fix(plugins): enforce strict validation and integrity checks for missing custom parser #1812

[i-OmSharma]

📝 Description

Fixes #1812. This PR replaces the soft-warning behavior with a hard validation failure during the plugin loading phase when a plugin explicitly sets output.parser == 'custom' but the physical parser.py file is missing from its directory. This prevents invalid/broken plugins from silently loading and crashing downstream at execution time.

🛠️ Key Changes

1. backend/secuscan/plugins.py (_validate_plugin):

   • Upgraded logger.warning to a explicit logger.error.
   • Returns False early to guarantee the plugin framework skips loading the broken instance.

2. compute_plugin_digest:

   • Introduced a require_parser: bool = False defensive keyword argument.
   • Raises a explicit FileNotFoundError if a custom parser is missing instead of hashing an empty fallback digest string.

3. _verify_plugin_integrity:

   • Dynamically tracks requirements using require_parser=(plugin.output.get("parser") == "custom").
   • This creates a double-assertion mechanism catching post-metadata-load file modifications (TOCTOU).

🧪 Testing & Verification

• Created a highly resilient test suite at testing/backend/unit/test_plugins_validation.py containing 15 unit tests.
• Scenarios covered:
  • Happy path: Custom parser present passes validation and registers correctly.
  • Failure paths: Validations drop bad plugins, log clean errors, and raise proper exceptions.
  • Race Conditions: Specifically tests runtime integrity failures if parser.py is removed post-metadata parsing.
  • Backward Compatibility: Parametrized matrix verifying that standard built-in pars (default, json, regex, builtin) continue working seamlessly without a local file presence.
• Local regression checks run across all 38 related plugin core tests—everything passes cleanly without issues.

[Copilot]

Pull request overview

This PR hardens SecuScan’s plugin-loading and integrity-verification flow by treating output.parser == "custom" without a corresponding parser.py as an invalid plugin, preventing broken/tampered plugins from being loaded and failing later at execution time.

Changes:

• Make _validate_plugin emit an error and hard-fail validation when a custom parser is declared but parser.py is missing.
• Extend compute_plugin_digest with require_parser to raise FileNotFoundError when a custom parser is required but absent, and wire this into _verify_plugin_integrity.
• Add a dedicated unit test suite covering validation failures, digest behavior, and integrity verification when parser.py is removed post-metadata load.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
backend/secuscan/plugins.py	Enforces custom-parser presence at validation time and strengthens integrity hashing to fail loudly when required files are missing.
testing/backend/unit/test_plugins_validation.py	Adds regression tests for missing custom parser handling and integrity verification behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[utksh1]

Excellent security fix. This properly enforces validation for custom parsers by:

• Upgrading soft warning to hard failure in _validate_plugin
• Adding require_parser flag to compute_plugin_digest with FileNotFoundError
• Double-assertion in _verify_plugin_integrity to catch TOCTOU
• 240 lines of comprehensive test coverage (15 tests covering happy path, failures, race conditions, backward compat)

All CI passing. Merging.