`CapeExtractor` version mismatch warning on self-hosted CAPE reports
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
When running `capa` against a `report.json` generated by a standard self-hosted CAPE Sandbox instance, `capa` logs a version warning:
```log
[capa.features.extractors.cape.extractor] WARNING: CAPE version '2.5' not tested/supported yet
```
### **Root Cause**
In `capa/features/extractors/cape/extractor.py`, `TESTED_VERSIONS` only contains versions with a `"-CAPE"` suffix:
```python
TESTED_VERSIONS = {"2.2-CAPE", "2.4-CAPE", "2.5-CAPE"}
```
* The hosted instance (`capesandbox.com`) writes version strings as `"2.5-CAPE"`.
* Self-hosted open-source CAPE instances write version strings simply as `"2.5"`.
### **Proposed Solution**
Update the version validation in `capa/features/extractors/cape/extractor.py` to support non-suffixed variants:
```python
TESTED_VERSIONS = {
"2.2", "2.2-CAPE",
"2.4", "2.4-CAPE",
"2.5", "2.5-CAPE",
}
```
Contributor guide
Research direction
Start in capa/features/extractors/cape/extractor.py by reading TESTED_VERSIONS and the version-validation path. Update the supported-version entries for the non-suffixed CAPE forms, then verify that a self-hosted report.json with version 2.5 no longer produces the unsupported-version warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100