Skip to content

fix(detectors): reject null trust threshold - #555

Open
DevaanshPathak wants to merge 2 commits into
GenAI-Security-Project:mainfrom
DevaanshPathak:agent/fix-issue-126-trust-threshold-config
Open

fix(detectors): reject null trust threshold#555
DevaanshPathak wants to merge 2 commits into
GenAI-Security-Project:mainfrom
DevaanshPathak:agent/fix-issue-126-trust-threshold-config

Conversation

@DevaanshPathak

Copy link
Copy Markdown

Summary

  • reject an explicitly configured min_amount=None during detector initialization
  • preserve the existing default-threshold behavior when the configuration key is omitted
  • add focused regression coverage for null, omitted, and valid positive values

Root cause

The validation guard checked whether the retrieved value was non-null rather than whether the configuration key was present. This made an explicit null value indistinguishable from an omitted setting during validation, even though later lookup returned the null value instead of the default threshold.

Impact

Invalid configuration now fails fast with a clear ValueError instead of allowing the detector to initialize and later crash with a TypeError while processing a qualifying approval event.

Testing

  • uv run pytest tests/unit/ctf/test_invoice_trust_override_config.py — 3 passed
  • uv run pytest tests/unit/ctf — 30 passed, 1 skipped
  • uv run black --check tests/unit/ctf/test_invoice_trust_override_config.py
  • uv run isort --check-only finbot/ctf/detectors/implementations/invoice_trust_override.py tests/unit/ctf/test_invoice_trust_override_config.py

Fixes #126

@DevaanshPathak
DevaanshPathak marked this pull request as ready for review August 4, 2026 17:44
Copilot AI lite review requested due to automatic review settings August 4, 2026 17:44

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request fixes configuration validation in InvoiceTrustOverrideDetector so an explicitly configured min_amount=None is rejected during initialization, avoiding a later runtime TypeError when comparing an invoice amount to None.

Changes:

  • Update _validate_config to validate min_amount based on key presence (reject explicit None, still allow omission).
  • Add unit tests covering explicit None, omitted min_amount, and a valid positive value.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
finbot/ctf/detectors/implementations/invoice_trust_override.py Adjusts config validation to treat an explicit min_amount=None as invalid while preserving omitted-key default behavior.
tests/unit/ctf/test_invoice_trust_override_config.py Adds regression tests for min_amount being None, omitted, and positive.
Suppressed comments (1)

tests/unit/ctf/test_invoice_trust_override_config.py:22

  • To verify the default-threshold behavior when min_amount is omitted, assert that a config lookup falls back to DEFAULT_MIN_AMOUNT (rather than only asserting detector.config == {}).
    assert detector.config == {}

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread tests/unit/ctf/test_invoice_trust_override_config.py
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug_029_MUST_FIX: Test Case DET-CFG-009 InvoiceTrustOverrideDetector silently accepts min_amount=None

2 participants