test(triage-security): exercise conditional Fullsend scenarios

evals/triage-security/files/fullsend-eval-1-trusted-input.json

@@ -0,0 +1,336 @@
+{
+  "schema_version": "1",
+  "issue": {
+    "key": "TC-8001",
+    "summary": "CVE-2026-31812 quinn-proto - Panic on large stream counts [rhtpa-2.2]",
+    "description": {
+      "type": "doc",
+      "version": 1,
+      "content": [
+        {
+          "type": "paragraph",
+          "content": [
+            {
+              "type": "text",
+              "text": "A vulnerability was found in quinn-proto. The quinn-proto crate before version 0.11.14 allows a remote attacker to cause a panic by sending a QUIC transport frame that creates an excessive number of streams. This vulnerability is classified as a denial of service (DoS).\n\n**Affected package**: quinn-proto\n**Affected versions**: versions before 0.11.14\n**Fixed version**: 0.11.14\n**CVSS**: 7.5 (High)\n\nThe vulnerability exists because quinn-proto does not properly validate the number of streams requested in a STREAMS frame. An attacker can send a specially crafted frame that causes the server to allocate an unbounded number of stream state objects, leading to a panic when the allocation exceeds internal limits.\n\n### References\n\n- https://github.com/advisories/GHSA-2026-qp73-x4mq\n- https://rustsec.org/advisories/RUSTSEC-2026-0042.html"
+            }
+          ]
+        }
+      ]
+    },
+    "status": "New",
+    "labels": [
+      "CVE-2026-31812",
+      "pscomponent:org/rhtpa-server"
+    ],
+    "versions": [],
+    "reporter": {
+      "account_id": "synthetic-reporter",
+      "display_name": "Synthetic Reporter"
+    },
+    "comments": [],
+    "fields": {
+      "fixture_purpose": "SYNTHETIC TEST DATA — independent Fullsend counterpart of interactive eval 1; all identities, URLs, CVEs, commit pins and evidence are deliberate public test material, not live advisory evidence.",
+      "current_user": {
+        "accountId": "synthetic-engineer",
+        "displayName": "Synthetic Engineer"
+      },
+      "ecosystem": "Cargo",
+      "affected_package": "quinn-proto",
+      "fixed_version": "0.11.14",
+      "affected_range": "< 0.11.14",
+      "affectsVersions": [
+        {
+          "id": "version-stale",
+          "name": "RHTPA 2.0.0"
+        }
+      ],
+      "assignee": null,
+      "issuelinks": [],
+      "customfield_10632": "quinn-proto"
+    }
+  },
+  "remote_links": [
+    {
+      "url": "https://example.com/advisories/CVE-2026-31812",
+      "title": "Synthetic CVE-2026-31812 advisory"
+    }
+  ],
+  "configuration": {
+    "project_key": "TC",
+    "jira_version_prefix": "RHTPA",
+    "vulnerability_issue_type_id": "10016",
+    "component_label_pattern": "pscomponent:",
+    "version_streams": [
+      {
+        "name": "2.1.x",
+        "matrix_path": "2.1.x/security-matrix.md",
+        "release_repository": "release-repo"
+      },
+      {
+        "name": "2.2.x",
+        "matrix_path": "2.2.x/security-matrix.md",
+        "release_repository": "release-repo"
+      }
+    ],
+    "source_repositories": [
+      {
+        "name": "backend",
+        "url": "https://github.com/example/backend",
+        "deployment_context": "customer-shipped"
+      }
+    ],
+    "vex_justification_field": "customfield_10665",
+    "upstream_affected_component_field": "customfield_10632",
+    "stream_field": "customfield_10832"
+  },
+  "external_evidence": {
+    "mitre": {
+      "source_url": "https://example.com/mitre/CVE-2026-31812",
+      "retrieved_at": "2026-09-30T12:00:00Z",
+      "status": 200,
+      "body": {
+        "cveMetadata": {
+          "cveId": "CVE-2026-31812"
+        },
+        "containers": {
+          "cna": {
+            "affected": [
+              {
+                "product": "quinn-proto",
+                "versions": [
+                  {
+                    "status": "affected",
+                    "lessThan": "0.11.14",
+                    "versionType": "semver"
+                  }
+                ]
+              }
+            ]
+          }
+        }
+      }
+    },
+    "osv": {
+      "source_url": "https://example.com/osv/CVE-2026-31812",
+      "retrieved_at": "2026-09-30T12:00:00Z",
+      "status": 200,
+      "body": {
+        "id": "CVE-2026-31812",
+        "affected": [
+          {
+            "package": {
+              "ecosystem": "Cargo",
+              "name": "quinn-proto"
+            },
+            "ranges": [
+              {
+                "type": "SEMVER",
+                "events": [
+                  {
+                    "introduced": "0"
+                  },
+                  {
+                    "fixed": "0.11.14"
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
+    },
+    "lifecycle": {
+      "source_url": "https://example.com/lifecycle",
+      "retrieved_at": "2026-09-30T12:00:00Z",
+      "status": 200,
