From 80228e0a3b883ccdf2d80ba544c01619a856ef9c Mon Sep 17 00:00:00 2001
From: nsfisis <nsfisis@gmail.com>
Date: Mon, 20 Jul 2026 15:36:54 +0900
Subject: fix(advisory): treat int-keyed ignore entries as plain IDs

parseIgnoreWithApply distinguishes ['CVE-123' => 'reason'] from
[0 => 'CVE-123'] by checking is_int($key) in PHP. AuditConfig only
matched on the value's type, so a canonical-int-keyed string value
was mistaken for an id => reason pair. Expose canonical_int_key from
the php-shim to replicate PHP's key-canonicalization rule and
unignore test_mixed_formats.
---
 crates/shirabe-php-shim/src/var.rs                 |  2 +-
 crates/shirabe/src/advisory/audit_config.rs        | 10 ++++++++--
 crates/shirabe/tests/advisory/audit_config_test.rs |  1 -
 3 files changed, 9 insertions(+), 4 deletions(-)

(limited to 'crates')

diff --git a/crates/shirabe-php-shim/src/var.rs b/crates/shirabe-php-shim/src/var.rs
index f0e55d53..513c3e88 100644
--- a/crates/shirabe-php-shim/src/var.rs
+++ b/crates/shirabe-php-shim/src/var.rs
@@ -79,7 +79,7 @@ fn serialize_float(f: f64) -> String {
 /// Returns the integer a PHP array key string normalizes to, or None if the key stays a string.
 /// PHP treats a key as an integer only when it is a canonical decimal integer: no leading `+`, no
 /// redundant leading zeros, and within the platform integer range ("-0" is not canonical).
-fn canonical_int_key(key: &str) -> Option<i64> {
+pub fn canonical_int_key(key: &str) -> Option<i64> {
     if key == "0" {
         return Some(0);
     }
diff --git a/crates/shirabe/src/advisory/audit_config.rs b/crates/shirabe/src/advisory/audit_config.rs
index 458ebefe..e5bf6985 100644
--- a/crates/shirabe/src/advisory/audit_config.rs
+++ b/crates/shirabe/src/advisory/audit_config.rs
@@ -3,7 +3,7 @@
 use crate::advisory::Auditor;
 use crate::config::Config;
 use indexmap::IndexMap;
-use shirabe_php_shim::{InvalidArgumentException, PhpMixed};
+use shirabe_php_shim::{InvalidArgumentException, PhpMixed, canonical_int_key};
 
 #[derive(Debug, Clone)]
 pub struct AuditConfig {
@@ -83,7 +83,13 @@ impl AuditConfig {
         for (key, value) in entries {
             let (id, apply, reason) = match value {
                 PhpMixed::String(reason_str) => {
-                    (key.clone(), "all".to_string(), Some(reason_str.clone()))
+                    // TODO(phase-e): PHP's `array` type must be modeled more precisely. This is
+                    // escape hatch.
+                    if canonical_int_key(key).is_some() {
+                        (reason_str.clone(), "all".to_string(), None)
+                    } else {
+                        (key.clone(), "all".to_string(), Some(reason_str.clone()))
+                    }
                 }
                 PhpMixed::Array(detail) => {
                     let apply = detail
diff --git a/crates/shirabe/tests/advisory/audit_config_test.rs b/crates/shirabe/tests/advisory/audit_config_test.rs
index 85337a44..28d436bb 100644
--- a/crates/shirabe/tests/advisory/audit_config_test.rs
+++ b/crates/shirabe/tests/advisory/audit_config_test.rs
@@ -95,7 +95,6 @@ fn test_detailed_format_block_only() {
 }
 
 #[test]
-#[ignore]
 fn test_mixed_formats() {
     let audit_config = audit_config_from(arr(vec![(
         "ignore",
-- 
cgit v1.3.1