Skip to content

fix(frameworks): stop prose and image mime types from faking magento - #322

Merged
vmfunc merged 2 commits into
vmfunc:mainfrom
TBX3D:fix/magento-detector-accuracy
Jul 22, 2026
Merged

fix(frameworks): stop prose and image mime types from faking magento#322
vmfunc merged 2 commits into
vmfunc:mainfrom
TBX3D:fix/magento-detector-accuracy

Conversation

@TBX3D

@TBX3D TBX3D commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

the bare "Magento" body word matched any page that merely named the
platform, and "mage/" is a substring of the near-ubiquitous "image/"
mime type, so a migration guide carrying a single image reference
scored both signatures and cleared the detection threshold. key on the
frontend static-asset base, the data-mage-init widget attribute and the
module namespace, which only appear when magento actually rendered the
page.

@TBX3D
TBX3D requested a review from vmfunc as a code owner July 3, 2026 23:56
@github-actions github-actions Bot added size/s <50 lines changed scan changes to scan engine tests test changes labels Jul 3, 2026
@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown

pr summary

2 files changed (+7 -2)

category files
go source 2
tests 1

@codecov-commenter

codecov-commenter commented Jul 3, 2026

Copy link
Copy Markdown

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@6500b08). Learn more about missing BASE report.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #322   +/-   ##
=======================================
  Coverage        ?   64.80%           
=======================================
  Files           ?       86           
  Lines           ?     7630           
  Branches        ?        0           
=======================================
  Hits            ?     4945           
  Misses          ?     2301           
  Partials        ?      384           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

the bare "Magento" body word matched any page that merely named the
platform, and "mage/" is a substring of the near-ubiquitous "image/"
mime type, so a migration guide carrying a single image reference
scored both signatures and cleared the detection threshold. key on the
frontend static-asset base, the data-mage-init widget attribute and the
module namespace, which only appear when magento actually rendered the
page.
@TBX3D
TBX3D force-pushed the fix/magento-detector-accuracy branch from 6dcd844 to c00e003 Compare July 9, 2026 23:52
@github-actions github-actions Bot added size/xs <10 lines changed and removed size/s <50 lines changed labels Jul 9, 2026

@vmfunc vmfunc left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

diagnosis is right, "image/" contains "mage/" as a substring and bare "Magento" caught any page that named it. new anchors are all structural. checked against detector.go: totalWeight 1.4, sigmoid centers at 0.3, so a single 0.4 marker lands at 0.286 and won't trip, you need two real signals to clear the threshold. good fp resistance and recall holds since real magento carries data-mage-init + /static/frontend/ + Magento_ together. in.

# Conflicts:
#	internal/scan/frameworks/detectors/accuracy_test.go
Copilot AI review requested due to automatic review settings July 22, 2026 22:02

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

@vmfunc
vmfunc enabled auto-merge (squash) July 22, 2026 22:02
@vmfunc
vmfunc merged commit 7d206ad into vmfunc:main Jul 22, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

scan changes to scan engine size/xs <10 lines changed tests test changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants