Repository navigation
Harden after SAST review; go-openadr v0.6.0; Go 1.26 fix - #11
Merged
Merged
Conversation
…without integer conversions (G115) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Network: redirects stay within the origin (no client secret sent elsewhere), bearer tokens checked, expires_in capped, token answers bounded, VTN text escaped in error lines, passwords in URLs redacted, no token over plain MQTT for an https VTN, webhook server timeouts, no records after a stream ends. Local: files and stdin read up to 16 MiB, control characters escaped in text and table output, generate-config --force writes 0600, non-finite --rate and negative ISO durations refused, flag binder safe for named types. Fuzz targets for flag values, environment and output escaping. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
…tested With --force the file is removed and created anew (O_EXCL, 0600), so a symbolic link at --output is replaced rather than written through. Tests for a subscription the VTN will not delete, Clean cutting at a rune, a cut-off /auth/server answer, and write and close failures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardening after a SAST review, on go-openadr v0.6.0. Prepares v0.5.0: the notes are in RELEASE.md.
SAST (low/low)
There were 11 findings. 10 are fixed in code, and 1 is triaged in the private triage repository:
type Port uint16) work instead of panicking.--insecureis the user's explicit choice, so it is triaged as a false positive.Hardening
Network:
expires_inis capped at 100 years.error:lines.Local:
generate-config --forcewrites the file with mode 0600.--rateand negative ISO durations are refused.Several failures now exit with a different code. They are listed in RELEASE.md and documented in docs/exitcodes.md and docs/json-output.md.
Also
go fixfor Go 1.26.Verified locally
make check: coverage 92.1% → 94.0%.make e2eandgo test -race ./....scripts/interop.sh: 25/25 against OpenLEADR, v0.6.3.scripts/interop301.sh: 37/37 against OpenLEADR v0.1.4, 3.0.1.🤖 Generated with Claude Code