Repository navigation
Sonar pass 2: clear the 12 new findings and make coverage count - #21
Merged
Merged
Conversation
Findings (all 12 open on main after PRs #15-#20): - prompts.py: delimiter-scrubbing regex rewritten as `<\s*(?:/\s*)?(rule|analysis)\s*>` so the two whitespace runs cannot backtrack against each other (S8786). Same match set, verified exhaustively over short alphabets; 20 KB of whitespace drops from 2.3 s to instant. The rule text is attacker-supplied and up to 64 KB. - test_prompt_injection.py: nine composite asserts split (S9073). - index.html: the theme bootstrap's empty catch says why it is empty (S2486). AccessGate: title text wrapped in a span so the JSX spacing after the logo is explicit (S6772). Coverage gate (76.3% on new code vs 80%): - Frontend tests were invisible to SonarCloud: no lcov file was ever produced, so every .ts file scored 0%. vitest now runs with the v8 coverage provider in CI and sonar-project.properties points at frontend/coverage/lcov.info. - backend/tests/conftest.py is classified as test code, not source. - New test_llm_client.py drives AnthropicLlmClient against a stubbed SDK: request shape, refusal, JSON output config, effort/timeout forwarding, every SDK-error-to-LlmError mapping, and streaming (deltas, final-message refusal, mid-stream failure). client.py goes from 52% to 100%; backend total 93% -> 96%. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
SonarCloud analysis · PR #21Quality gate: ✅ Passed · Open in SonarCloud
Open issues on new code: 0No open issues on the changed code. 🎉 Commit |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Second SonarCloud pass on
main. PRs #15 to #20 landed 12 new findings; this clears all of them and fixes the reason the coverage gate has been red.Findings
prompts.py: the delimiter-scrubbing regex is rewritten as<\s*(?:/\s*)?(rule|analysis)\s*>so its two whitespace runs cannot backtrack against each other (S8786, super-linear). Same match set, verified exhaustively over 111k generated strings; 20 KB of whitespace drops from 2.3 s to instant. The input is attacker-supplied rule text up to 64 KB, so this was a real slow-input vector.test_prompt_injection.py: nine composite asserts split (S9073).index.html: the theme bootstrap's emptycatchnow says why it is empty (S2486).AccessGate.tsx: title text wrapped in a<span>so the spacing after the logo is explicit (S6772).Coverage gate (was 76.3% on new code against 80%)
.tsfile scored 0% even where tests exist.vitest run --coverage(v8 provider, new dev dependency) now writesfrontend/coverage/lcov.infoin CI andsonar-project.propertiespoints at it.backend/tests/conftest.pyis now classified as test code rather than uncovered source.test_llm_client.pydrivesAnthropicLlmClientagainst a stubbed SDK: request shape, refusal, JSON output config, effort and timeout forwarding, every SDK-error-to-LlmErrormapping, and streaming (deltas, final-message refusal, mid-stream failure).client.pygoes from 52% to 100%; backend total 93% to 96%.Verification
🤖 Generated with Claude Code