From cd9020f1c5e150b6746c28728d774b76e39515e3 Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Tue, 30 Jun 2026 17:10:45 +0900
Subject: [PATCH] Map Strix JSON target paths to PR changes

---
 scripts/ci/strix_quick_gate.sh      |  1 +
 scripts/ci/test_strix_quick_gate.sh | 59 +++++++++++++++++++++++++++++
 2 files changed, 60 insertions(+)

diff --git a/scripts/ci/strix_quick_gate.sh b/scripts/ci/strix_quick_gate.sh
index 0dcbc6240..0e9f92ac9 100755
--- a/scripts/ci/strix_quick_gate.sh
+++ b/scripts/ci/strix_quick_gate.sh
@@ -1713,6 +1713,7 @@ text = Path(sys.argv[1]).read_text(encoding='utf-8', errors='replace')
 patterns = [
     re.compile(r'(?P<path>/workspace/[^`\r\n]*\.[A-Za-z0-9_]+|[A-Za-z0-9_./ \[\]-]+\.[A-Za-z0-9_]+):\d+'),
     re.compile(r'(?P<path>/workspace/[A-Za-z0-9_./ \[\]-]*(?:Dockerfile|Containerfile|Makefile))'),
+    re.compile(r'["\'](?:target|file|path)["\']\s*:\s*["\'](?P<path>/workspace/[^"`\r\n]*\.[A-Za-z0-9_]+|[A-Za-z0-9_./\[\]-][A-Za-z0-9_./ \[\]-]*\.[A-Za-z0-9_]+)["\']', re.IGNORECASE),
     re.compile(r'<file>\s*(?P<path>/workspace/[^<`\r\n│]*\.[A-Za-z0-9_]+|[A-Za-z0-9_./\[\]-][A-Za-z0-9_./ \[\]-]*\.[A-Za-z0-9_]+)\s*</file>'),
     re.compile(r'^[^\S\r\n│]*[│]?[ \t]*(?:\*\*)?Target:(?:\*\*)?[ \t]*(?:File:[ \t]*)?(?P<path>/workspace/[^`\r\n│]*\.[A-Za-z0-9_]+|[A-Za-z0-9_./\[\]-][A-Za-z0-9_./ \[\]-]*\.[A-Za-z0-9_]+)', re.MULTILINE),
     re.compile(r'^[^\S\r\n│]*[│]?[ \t]*(?:\*\*)?Target:(?:\*\*)?[ \t]*(?:File:[ \t]*)?(?P<path>/workspace/[A-Za-z0-9_./ \[\]-]*(?:Dockerfile|Containerfile|Makefile)|(?:Dockerfile|Containerfile|Makefile))', re.MULTILINE),
diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh
index 3cbd47641..c1d4f9e59 100755
--- a/scripts/ci/test_strix_quick_gate.sh
+++ b/scripts/ci/test_strix_quick_gate.sh
@@ -3823,6 +3823,19 @@ EOS
 		echo "Penetration test failed: changed internal dot-directory target"
 		exit 1
 		;;
+	pr-critical-changed-json-target)
+		mkdir -p "$STRIX_REPORTS_DIR/fake-pr-changed-json-target/vulnerabilities"
+		cat >"$STRIX_REPORTS_DIR/fake-pr-changed-json-target/vulnerabilities/vuln-0001.md" <<EOS
+**Severity:** MEDIUM
+{
+  "severity": "medium",
+  "target": "/workspace/$(basename -- "$target_path")/frontend/src/components/CalendarLayout.tsx",
+  "title": "Missing CSRF Protection in Calendar API Endpoints"
+}
+EOS
+		echo "Penetration test failed: changed JSON target"
+		exit 1
+		;;
 	pr-critical-changed-subdir-target)
 		mkdir -p "$STRIX_REPORTS_DIR/fake-pr-changed-subdir/vulnerabilities"
 		cat >"$STRIX_REPORTS_DIR/fake-pr-changed-subdir/vulnerabilities/vuln-0001.md" <<'EOS'
@@ -4275,6 +4288,9 @@ EOS
 	elif [ "$scenario" = "pr-critical-changed-internal-dotdir-target" ]; then
 		mkdir -p "$repo_root_dir/.github/workflows"
 		echo 'name: OpenCode Review' >"$repo_root_dir/.github/workflows/opencode-review.yml"
+	elif [ "$scenario" = "pr-critical-changed-json-target" ]; then
+		mkdir -p "$repo_root_dir/frontend/src/components"
+		echo 'export function CalendarLayout() { return null }' >"$repo_root_dir/frontend/src/components/CalendarLayout.tsx"
 	elif [ "$scenario" = "opencode-documented-env-api-key-fallback-success" ]; then
 		mkdir -p "$repo_root_dir/.github/workflows"
 		cat >"$repo_root_dir/.github/workflows/opencode-review.yml" <<'EOS'
@@ -4639,6 +4655,28 @@ run_filtered_gate_case_if_requested() {
 			"vertex_ai/missing-primary|vertex_ai/fallback-one" \
 			"<unset>|<unset>"
 		;;
+	pr-critical-changed-json-target)
+		run_gate_case "pr-critical-changed-json-target" \
+			"vertex_ai/gemini-2.5-pro" \
+			"" \
+			"1" \
+			"Strix finding intersects files changed in this pull request." \
+			"1" \
+			"vertex_ai/gemini-2.5-pro" \
+			"<unset>" \
+			"vertex_ai" \
+			"__DEFAULT__" \
+			"" \
+			"0" \
+			"MEDIUM" \
+			"0" \
+			"" \
+			"" \
+			"1200" \
+			"0" \
+			"pull_request" \
+			"frontend/src/components/CalendarLayout.tsx"
+		;;
 	*)
 		record_failure "unknown STRIX_TEST_CASE_FILTER '${STRIX_TEST_CASE_FILTER:-}'"
 		;;
@@ -9180,6 +9218,27 @@ run_gate_case "pr-critical-changed-internal-dotdir-target" \
 	"pull_request" \
 	".github/workflows/opencode-review.yml"
 
+run_gate_case "pr-critical-changed-json-target" \
+	"vertex_ai/gemini-2.5-pro" \
+	"" \
+	"1" \
+	"Strix finding intersects files changed in this pull request." \
+	"1" \
+	"vertex_ai/gemini-2.5-pro" \
+	"<unset>" \
+	"vertex_ai" \
+	"__DEFAULT__" \
+	"" \
+	"0" \
+	"MEDIUM" \
+	"0" \
+	"" \
+	"" \
+	"1200" \
+	"0" \
+	"pull_request" \
+	"frontend/src/components/CalendarLayout.tsx"
+
 run_gate_case "pr-critical-changed-subdir-target" \
 	"openai/gpt-4o-mini" \
 	"" \