Repository navigation
fix: SAST hardening, Go 1.26, go-canopen v0.4.1, go-canbus v0.8.0 - #16
Merged
Merged
Conversation
SAST (gosec/opengrep, low/low): 34 findings fixed in code. Integer node-ID flags wrapped before their range check (--client-id, --master-id, --first, simulate --node-id: 257 was node 1); --baud accepted 1..9; output files 0600, directories 0750; paths cleaned. New --max-size for SDO/USDO uploads (1 MiB default, go-canopen bounds both now); a local out-of-memory abort names it. --retries also repeats SDO transfers broken by lost or reordered frames, after one --timeout. Tests: hostile SDO servers, TestMonkeySDO through a chaos bridge (found the go-canopen v0.4.0 stale-segment defect, fixed in v0.4.1), fuzz targets for numbers, trace decoding and EDS files, regression tests. Interop images canopen-interop v0.3.1, workflows v3.3.1, CI Go 1.26/1.27. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SAST review (
make sast SEVERITY=low CONFIDENCE=low): 34 findings, all fixed in code, 0 open, no triage records. Go 1.26 floor withgo fix, go-canopen v0.4.1, go-canbus v0.8.0, canopen-interop v0.3.1 images, shared workflows v3.3.1.Defects fixed
--client-id 257ran as node 1. This applied toboot --master-id,lss assign-all --firstandsimulate --node-idtoo. They are now refused with exit 3. The regression tests fail onmain.eds convert --baudaccepted 1..9 although the help says 10..1000.Hardening
--max-size(SDO and USDO uploads, 1 MiB default, up to 1 GiB). A local out-of-memory abort now says that the data is larger than--max-size.--retriesalso repeats SDO transfers broken by lost, duplicated or reordered frames (toggle, command and block aborts), after waiting one--timeout.Tests
TestMonkeySDOruns SDO through a chaos bridge. It found a go-canopen v0.4.0 SDO defect, wrong data after a retry, fixed in go-canopen v0.4.1 (fix(sdo): discard stale responses before segment requests (v0.4.1) go-canopen#20).FuzzParseNumbers,FuzzDecodeTraceandFuzzEDSFile.make checkpasses with 93.1% coverage; golangci-lint reports 0 issues.Breaking changes and notes are in RELEASE.md v0.4.0.
🤖 Generated with Claude Code