Fix CodeQL incomplete URL substring sanitization alert#15
Conversation
Replace vague `"example.com" in result` assertion with the exact URL-encoded avatar parameter, which is both more precise as a test and eliminates the CodeQL py/incomplete-url-substring-sanitization false positive. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughVersion bump to 5.1.0-rc0 accompanied by CI matrix expansion for Debian 12 and Ubuntu 24.04 testing, and test assertion tightening for URL-encoded query parameter validation. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #15 +/- ##
=======================================
Coverage 58.76% 58.76%
=======================================
Files 12 12
Lines 2185 2185
Branches 445 445
=======================================
Hits 1284 1284
Misses 774 774
Partials 127 127 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Both distros verified locally — pip install works with system pip. Ubuntu 22.04 remains skipped (pip 22.0.2 builds UNKNOWN-0.0.0). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Summary
py/incomplete-url-substring-sanitization"example.com" in resultintest_config.pywas flagged because substring checks on URLs are unreliable for sanitization. This is a false positive (it's a test, not a security check), but the fix is better anyway: assert the exact URL-encoded avatar parameter instead of a vague domain substring.Test plan
TestAvatarUrlAppendingtests pass locally (5/5)🤖 Generated with Claude Code
Summary by CodeRabbit
Tests
Chores