trace/BUG_REPORT.md

Bug Report - Code Review Findings

Critical Bugs

1. IOC Extraction Order Inconsistency (models.py)

Location: models.py:32-92 vs models.py:100-162

Issue: The extract_iocs() method extracts domains BEFORE URLs, while extract_iocs_from_text() extracts URLs BEFORE domains. This causes inconsistent behavior and duplicate IOC extraction.

Impact:

• In extract_iocs(): URL https://evil.com/path will extract both evil.com (as domain) and https://evil.com/path (as URL)
• In extract_iocs_from_text(): Only the full URL is extracted (correct behavior)

Lines:

• extract_iocs(): Lines 51-64 (domains), then 59-64 (URLs) ❌
• extract_iocs_from_text(): Lines 119-124 (URLs), then 126-132 (domains) ✅

Fix: URLs should be checked BEFORE domains in extract_iocs() to prevent domain extraction from within URLs.

---

2. Overlapping IOC Highlights (models.py:165-203)

Location: models.py:165-203

Issue: extract_iocs_with_positions() doesn't prevent overlapping highlights. URLs containing domains will have both the URL and domain highlighted, causing visual overlap.

Impact: In the TUI, text like https://evil.com/path would be highlighted twice - once for the URL and once for evil.com as a domain.

Fix: Should use the same approach as extract_iocs_from_text() - check URLs before domains and use the seen set to prevent duplicates based on position ranges.

---

3. Invalid IPv4 Address Matching (models.py, multiple locations)

Locations: Lines 38, 106, 157, 171

Issue: IPv4 pattern r'\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b' matches invalid IP addresses like 999.999.999.999 because it doesn't validate that octets are in the range 0-255.

Impact: False positive IOC detection for invalid IPs that look like version numbers or other numeric patterns.

Example: Would match 999.999.999.999, 300.400.500.600

Fix: Add validation to check each octet is <= 255, or use a more restrictive pattern.

---

High Priority Issues

4. Subprocess Timeout Missing (crypto.py:12-18, 67-74)

Location: crypto.py:12-18 and crypto.py:67-74

Issue: GPG subprocess calls have no timeout parameter. If GPG hangs (e.g., waiting for passphrase), the application will hang indefinitely.

Impact: Application freeze if GPG prompts for input or encounters issues.

Fix: Add timeout parameter to communicate() call:

stdout, stderr = proc.communicate(timeout=10)

---

5. Inconsistent Indentation (storage.py:253)

Location: storage.py:253

Issue: Extra leading space before return statement - inconsistent with Python style and could indicate a logic error.

except (json.JSONDecodeError, IOError):
     return {"case_id": None, "evidence_id": None}  # Extra space

Impact: Style inconsistency, potentially confusing for maintainers.

---

Medium Priority Issues

6. Inefficient Demo Case Creation (storage.py:24-180)

Location: storage.py:46-156

Issue: Eight separate time.sleep(0.1) calls add 800ms of unnecessary delay during first launch.

Impact: Slow first-time startup experience (nearly 1 second added delay).

Fix: Either remove the sleeps entirely (timestamp granularity is sufficient) or use a single smaller sleep.

---

7. Missing File Write Error Handling (cli.py:68-112)

Location: cli.py:68-112

Issue: export_markdown() doesn't handle file write errors (disk full, permission denied, etc.).

Impact: Uncaught exceptions on export failure, no user feedback.

Fix: Wrap file operations in try/except and provide meaningful error messages.

---

8. Incomplete IPv6 Pattern (models.py:45, 113, 175)

Locations: Lines 45, 113, 175

Issue: IPv6 pattern r'\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b' only matches full format (8 groups), missing compressed format (::).

Impact: Won't detect compressed IPv6 addresses like 2001:db8::1 or ::1.

Example: Misses 2001:0db8:85a3::8a2e:0370:7334 from demo data (line 146).

---

Low Priority Issues

9. Hash Collision Risk in IOC Classification (tui.py:144-162)

Location: tui.py:144-162

Issue: _classify_ioc() checks hash lengths in wrong order (MD5, SHA1, SHA256). A SHA256 hash starting with 32 zeros could theoretically match the MD5 pattern first.

Impact: Extremely unlikely in practice due to word boundaries, but ordering is still incorrect for clarity.

Fix: Check longest hashes first (SHA256, SHA1, MD5).

---

10. No Atomic Write for Settings (storage.py:264-268)

Location: storage.py:264-268

Issue: set_setting() directly writes to settings file without atomic write pattern (temp file + rename) used elsewhere.

Impact: Settings corruption if write is interrupted.

Fix: Use same atomic write pattern as save_data().

---

11. No Atomic Write for State (storage.py:239-244)

Location: storage.py:239-244

Issue: set_active() directly writes to state file without atomic write pattern.

Impact: State corruption if write is interrupted.

Fix: Use same atomic write pattern as save_data().

---

Summary

Critical: 3 bugs (IOC extraction, overlapping highlights, invalid IPv4) High: 2 bugs (subprocess timeout, indentation) Medium: 3 issues (inefficient sleeps, missing error handling, IPv6 pattern) Low: 3 issues (hash classification order, non-atomic writes)

Total: 11 issues found

Recommendations

1. Immediate fixes: #1 (IOC extraction order), #3 (IPv4 validation), #4 (subprocess timeout)
2. High priority: #2 (overlapping highlights), #5 (indentation), #7 (error handling)
3. Nice to have: #6 (remove sleeps), #8 (IPv6 support), #9-11 (robustness improvements)