Surface heuristic scanner failures instead of swallowing at Debug (#140) - #141
Merged
Conversation
Get-MsixHeuristicFinding runs each read-only scanner in its own try/catch so one broken scanner can't abort the analysis, but the catch swallowed the failure at Debug level - a scanner failing for an environmental reason (missing DLL, absent tool, denied path in a headless image) silently dropped an entire finding category, and the report looked identical to a clean package. - _MsixAddScannerError: logs Warning + appends a low-severity ScannerError finding naming the scanner + error. AllowEmptyCollection so it binds even when the first scanner fails before any finding is added. - _MsixAddOffregScannerError: registry-derived scanners defer to the single OfflineRegistryUnavailable umbrella finding when offreg.dll is absent (no redundant per-scanner ScannerError); genuine failures while offreg is present still surface. - Route every Debug-swallow catch in Get-MsixHeuristicFinding through these. - Wrap + gate the Run-key scanner (offreg-dependent, previously UNWRAPPED - it could abort the whole analysis on a host without offreg.dll). Wrap the Uninstaller and Alias loops too for consistency. - _MsixTestOffregAvailable probe catch now Debug-logs (issue minor point). - Regression tests in MSIX.ScannerError.Tests.ps1; bump 0.73.4 + notes/CHANGELOG. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #140.
Problem
Get-MsixHeuristicFindingruns each read-only scanner in its owntry { … } catch { Write-MsixLog -Level Debug … }. Swallowing at Debug means a scanner that fails for an environmental reason (missing DLL, absent tool, denied path in a headless image) silently drops an entire finding category — and the report looks identical to a genuinely clean package. 0.73.3 fixed the specificoffreg.dllcase; this generalizes the pattern.Changes
_MsixAddScannerError— on a scanner throw, logs at Warning and appends a low-severityScannerErrorfinding naming the scanner + underlying error.[AllowEmptyCollection()]so it binds even when the first scanner fails before any finding is added (caught by a test — would have been a real bind failure)._MsixAddOffregScannerError— the 6 registry-derived scanners (ShellExt/ShellVerb, services, preview/property/thumbnail handlers, uninstall keys, run keys, COM servers) defer to the singleOfflineRegistryUnavailableumbrella finding whenoffreg.dllis absent, so they don't emit 6 redundantScannerErrorfindings for one root cause. A genuine failure while offreg is present still surfaces.catchinGet-MsixHeuristicFindingnow routes through the right helper.offreg.dllit threwDllNotFoundExceptionthat aborted the whole analysis. Now wrapped + gated. The Uninstaller and Alias loops were wrapped too for consistency.catchin_MsixTestOffregAvailablenow Debug-logs."Expected empty vs failed"
The issue asks to distinguish scanner ran, found nothing from scanner threw. This is structurally satisfied: a
catchonly fires on a throw; an empty result simply adds no finding and never enters the catch. No extra detection needed.Validation
MSIX.Tests/MSIX.ScannerError.Tests.ps1: 4/4 pass (unit-tests both helpers incl. the offreg-suppression path).Newly-surfaced latent bug (follow-up, not fixed here)
Running the suite now logs
Heuristic scanner 'ManifestFix' failed … null-valued expressionagainst a fixture — a pre-existing NRE in the ManifestFix block that was silently swallowed before and is now visible (exactly what #140 is meant to expose). Tests pass (nothing asserts on it). Worth a separate issue to fix the NRE so those manifest-fix findings aren't dropped for that manifest shape.No release cut.
🤖 Generated with Claude Code