Skip to content

Fixed capa timeout issue#3551

Open
IshaanXCoder wants to merge 6 commits intointelowlproject:developfrom
IshaanXCoder:fix/capa-timeout
Open

Fixed capa timeout issue#3551
IshaanXCoder wants to merge 6 commits intointelowlproject:developfrom
IshaanXCoder:fix/capa-timeout

Conversation

@IshaanXCoder
Copy link
Copy Markdown
Contributor

Fixed Capa timeout (resolves #3157 )

Description

this PR resolved capa timeout error, changed the timeout to 120s from 15s, tested with the malware provided in #3157 (comment) and added it to the test files zip.

Type of change

  • Bug fix (non-breaking change which fixes an issue).

Checklist

  • I have read and understood the rules about how to Contribute to this project
  • The pull request is for the branch develop
  • I have inserted the copyright banner at the start of the file: # This file is a part of IntelOwl https://github.com/intelowlproject/IntelOwl # See the file 'LICENSE' for copying permission.
  • Linters (Ruff) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.
  • I have added tests for the feature/bug I solved (see tests folder). All the tests (new and old ones) gave 0 errors.

Copilot AI review requested due to automatic review settings March 25, 2026 21:07
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR increases the CAPA analyzer timeout to reduce premature failures and adds coverage to ensure the analyzer reports timeouts deterministically.

Changes:

  • Increased CAPA timeout default from 15s to 120s in the analyzer code and test config.
  • Added a data migration to update existing default CAPA timeout PluginConfig values from 15 to 120.
  • Added/updated unit tests using a real PE sample and validating timeout exception handling.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

File Description
api_app/analyzers_manager/file_analyzers/capa_info.py Raises default timeout to 120s and converts subprocess timeouts into AnalyzerRunException.
api_app/analyzers_manager/migrations/0187_update_capa_timeout.py Data migration updating persisted default timeout config values (15 → 120).
tests/api_app/analyzers_manager/unit_tests/file_analyzers/test_capa_info.py Updates test config timeout, uses a real PE sample, and adds timeout/reproducibility tests.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot AI review requested due to automatic review settings March 26, 2026 07:30
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

"shellcode": False,
"arch": "64",
"timeout": 15,
"timeout": 120,
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

get_extra_config() returns timeout as an int (120) even though the corresponding Parameter is typed as float and other layers (model/serializer) validate exact type names. Consider using 120.0 here to keep the test config aligned with the declared type and to avoid hiding type-mismatch problems.

Suggested change
"timeout": 120,
"timeout": 120.0,

Copilot uses AI. Check for mistakes.
shellcode: bool
arch: str
timeout: float = 15
timeout: float = 120
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The analyzer attribute is annotated as timeout: float but the default is set as an int (120). Given PluginConfig/serializer validation enforces exact type names for Parameter values, consider using 120.0 here to keep the runtime default consistent with the declared float type.

Suggested change
timeout: float = 120
timeout: float = 120.0

Copilot uses AI. Check for mistakes.
@sanjib2006
Copy link
Copy Markdown

sanjib2006 commented Mar 26, 2026

@IshaanXCoder migration file 0187 is already present in the develop branch, I think that is why backend-tests is failing.

Copilot AI review requested due to automatic review settings March 26, 2026 16:55
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@IshaanXCoder
Copy link
Copy Markdown
Contributor Author

thanks @sanjib2006 , idk how did i miss this

@IshaanXCoder
Copy link
Copy Markdown
Contributor Author

Hey @mlodic PTAL at this

@mlodic
Copy link
Copy Markdown
Member

mlodic commented Mar 26, 2026

There's a problem about adding that malware in the repo. Considering it is known malware, it's hash has been flagged as malicious recently so we risk to get all the repo banned as malware delivery repo.
This unfortunately already happened in the past so we cannot add new known malware in the repo, even if it is not functional anymore. So please just test it manually with that sample and provide a video that it indeed works and we are fine, thanks

@IshaanXCoder
Copy link
Copy Markdown
Contributor Author

aight my bad, didn't know about this. fixing this in a whlie

@mlodic
Copy link
Copy Markdown
Member

mlodic commented Mar 26, 2026

yeah np

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants