Repository navigation
Conversation
Enforce upfront checks (<= 0) on base_id, year_id, and neighbor_id parameters across year management, rollover, and neighbor association endpoints to prevent unexpected database errors and unconstrained queries. Co-authored-by: d0linger <61334677+d0linger@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Apply input hardening from PRs #240-243, #247-248 and #250, consolidate duplicate proposals, and adapt validation to the new accounting presets. Update the matched browser packages/image and patched Go toolchains from PRs #244-246 and #249 while preserving correct image digests. Require passkey authentication when policy forbids password-only sign-in, serialize signature changes with the open account/invoice boundary, and keep audit verification consistent with concurrent sealing and pruning. Reject overflowing form integers and add regression coverage. Validate with the pinned linter, vet, dead-code and vulnerability scans, PostgreSQL 16/18 race and integration suites, 208 browser tests and 40 existing screenshot baselines.
|
Superseded by #251 |
🛡️ Sentinel Security PR: Validate non-positive base, year, and neighbor form IDs
base_id,year_id,neighbor_id) bypassing upfront validation checks and executing database queries/transactions.<= 0) could cause unexpected foreign key constraint errors or unconstrained database operations.<= 0) inhandleYearCreate,handleYearUpdate,handleYearAddNeighbor,handleYearRemoveNeighbor, andhandleYearRolloverCreatebefore database calls.TestYearIDValidationunit tests ininternal/server/input_limits_test.goand verified withgo test ./....PR created automatically by Jules for task 15734210251081677727 started by @d0linger