +102,9 @@ def test_apply_entity_cap_culls_low_confidence_and_placeholders():
     capped, original_count = apply_entity_cap(entities, cap=50, investigation_id=None)
 
     assert original_count == 4
-    assert len(capped) == 2
+    assert len(capped) == 3
     assert all(entity.confidence >= 0.80 for entity in capped)
     assert all(entity.source_quality != 0.0 for entity in capped)
-    assert {entity.entity_type for entity in capped} == {"BITCOIN_ADDRESS", "THREAT_ACTOR_HANDLE"}
+    assert {entity.entity_type for entity in capped} == {
+        "BITCOIN_ADDRESS", "THREAT_ACTOR_HANDLE", "ORGANIZATION_NAME"
+    }

{voidaccess-1.9.2 → voidaccess-1.9.3}/tests/test_db.py

@@ -510,6 +510,7 @@ class TestSessionFactory:
         """get_engine() with no URL and no DATABASE_URL env var must raise clearly."""
         import db.session as sess_module
 
+        monkeypatch.delenv("DATABASE_URL", raising=False)
         monkeypatch.setattr(sess_module, "DATABASE_URL", None)
         with pytest.raises(RuntimeError, match="DATABASE_URL"):
             sess_module.get_engine(url=None)

{voidaccess-1.9.2 → voidaccess-1.9.3}/tests/test_llm.py

@@ -39,6 +39,16 @@ def test_select_relevant_pages_fits_budget():
     assert len(result) == 5
 
 
+def test_select_relevant_pages_selects_embedding_model_before_small_run_shortcut():
+    """The fallback notice path is reached even when ranking is unnecessary."""
+    from unittest.mock import MagicMock, patch
+
+    pages = [make_page("x" * 100)]
+    with patch("voidaccess.llm._get_embed_model", return_value=MagicMock()) as get_model:
+        assert select_relevant_pages("test query", pages, max_chars=10000) == pages
+    get_model.assert_called_once()
+
+
 def test_select_relevant_pages_trims_to_budget():
     """Pages exceeding budget are trimmed."""
     pages = [make_page("x" * 3000, f"http://{i}.onion") for i in range(20)]

{voidaccess-1.9.2 → voidaccess-1.9.3}/tests/test_llm_utils.py

@@ -91,7 +91,7 @@ def test_get_llm_unknown_prefix_fallback(caplog):
     from voidaccess.llm_utils import resolve_model_config
     from langchain_openai import ChatOpenAI
 
-    with caplog.at_level(logging.WARNING, logger="llm_utils"):
+    with caplog.at_level(logging.WARNING):
         config = resolve_model_config("totally-unknown-provider/some-model")
 
     assert config is not None

{voidaccess-1.9.2 → voidaccess-1.9.3}/tests/test_regex_patterns.py

@@ -477,9 +477,9 @@ def test_normalize_entities_produces_normalized_records():
         by_type.setdefault(rec.entity_type, []).append(rec)
 
     assert LITECOIN_ADDRESS in by_type
-    assert by_type[LITECOIN_ADDRESS][0].confidence == 0.90
+    assert by_type[LITECOIN_ADDRESS][0].confidence == 0.94
     assert DOGECOIN_ADDRESS in by_type
-    assert by_type[DOGECOIN_ADDRESS][0].confidence == 0.90
+    assert by_type[DOGECOIN_ADDRESS][0].confidence == 0.94
 
 
 # ---------------------------------------------------------------------------
@@ -983,15 +983,15 @@ def test_credential_normalizer_round_trip():
         by_type.setdefault(rec.entity_type, []).append(rec)
 
     assert AWS_ACCESS_KEY in by_type
-    assert by_type[AWS_ACCESS_KEY][0].confidence == 1.0
+    assert by_type[AWS_ACCESS_KEY][0].confidence == 0.94
     assert GITHUB_TOKEN in by_type
-    assert by_type[GITHUB_TOKEN][0].confidence == 1.0
+    assert by_type[GITHUB_TOKEN][0].confidence == 0.94
     assert STRIPE_KEY in by_type
-    assert by_type[STRIPE_KEY][0].confidence == 1.0
+    assert by_type[STRIPE_KEY][0].confidence == 0.94
     assert GOOGLE_API_KEY in by_type
-    assert by_type[GOOGLE_API_KEY][0].confidence == 1.0
+    assert by_type[GOOGLE_API_KEY][0].confidence == 0.94
     assert JWT_TOKEN in by_type
-    assert by_type[JWT_TOKEN][0].confidence == 1.0
+    assert by_type[JWT_TOKEN][0].confidence == 0.94
 
