fix(security): close CodeQL SSRF flow for IPv6 proxy origins - #1179
fix(security): close CodeQL SSRF flow for IPv6 proxy origins#1179seonghobae wants to merge 5 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe PR updates IPv6 backend-origin construction, revises proxy target documentation, and changes frontend coverage scripts to support both default-suite and trace-readiness-specific coverage runs. ChangesBackend URL and coverage updates
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head623151dfee978101b1ff5cb8f23c5e15f470c7ee. -
Head SHA:
623151dfee978101b1ff5cb8f23c5e15f470c7ee -
Workflow run: 30429107789
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Frontend (2 files)"]
S1 --> I1["browser runtime and bundle"]
I1 --> R1["Review risk: Frontend (2 files)"]
R1 --> V1["frontend tests"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Frontend (3 files)"]
S1 --> I1["browser runtime and bundle"]
I1 --> R1["Review risk: Frontend (3 files)"]
R1 --> V1["frontend tests"]
|
|
PR governance metadata gate update for PR governance metadata gate is waiting on current-head requirements; see the latest check for pending reasons. |
Dismissed after central runner remediation: this review was generated solely from coverage-evidence failure in central run 30429107789 because pinned pnpm@11.5.3 was absent. ContextualWisdomLab/.github#641 (merge c3b718f0e8f1e0be98a31b9f7ecd4daf3d91d243) now installs SHA-verified Node v24.18.0 and pnpm 11.5.3; its default-branch dispatch 30430987586 passed the trusted coverage-evidence job. Re-run exact-head review for 623151d.
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head623151dfee978101b1ff5cb8f23c5e15f470c7ee. -
Head SHA:
623151dfee978101b1ff5cb8f23c5e15f470c7ee -
Workflow run: 30431708053
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 3
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Frontend (2 files)"]
S1 --> I1["browser runtime and bundle"]
I1 --> R1["Review risk: Frontend (2 files)"]
R1 --> V1["frontend tests"]
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Obsolete prior-head coverage review. It is bound to 623151d, while the live PR head is 93e56e6. Run 30431708053 failed because the trusted central workflow attempted registry access inside the networkless sandbox; central fix PR ContextualWisdomLab/.github#642 has current-head coverage, CodeQL, OSV, Trivy, dependency-review, Semgrep, Bandit, and pip-audit evidence passing. The new Naruon head also expands repository coverage to all frontend tests; a new exact-head authenticated review remains required.
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head93e56e6782a89e8679d00f1cf2bda955f45a6f7e. -
Head SHA:
93e56e6782a89e8679d00f1cf2bda955f45a6f7e -
Workflow run: 30435182191
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 3
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Frontend (3 files)"]
S1 --> I1["browser runtime and bundle"]
I1 --> R1["Review risk: Frontend (3 files)"]
R1 --> V1["frontend tests"]
Central coverage transport defect was fixed and merged in ContextualWisdomLab/.github#643. This dismissal is not an approval; it removes a non-source tool-state blocker solely to permit a fresh exact-head OpenCode rerun at 93e56e6.
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head93e56e6782a89e8679d00f1cf2bda955f45a6f7e. -
Head SHA:
93e56e6782a89e8679d00f1cf2bda955f45a6f7e -
Workflow run: 30439758983
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Frontend (3 files)"]
S1 --> I1["browser runtime and bundle"]
I1 --> R1["Review risk: Frontend (3 files)"]
R1 --> V1["frontend tests"]
Dismissed only because central coverage run 30439758983 failed on the fixed trusted-workflow path duplication (frontend/frontend/pnpm-lock.yaml), not on target code or tests. Central fix ContextualWisdomLab/.github#645 is merged at 66c2b1d; this dismissal is not approval and permits a fresh exact-head review.
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headc705f89a79054c355e781bb7307ea29bb969b036. -
Head SHA:
c705f89a79054c355e781bb7307ea29bb969b036 -
Workflow run: 30443337486
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Frontend (3 files)"]
S1 --> I1["browser runtime and bundle"]
I1 --> R1["Review risk: Frontend (3 files)"]
R1 --> V1["frontend tests"]
Dismissed only because central coverage run 30443337486 passed pnpm install and all 394 target tests, then failed reading root-owned mode-0600 /tmp/javascript-coverage-summaries.* as the unprivileged sandbox UID. Central fix is in ContextualWisdomLab/.github#647; this dismissal is not approval and permits an exact-head rerun after merge.
|
Closing after Loop drain: permanently blocked — branch was updated onto develop for mergeability, which cleared prior APPROVED robot evidence; re-review (CodeRabbit/OpenCode) and/or central gate jobs (metadata-only gate evaluation, coverage-evidence) remained pending/stuck without a re-runnable workflow handle. Not force-merging (merge-gate policy). Re-open a focused PR when robot capacity is available. Related product security fixes that reimplemented cleanly remain on branch goal/carddav-path-traversal-decode (#1206) for relaunch. |
Pull request was closed
|
Superseded by #1184. This branch only adjusts the trusted origin / IPv6 authority construction and does not pin DNS resolution, so it does not provide the full DNS-rebinding protection required for Critical CodeQL alert #318. #1184 retains the stronger resolve-validate-pin request path, current-head CodeRabbit approval, resolved GHAS threads, and clean branch/merge-ref CodeQL evidence. Closing this weaker duplicate without merge. |
Pull request was closed
1 participant
문제
기본 브랜치 current HEAD
405ceee68b069d38cb958c1c60156bc5a7d4a942의 CodeQL alert #318 (js/request-forgery, Critical)이 이전 수정 후에도 재현되었습니다. 실제 taint 경로는BACKEND_INTERNAL_URL에서 파생된 IPv6 hostname이trustedBackendOrigin()의 IPv6 분기에서 인코딩 없이 authority에 보간되는 경로였습니다.수정
encodeURIComponent로 경계 처리합니다.%3A를 고정:로 복원하고, 다른 authority 문자는 복원하지 않습니다.Current-head verification
Head:
4afd4af7ad343660356791873d940aa2846f40c2tsc --noEmit: passedSecurity evidence
frontend/src/app/api/[...path]/route.ts:284, sourcefrontend/src/lib/backend-url.ts:44encodeURIComponentbefore reachingfetch.Summary by CodeRabbit