Conversation
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 22 minutes and 15 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📝 WalkthroughWalkthroughThis pull request resolves CodeQL security alerts by adding explicit Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
- scripts/setup-zitadel.py: write sensitive config (client secrets, IDs) to .env.zitadel-setup file instead of logging to stdout; mask admin password in all print output; add .env.zitadel-setup to .gitignore; fix unused api_app variable - .github/workflows/release.yml: add explicit permissions (contents: read) to lint, test, and build jobs Resolves CodeQL alerts #3-#9. Closes #42 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This is a local development setup script — printing credentials to stdout is acceptable and helpful. Restore the original stdout output, add a dev-environment disclaimer comment, and keep the .env.zitadel-setup file as an additional convenience. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
JohnRDOrazio
force-pushed
the
fix/codeql-security-alerts
branch
from
c78a206 to
ae25938
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (3)
scripts/setup-zitadel.py (3)
61-62: Nitpick: Add explicit mode toopen()for clarity.While the default mode
"r"works correctly, being explicit improves readability.Suggested fix
- with open("/tmp/admin.pat") as f: + with open("/tmp/admin.pat", "r") as f:🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/setup-zitadel.py` around lines 61 - 62, The open call that reads the admin PAT currently relies on the default read mode; update the call that opens "/tmp/admin.pat" to explicitly pass mode "r" (e.g., open("/tmp/admin.pat", "r")) so the read is explicit and clear—this affects the block that reads into variable pat in the script (the with open(...) as f: / pat = f.read().strip() section).
286-304: Consider masking the password in the file comment.Line 289 writes the admin password in clear text to the file comment, contributing to the CodeQL clear-text storage alert on line 304. Since users already see credentials in stdout, the file comment could mask it:
🔒 Proposed fix
env_lines = [ "# Generated by setup-zitadel.py (LOCAL DEVELOPMENT ONLY)\n", f"# Zitadel Console: {ZITADEL_URL}\n", - f"# Login: {ADMIN_USERNAME} / {ADMIN_PASSWORD}\n\n", + f"# Login: {ADMIN_USERNAME} / ******* (see stdout for password)\n\n", "# ontokit-api/.env\n", f"ZITADEL_ISSUER={ZITADEL_URL}\n", ]🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/setup-zitadel.py` around lines 286 - 304, The file writes the admin password into env_lines (see env_lines list construction using ADMIN_PASSWORD) which stores clear-text credentials into env_file; change the comment line that includes f"# Login: {ADMIN_USERNAME} / {ADMIN_PASSWORD}\n" to mask or redact the password (e.g. f"# Login: {ADMIN_USERNAME} / ******\\n" or omit the password) before appending to env_lines, keeping the actual ADMIN_PASSWORD variable intact for any programmatic use but ensuring env_lines only contains a masked value; update the code that builds env_lines (and any related string) so the written .env.zitadel-setup file never contains the plain ADMIN_PASSWORD.
268-280: Consider includingZITADEL_SERVICE_TOKENin the output.The script outputs
ZITADEL_ISSUER,ZITADEL_CLIENT_ID, andZITADEL_CLIENT_SECRET, butcompose.yamland.env.examplealso referenceZITADEL_SERVICE_TOKEN(the PAT for service account user lookups).The PAT is already retrieved in
get_admin_token(). If users are expected to configure this separately, a comment indicating where to find it would help:print("# ontokit-api/.env") print(f"ZITADEL_ISSUER={ZITADEL_URL}") if native_app.get("clientId"): print(f"ZITADEL_CLIENT_ID={native_app['clientId']}") +print("# ZITADEL_SERVICE_TOKEN can be found at: docker cp ontokit-zitadel:/zitadel-data/admin.pat -") print()🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/setup-zitadel.py` around lines 268 - 280, Add the ZITADEL_SERVICE_TOKEN to the printed env output using the admin token retrieved by get_admin_token(): when printing for ontokit-api (.env) and ontokit-web (.env.local) include a line like ZITADEL_SERVICE_TOKEN=<admin_token> (use the variable returned from get_admin_token()), so both places output the PAT used for service-account lookups alongside ZITADEL_ISSUER, ZITADEL_CLIENT_ID and ZITADEL_CLIENT_SECRET; if you prefer not to print secrets, instead print a short comment pointing users to where to obtain the service token and reference get_admin_token() as the retrieval location.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@scripts/setup-zitadel.py`:
- Around line 61-62: The open call that reads the admin PAT currently relies on
the default read mode; update the call that opens "/tmp/admin.pat" to explicitly
pass mode "r" (e.g., open("/tmp/admin.pat", "r")) so the read is explicit and
clear—this affects the block that reads into variable pat in the script (the
with open(...) as f: / pat = f.read().strip() section).
- Around line 286-304: The file writes the admin password into env_lines (see
env_lines list construction using ADMIN_PASSWORD) which stores clear-text
credentials into env_file; change the comment line that includes f"# Login:
{ADMIN_USERNAME} / {ADMIN_PASSWORD}\n" to mask or redact the password (e.g. f"#
Login: {ADMIN_USERNAME} / ******\\n" or omit the password) before appending to
env_lines, keeping the actual ADMIN_PASSWORD variable intact for any
programmatic use but ensuring env_lines only contains a masked value; update the
code that builds env_lines (and any related string) so the written
.env.zitadel-setup file never contains the plain ADMIN_PASSWORD.
- Around line 268-280: Add the ZITADEL_SERVICE_TOKEN to the printed env output
using the admin token retrieved by get_admin_token(): when printing for
ontokit-api (.env) and ontokit-web (.env.local) include a line like
ZITADEL_SERVICE_TOKEN=<admin_token> (use the variable returned from
get_admin_token()), so both places output the PAT used for service-account
lookups alongside ZITADEL_ISSUER, ZITADEL_CLIENT_ID and ZITADEL_CLIENT_SECRET;
if you prefer not to print secrets, instead print a short comment pointing users
to where to obtain the service token and reference get_admin_token() as the
retrieval location.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 1acd2c39-53b7-4a05-8461-ce45dcb1d35d
📒 Files selected for processing (3)
.github/workflows/release.yml.gitignorescripts/setup-zitadel.py
Stdout printing of dev credentials is intentional, but the written env file is more persistent — mask the password there. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2 participants
Summary
scripts/setup-zitadel.py: Write sensitive config (client IDs, secrets) to.env.zitadel-setupfile instead of logging to stdout. Mask admin password in all print output. Add.env.zitadel-setupto.gitignore. Fix pre-existing unusedapi_appvariable..github/workflows/release.yml: Add explicitpermissions: { contents: read }tolint,test, andbuildjobs.Resolves CodeQL alerts #3–#9:
py/clear-text-logging-sensitive-data(high severity)actions/missing-workflow-permissions(medium severity)Test plan
python scripts/setup-zitadel.pyagainst a local Zitadel instance and verify credentials are written to.env.zitadel-setupinstead of stdoutCloses #42
🤖 Generated with Claude Code
Summary by CodeRabbit