+      "body": {
+        "supported_streams": [
+          "2.1.x",
+          "2.2.x"
+        ],
+        "eol_streams": []
+      }
+    }
+  },
+  "matrix": {
+    "streams": [
+      {
+        "name": "2.1.x",
+        "matrix_source": "SYNTHETIC TEST DATA — trusted 2.1.x matrix snapshot",
+        "rows": [
+          {
+            "version": "2.1.0",
+            "source_commits": {
+              "backend": "a003008"
+            },
+            "retag_of": null
+          },
+          {
+            "version": "2.1.1",
+            "source_commits": {
+              "backend": "a003012"
+            },
+            "retag_of": null
+          }
+        ]
+      },
+      {
+        "name": "2.2.x",
+        "matrix_source": "SYNTHETIC TEST DATA — trusted 2.2.x matrix snapshot",
+        "rows": [
+          {
+            "version": "2.2.0",
+            "source_commits": {
+              "backend": "a004005"
+            },
+            "retag_of": null
+          },
+          {
+            "version": "2.2.1",
+            "source_commits": {
+              "backend": "a004008"
+            },
+            "retag_of": null
+          },
+          {
+            "version": "2.2.2",
+            "source_commits": {
+              "backend": "a004008"
+            },
+            "retag_of": "2.2.1"
+          },
+          {
+            "version": "2.2.3",
+            "source_commits": {
+              "backend": "a004011"
+            },
+            "retag_of": null
+          },
+          {
+            "version": "2.2.4",
+            "source_commits": {
+              "backend": "a004012"
+            },
+            "retag_of": null
+          }
+        ]
+      }
+    ]
+  },
+  "source_evidence": {
+    "lock_files": [
+      {
+        "repository": "backend",
+        "ref": "a003008",
+        "path": "Cargo.lock",
+        "command": "git show a003008:Cargo.lock",
+        "content": "[[package]]\nname = \"quinn-proto\"\nversion = \"0.11.14\"\n"
+      },
+      {
+        "repository": "backend",
+        "ref": "a003012",
+        "path": "Cargo.lock",
+        "command": "git show a003012:Cargo.lock",
+        "content": "[[package]]\nname = \"quinn-proto\"\nversion = \"0.11.14\"\n"
+      },
+      {
+        "repository": "backend",
+        "ref": "a004005",
+        "path": "Cargo.lock",
+        "command": "git show a004005:Cargo.lock",
+        "content": "[[package]]\nname = \"quinn-proto\"\nversion = \"0.11.9\"\n"
+      },
+      {
+        "repository": "backend",
+        "ref": "a004008",
+        "path": "Cargo.lock",
+        "command": "git show a004008:Cargo.lock",
+        "content": "[[package]]\nname = \"quinn-proto\"\nversion = \"0.11.12\"\n"
+      },
+      {
+        "repository": "backend",
+        "ref": "a004011",
+        "path": "Cargo.lock",
+        "command": "git show a004011:Cargo.lock",
+        "content": "[[package]]\nname = \"quinn-proto\"\nversion = \"0.11.14\"\n"
+      },
+      {
+        "repository": "backend",
+        "ref": "a004012",
+        "path": "Cargo.lock",
+        "command": "git show a004012:Cargo.lock",
+        "content": "[[package]]\nname = \"quinn-proto\"\nversion = \"0.11.14\"\n"
+      }
+    ],
+    "development_streams": [
+      {
+        "repository": "backend",
+        "ref": "release/0.3.z",
+        "path": "Cargo.lock",
+        "command": "git show release/0.3.z:Cargo.lock",
+        "content": "[[package]]\nname = \"quinn-proto\"\nversion = \"0.11.14\"\n"
+      },
+      {
+        "repository": "backend",
+        "ref": "release/0.4.z",
+        "path": "Cargo.lock",
+        "command": "git show release/0.4.z:Cargo.lock",
+        "content": "[[package]]\nname = \"quinn-proto\"\nversion = \"0.11.12\"\n"
+      }
+    ]
+  },
+  "jira_metadata": {
+    "versions": [
+      {
+        "id": "version-2-1-0",
+        "name": "RHTPA 2.1.0",
+        "released": true
+      },
+      {
+        "id": "version-2-1-1",
+        "name": "RHTPA 2.1.1",
+        "released": true
+      },
+      {
+        "id": "version-2-2-0",
+        "name": "RHTPA 2.2.0",
+        "released": true
+      },
+      {
+        "id": "version-2-2-1",
+        "name": "RHTPA 2.2.1",
+        "released": true
+      },
+      {
+        "id": "version-2-2-2",
+        "name": "RHTPA 2.2.2",
+        "released": true
+      },
+      {
+        "id": "version-2-2-3",
+        "name": "RHTPA 2.2.3",
+        "released": true
+      },
+      {
+        "id": "version-2-2-4",
+        "name": "RHTPA 2.2.4",
+        "released": true
+      },
+      {
+        "id": "version-dev",
+        "name": "RHTPA 2.2.5",
+        "released": false
+      }
+    ],
+    "sibling_searches": [],
+    "related_issues": []
+  },
+  "idempotency": {
+    "action_markers": [],
+    "existing_remediation": []
+  },
+  "authorization": {
+    "mutation_authorized": true
+  }
+}