 
 # --- 8.11. Graph integration ----------------------------------------------
@@ -1461,34 +1461,34 @@ def test_messaging_normalizer_round_trip():
 
     # Spot-check each type survived with the right confidence
     assert TELEGRAM_HANDLE in by_type
-    assert by_type[TELEGRAM_HANDLE][0].confidence == 0.90
+    assert by_type[TELEGRAM_HANDLE][0].confidence == 0.94
     assert by_type[TELEGRAM_HANDLE][0].value == "lockbitsupport"
 
     assert DISCORD_HANDLE in by_type
-    assert by_type[DISCORD_HANDLE][0].confidence == 0.90
+    assert by_type[DISCORD_HANDLE][0].confidence == 0.94
 
     assert XMPP_JID in by_type
-    assert by_type[XMPP_JID][0].confidence == 0.90
+    assert by_type[XMPP_JID][0].confidence == 0.94
     assert by_type[XMPP_JID][0].value == "lockbit@exploit.im"
 
     assert TOX_ID in by_type
-    assert by_type[TOX_ID][0].confidence == 1.0
+    assert by_type[TOX_ID][0].confidence == 0.94
 
     assert SESSION_ID in by_type
-    assert by_type[SESSION_ID][0].confidence == 1.0
+    assert by_type[SESSION_ID][0].confidence == 0.94
 
     assert MATRIX_HANDLE in by_type
-    assert by_type[MATRIX_HANDLE][0].confidence == 1.0
+    assert by_type[MATRIX_HANDLE][0].confidence == 0.94
     assert by_type[MATRIX_HANDLE][0].value == "@lockbitsupport:matrix.org"
 
     assert ICQ_NUMBER in by_type
-    assert by_type[ICQ_NUMBER][0].confidence == 0.90
+    assert by_type[ICQ_NUMBER][0].confidence == 0.94
 
     assert WICKR_ID in by_type
-    assert by_type[WICKR_ID][0].confidence == 0.90
+    assert by_type[WICKR_ID][0].confidence == 0.94
 
     assert WIRE_HANDLE in by_type
-    assert by_type[WIRE_HANDLE][0].confidence == 0.90
+    assert by_type[WIRE_HANDLE][0].confidence == 0.94
 
 
 # --- 9.11. Context helper ---------------------------------------------------
@@ -2136,23 +2136,23 @@ def test_network_forensic_normalizer_round_trip():
 
     # Spot-check each type survived with the right confidence + canonical form
     assert IPV6_ADDRESS in by_type
-    assert by_type[IPV6_ADDRESS][0].confidence == 1.0
+    assert by_type[IPV6_ADDRESS][0].confidence == 0.94
     assert by_type[IPV6_ADDRESS][0].value == "2001:0db8:85a3:0000:0000:8a2e:0370:7334"
 
     assert MAC_ADDRESS in by_type
-    assert by_type[MAC_ADDRESS][0].confidence == 1.0
+    assert by_type[MAC_ADDRESS][0].confidence == 0.94
     # Hyphen form was canonicalised to colon form
     assert by_type[MAC_ADDRESS][0].value == "AA:BB:CC:DD:EE:FF"
 
     assert IPFS_CID in by_type
-    assert by_type[IPFS_CID][0].confidence == 1.0
+    assert by_type[IPFS_CID][0].confidence == 0.94
 
     assert MITRE_TACTIC in by_type
-    assert by_type[MITRE_TACTIC][0].confidence == 1.0
+    assert by_type[MITRE_TACTIC][0].confidence == 0.94
     assert by_type[MITRE_TACTIC][0].value == "TA0001"
 
     assert EXPLOIT_DB_ID in by_type
-    assert by_type[EXPLOIT_DB_ID][0].confidence == 1.0
+    assert by_type[EXPLOIT_DB_ID][0].confidence == 0.94
     assert by_type[EXPLOIT_DB_ID][0].value == "12345"
 
     assert CVE_NUMBER in by_type