Fixed capa timeout issue#3551
Conversation
There was a problem hiding this comment.
Pull request overview
This PR increases the CAPA analyzer timeout to reduce premature failures and adds coverage to ensure the analyzer reports timeouts deterministically.
Changes:
- Increased CAPA timeout default from 15s to 120s in the analyzer code and test config.
- Added a data migration to update existing default CAPA timeout
PluginConfigvalues from 15 to 120. - Added/updated unit tests using a real PE sample and validating timeout exception handling.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
api_app/analyzers_manager/file_analyzers/capa_info.py |
Raises default timeout to 120s and converts subprocess timeouts into AnalyzerRunException. |
api_app/analyzers_manager/migrations/0187_update_capa_timeout.py |
Data migration updating persisted default timeout config values (15 → 120). |
tests/api_app/analyzers_manager/unit_tests/file_analyzers/test_capa_info.py |
Updates test config timeout, uses a real PE sample, and adds timeout/reproducibility tests. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
tests/api_app/analyzers_manager/unit_tests/file_analyzers/test_capa_info.py
Show resolved
Hide resolved
tests/api_app/analyzers_manager/unit_tests/file_analyzers/test_capa_info.py
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "shellcode": False, | ||
| "arch": "64", | ||
| "timeout": 15, | ||
| "timeout": 120, |
There was a problem hiding this comment.
get_extra_config() returns timeout as an int (120) even though the corresponding Parameter is typed as float and other layers (model/serializer) validate exact type names. Consider using 120.0 here to keep the test config aligned with the declared type and to avoid hiding type-mismatch problems.
| "timeout": 120, | |
| "timeout": 120.0, |
| shellcode: bool | ||
| arch: str | ||
| timeout: float = 15 | ||
| timeout: float = 120 |
There was a problem hiding this comment.
The analyzer attribute is annotated as timeout: float but the default is set as an int (120). Given PluginConfig/serializer validation enforces exact type names for Parameter values, consider using 120.0 here to keep the runtime default consistent with the declared float type.
| timeout: float = 120 | |
| timeout: float = 120.0 |
|
@IshaanXCoder migration file 0187 is already present in the develop branch, I think that is why backend-tests is failing. |
abcd0b1 to
b86612f
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
api_app/analyzers_manager/migrations/0188_update_capa_timeout.py
Outdated
Show resolved
Hide resolved
tests/api_app/analyzers_manager/unit_tests/file_analyzers/test_capa_info.py
Outdated
Show resolved
Hide resolved
|
thanks @sanjib2006 , idk how did i miss this |
|
Hey @mlodic PTAL at this |
|
There's a problem about adding that malware in the repo. Considering it is known malware, it's hash has been flagged as malicious recently so we risk to get all the repo banned as malware delivery repo. |
|
aight my bad, didn't know about this. fixing this in a whlie |
|
yeah np |
Fixed Capa timeout (resolves #3157 )
Description
this PR resolved capa timeout error, changed the timeout to 120s from 15s, tested with the malware provided in #3157 (comment) and added it to the test files zip.
Type of change
Checklist
develop# This file is a part of IntelOwl https://github.com/intelowlproject/IntelOwl # See the file 'LICENSE' for copying permission.Ruff) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.testsfolder). All the tests (new and old ones) gave 0 errors.