Skip to content

fix: coerce is_strictly_forces_https return value to bool - #270

Merged
jsf9k merged 2 commits into
cisagov:developfrom
steps-re:fix/strictly-forces-https-none-coercion
Jul 9, 2026
Merged

fix: coerce is_strictly_forces_https return value to bool#270
jsf9k merged 2 commits into
cisagov:developfrom
steps-re:fix/strictly-forces-https-none-coercion

Conversation

@steps-re

@steps-re steps-re commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Fixes #176.

Problem

is_strictly_forces_https could return None instead of True/False, which caused the "Strictly Forces HTTPS" JSON field to be null for some domains.

The root cause was in the down_or_redirects inner helper:

# before
def down_or_redirects(endpoint):
    return not endpoint.live or endpoint.redirect_immediately_to_https

redirect_immediately_to_https defaults to None in models.py (line 58). When endpoint.live is True, Python evaluates False or None as None. That None then propagates through the and chain on line 1280, so the final return value is None rather than a bool.

Fix

Wrap the attribute in bool() in the helper, and apply the same treatment to https_somewhere:

def down_or_redirects(endpoint):
    return (not endpoint.live) or bool(endpoint.redirect_immediately_to_https)

https_somewhere = bool(https.live or httpswww.live)

Both bool(None)False and bool(True)True, so the semantics are unchanged for any non-None value.

Tests

Adds TestStrictlyForcesHttps with three cases:

  • All endpoints at default (None) state → returns False, not None
  • HTTPS live, HTTP live with redirect_immediately_to_https=None → returns False, not None
  • HTTPS live, HTTP endpoints both redirecting to HTTPS → returns True

`down_or_redirects` evaluated `False or endpoint.redirect_immediately_to_https`
which, when the attribute holds its default value of None, returns None
instead of False.  That None then propagated through the `and` chain so
`is_strictly_forces_https` — and therefore the "Strictly Forces HTTPS"
JSON field — could be null rather than true/false.

Fix: wrap `endpoint.redirect_immediately_to_https` in `bool()` in the
inner helper and coerce `https_somewhere` the same way, so the function
always returns a proper boolean regardless of how far each endpoint scan
has progressed.

Add three unit tests in `TestStrictlyForcesHttps` that cover the null-
propagation regression (all-None state, live HTTP with unset redirect)
and the positive case (HTTP endpoints that do redirect to HTTPS).

Fixes cisagov#176

Signed-off-by: Mike German <mike@stepsventures.com>
@jsf9k jsf9k self-assigned this Jul 8, 2026
@jsf9k jsf9k added python Pull requests that update Python code test This issue or pull request adds or otherwise modifies test code bug This issue or pull request addresses broken functionality labels Jul 8, 2026
@github-project-automation github-project-automation Bot moved this to In progress in BOD 18-01 Jul 8, 2026
@jsf9k jsf9k moved this to In Progress in CyHy System Jul 8, 2026
@jsf9k jsf9k added the version bump This issue or pull request increments the version number label Jul 8, 2026
@jsf9k jsf9k moved this from In progress to Review in progress in BOD 18-01 Jul 8, 2026
@jsf9k
jsf9k enabled auto-merge July 8, 2026 19:46
@jsf9k

jsf9k commented Jul 8, 2026

Copy link
Copy Markdown
Member

Thank you for the contribution @steps-re!

@dav3r dav3r left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - thanks @steps-re for your contribution! 👍

@jsf9k
jsf9k merged commit df93ceb into cisagov:develop Jul 9, 2026
37 checks passed
@github-project-automation github-project-automation Bot moved this from Review in progress to Reviewer approved in BOD 18-01 Jul 9, 2026
@github-project-automation github-project-automation Bot moved this from In Progress to Done in CyHy System Jul 9, 2026
@github-project-automation github-project-automation Bot moved this from Reviewer approved to Done in BOD 18-01 Jul 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug This issue or pull request addresses broken functionality python Pull requests that update Python code test This issue or pull request adds or otherwise modifies test code version bump This issue or pull request increments the version number

Projects

Status: Done
Status: Done

Development

Successfully merging this pull request may close these issues.

"Strictly Forces HTTPS" can sometimes be null

3 participants