From 1d3e8bb03c36b3842ba86e0b2a88445f798fe436 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 8 Sep 2026 09:15:07 +0000 Subject: [PATCH 1/3] Tighten DNS corpus assertions to exact equality (fixes CodeQL #166) CodeQL flagged py/incomplete-url-substring-sanitization on three assertions in test_names_decompress_to_real_domains and test_answers_parse_to_real_records: "domain" in names and rdata_text.endswith("google.com"). These are test assertions against a fixed DNS packet corpus, not URL/domain trust checks, so they were false positives from a security standpoint. Still, the raw substring/endswith pattern is exactly what the rule is built to catch and the checks were looser than they needed to be, since the corpus is fixed and every value is known ahead of time. Replaced both with exact equality against the known decoded values: names now compares equal to the full expected set instead of checking membership, and the CNAME assertion compares the full decompressed rdata_text instead of just its suffix. This removes the substring/ endswith pattern CodeQL keys on and makes the tests strictly more precise (they now catch any deviation in the decoded output, not just a missing prefix or suffix). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01CXX5fFdPYfwpXfj6LiqiLr --- tests/test_dns.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/tests/test_dns.py b/tests/test_dns.py index 3b93bb3..8a7ed12 100644 --- a/tests/test_dns.py +++ b/tests/test_dns.py @@ -134,8 +134,7 @@ def test_every_corpus_frame_round_trips_byte_exact(self): def test_names_decompress_to_real_domains(self): names = {walk(frame)[0][-1].question_name for frame in CORPUS_DNS} - assert "example.com" in names - assert "accounts.youtube.com" in names + assert names == {"example.com", "accounts.youtube.com"} def test_answers_parse_to_real_records(self): records = [ @@ -148,9 +147,9 @@ def test_answers_parse_to_real_records(self): # An A record's RDATA decodes to the dotted IPv4 in rdata_text. a = next(r for r in records if r.rtype_name == "A") assert a.rdata == socket.inet_aton(a.rdata_text) - # A CNAME's RDATA decompresses to a real target domain. + # A CNAME's RDATA decompresses to the real target domain. cname = next(r for r in records if r.rtype_name == "CNAME") - assert cname.rdata_text.endswith("google.com") + assert cname.rdata_text == "www3.l.google.com" def test_authority_soa_and_additional_opt(self): stacks = [walk(frame)[0][-1] for frame in CORPUS_DNS] From 61894e3c230dd9237d0153ffbdf1d74cf9749185 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 8 Sep 2026 09:18:26 +0000 Subject: [PATCH 2/3] Add CHANGELOG entry for the CodeQL test-assertion fix (#166) Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01CXX5fFdPYfwpXfj6LiqiLr --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e7ea7de..74635d7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [Unreleased] + +### Development +- **Tightened three DNS corpus assertions in `tests/test_dns.py` from substring/`endswith` checks to exact equality, closing 3 open CodeQL `py/incomplete-url-substring-sanitization` alerts (#166).** `test_names_decompress_to_real_domains` asserted `"example.com" in names` / `"accounts.youtube.com" in names` against a `set` decoded from a fixed pcap corpus, and `test_answers_parse_to_real_records` asserted `cname.rdata_text.endswith("google.com")` against the same corpus — not security-relevant trust checks, but exactly the substring/suffix pattern the rule flags regardless of what the value's actually validating. Both now compare against the known exact decoded values instead (`names == {"example.com", "accounts.youtube.com"}`, `rdata_text == "www3.l.google.com"`), which removes the pattern CodeQL keys on and is strictly more precise than the checks it replaces. + ## [2.2.1] - 2026-09-07 ### Fixed From 8f11947f271d10cfc4d223767067abb43adde32d Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 8 Sep 2026 09:29:49 +0000 Subject: [PATCH 3/3] Add blank line after CHANGELOG heading (markdownlint MD022) Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01CXX5fFdPYfwpXfj6LiqiLr --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 74635d7..7081cbf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ### Development + - **Tightened three DNS corpus assertions in `tests/test_dns.py` from substring/`endswith` checks to exact equality, closing 3 open CodeQL `py/incomplete-url-substring-sanitization` alerts (#166).** `test_names_decompress_to_real_domains` asserted `"example.com" in names` / `"accounts.youtube.com" in names` against a `set` decoded from a fixed pcap corpus, and `test_answers_parse_to_real_records` asserted `cname.rdata_text.endswith("google.com")` against the same corpus — not security-relevant trust checks, but exactly the substring/suffix pattern the rule flags regardless of what the value's actually validating. Both now compare against the known exact decoded values instead (`names == {"example.com", "accounts.youtube.com"}`, `rdata_text == "www3.l.google.com"`), which removes the pattern CodeQL keys on and is strictly more precise than the checks it replaces. ## [2.2.1] - 2026-09-07