Repository navigation
fix(release): trust origin by its host, not by a substring of its URL - #50
Merged
Merged
Conversation
bump_version.py opens the release pull request with auto-merge only when origin is this repository on GitHub. It asked whether "github.com" and "maksimtech/patchradar" occurred anywhere in the URL, so a host of anyone's choosing passed (https://evil.example/github.com/maksimtech/patchradar), and an upper-case host that is GitHub did not. CodeQL alert #60, py/incomplete-url-substring-sanitization, high, has kept Security Posture red on main since the change landed. The URL is now split into host and path (urlsplit, or the scp-like user@host:path form), the host must be github.com and the path must be the repository, whole. The new cases run against a real clone whose origin is set with `git remote set-url`; they failed 7 of 13 before the fix. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
Merging this PR will not alter performance
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
maksimtech
added a commit
that referenced
this pull request
Oct 15, 2026
The gate lists these entries as settled: their alerts are closed because the scanners stopped reporting them, not because anything left the image. `patchradar debian` on 2026-10-15 still reports gcc-14 no-dsa in trixie at 14.2.0-19 (fix only in sid, 14.4.0-3), so the flaws are still present and only the reporting changed. The entries stay, and each now records when the scanner fell silent and what Debian said, in the words the CVE-2026-82560 entry already uses. Deleting a flaw that is demonstrably present because a scanner fell silent is the one direction the file must not drift in. Checked, not inferred: a script read this repository's live open and closed code-scanning alerts and listed every kept settled entry that did not say why (4 before, 0 after), and tools/security_exceptions.py on the same alerts still exits 1, only for CodeQL #60, which #50 fixes. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
scripts/bump_version.pyopens the release PR with auto-merge only whenoriginis this repository on GitHub._origin_is_githubtested"github.com" in url and RELEASE_REPO in url, which any host that merely mentions github.com satisfies. CodeQL alert #60 (py/incomplete-url-substring-sanitization, high) flagged it, and Security Posture has been red onmainsince #48 landed.What
_github_repo(url)splits the remote URL into host and path (urllib.parse.urlsplit, or the scp-likeuser@host:pathform). The host must be exactlygithub.com, and the path must be the repository, whole._origin_is_githubcompares thatowner/namewithRELEASE_REPO.Tests (TDD)
New cases in
tests/test_release_through_pr.pyrun against a real clone whoseoriginis set withgit remote set-url. Nothing is mocked, and git does not contact the URLs.https://GitHub.com/...was refused.ruff check src tests benchmarks scripts toolsis clean.🤖 Generated with Claude Code