fix: remove dead except ValueError clause in capa2sarif.py so JSONDecodeError is caught correctly

json.JSONDecodeError is a subclass of ValueError, so the broader except ValueError
was shadowing the more specific handler, making it unreachable. Keep only the
specific except json.JSONDecodeError handler.

CHANGELOG.md

@@ -49,6 +49,7 @@
 - fix: Scopes.from_dict uses cls instead of self so subclasses return the correct type @williballenthin
 - fix: correct wrong dict key in VMRay _compute_monitor_threads assertion (used thread_id instead of process_id) @williballenthin
 - fix: replace assert with isinstance guard in get_callee for invalid MethodSpec tokens @williballenthin
+- fix: remove dead except ValueError clause in capa2sarif.py so JSONDecodeError is caught by the specific handler @williballenthin (SURF-91)
 - fix: dedent bulk-process.py main() body so explicit argv argument is used instead of silently ignored @williballenthin (SURF-90)
 - fix: guard statistics.quantiles/mean in compare-backends.py report() against empty duration lists @williballenthin (SURF-89)
 - fix: replace zipfile with pyzipper in minimize_vmray_results.py so output archive is AES-encrypted @williballenthin (SURF-88)

scripts/capa2sarif.py

@@ -93,13 +93,9 @@ def main() -> int:
 
     try:
         json_data = json.loads(Path(args.capa_output).read_text(encoding="utf-8"))
-    except ValueError:
+    except json.JSONDecodeError:
         logger.error("Input data was not valid JSON, input should be a capa json output file.")
         return -1
-    except json.JSONDecodeError:
-        # An exception has occured
-        logger.error("Input data was not valid JSON, input should be a capa json output file.")
-        return -2
 
     # Marshall json into Sarif
     # Create baseline sarif structure to be populated from json data

tests/test_scripts.py

@@ -163,6 +163,13 @@ def test_proto_conversion(tmp_path):
     assert p.stdout.startswith(b'{\n  "meta": ') or p.stdout.startswith(b'{\r\n  "meta": ')
 
 
+def test_capa2sarif_invalid_json(tmp_path):
+    invalid_json_file = tmp_path / "bad.json"
+    invalid_json_file.write_text("this is not valid json", encoding="utf-8")
+    p = run_program(get_script_path("capa2sarif.py"), [str(invalid_json_file)])
+    assert p.returncode != 0
+
+
 def test_detect_duplicate_features(tmpdir):
     TEST_RULE_0 = textwrap.dedent("""
         rule: