Skip to content

Fix CodeQL incomplete URL substring sanitization alert#15

Merged
m4r1k merged 4 commits intomainfrom
fix/codeql-url-substring
Apr 11, 2026
Merged

Fix CodeQL incomplete URL substring sanitization alert#15
m4r1k merged 4 commits intomainfrom
fix/codeql-url-substring

Conversation

@m4r1k
Copy link
Copy Markdown
Owner

@m4r1k m4r1k commented Apr 11, 2026

Summary

  • Resolves code scanning alert #1py/incomplete-url-substring-sanitization
  • The assertion "example.com" in result in test_config.py was flagged because substring checks on URLs are unreliable for sanitization. This is a false positive (it's a test, not a security check), but the fix is better anyway: assert the exact URL-encoded avatar parameter instead of a vague domain substring.

Test plan

  • TestAvatarUrlAppending tests pass locally (5/5)
  • CI passes

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Tests

    • Enhanced test accuracy for URL parameter encoding validation.
  • Chores

    • Version bumped to 5.1.0-rc0.
    • Expanded continuous integration testing to include Debian 12 and Ubuntu 24.04 environments.

Replace vague `"example.com" in result` assertion with the exact
URL-encoded avatar parameter, which is both more precise as a test
and eliminates the CodeQL py/incomplete-url-substring-sanitization
false positive.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 11, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 16363781-992d-42ed-994e-925145127ee9

📥 Commits

Reviewing files that changed from the base of the PR and between 0ecb8db and a5bd3a5.

📒 Files selected for processing (3)
  • .github/workflows/integration.yml
  • src/eneru/version.py
  • tests/test_config.py

📝 Walkthrough

Walkthrough

Version bump to 5.1.0-rc0 accompanied by CI matrix expansion for Debian 12 and Ubuntu 24.04 testing, and test assertion tightening for URL-encoded query parameter validation.

Changes

Cohort / File(s) Summary
CI/CD Testing Matrix
.github/workflows/integration.yml
Expanded test-deb and test-pip-in-container job matrices to include Debian 12 and Ubuntu 24.04 targets for broader OS compatibility coverage.
Package Version
src/eneru/version.py
Updated __version__ from "5.0.0-rc4" to "5.1.0-rc0" for pre-release versioning.
Test Assertion Refinement
tests/test_config.py
Tightened test_append_avatar_to_discord assertion to verify exact URL-encoded query parameter value instead of loose substring containment checks.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A hop through the versions, from rc4 we spring,
To five-point-one-oh with test tightening!
Debian twelve joins the testing spree,
Ubuntu twenty-four bounds so free—
Query params encoded, assertions precise,
Our little release tastes quite nice!

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title directly addresses the main fix in the PR: replacing a vague substring assertion with an exact URL-encoded parameter assertion to resolve a CodeQL alert.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/codeql-url-substring

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 11, 2026

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.76%. Comparing base (0ecb8db) to head (a5bd3a5).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files
@@           Coverage Diff           @@
##             main      #15   +/-   ##
=======================================
  Coverage   58.76%   58.76%           
=======================================
  Files          12       12           
  Lines        2185     2185           
  Branches      445      445           
=======================================
  Hits         1284     1284           
  Misses        774      774           
  Partials      127      127           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

m4r1k and others added 3 commits April 11, 2026 14:31
Both distros verified locally — pip install works with system pip.
Ubuntu 22.04 remains skipped (pip 22.0.2 builds UNKNOWN-0.0.0).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@m4r1k m4r1k merged commit c7fa211 into main Apr 11, 2026
34 checks passed
@m4r1k m4r1k deleted the fix/codeql-url-substring branch April 11, 2026 12:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants