Skip to content

fix(db): reject code-span linked issue matches#4089

Merged
JSONbored merged 1 commit into
mainfrom
codex/propose-fix-for-linked-issue-vulnerability
Jul 8, 2026
Merged

fix(db): reject code-span linked issue matches#4089
JSONbored merged 1 commit into
mainfrom
codex/propose-fix-for-linked-issue-vulnerability

Conversation

@JSONbored

Copy link
Copy Markdown
Owner

Motivation

  • Prevent inline code spans from bridging a closing keyword and a later issue number so malformed Markdown like Fixes not a directive #42 cannot be treated as a valid linked-issue reference.
  • Preserve the intended behavior of ignoring code-span-contained examples (e.g. the PR template (e.g. Closes feat(data): add contributor reconciliation reports #123)) while avoiding the new false-positive introduced by whitespace replacement.

Description

  • Update extractLinkedIssueNumbersWithOverflow to scan the original text and compute inline code-span ranges (regex: /`[^`\n]*`/g) and skip any closing-keyword regex match that overlaps a code span; the closing-keyword regex remains the same. (file: src/db/repositories.ts)
  • Add regression unit tests that assert closing keywords separated from issue references by inline code spans are not joined into valid matches and that valid references outside code spans continue to extract. (file: test/unit/db-parsers.test.ts)
  • Regenerate Cloudflare worker runtime types to satisfy local drift checks (worker-configuration.d.ts).

Testing

  • Ran npm run typecheck which completed successfully (no TypeScript errors).
  • Ran npx vitest run test/unit/db-parsers.test.ts and the updated unit tests passed (45 tests passed).
  • Attempted the full local gate via npm run test:ci; it initially reported stale worker-configuration.d.ts (fixed by regenerating types), then the full coverage run stalled in unrelated queue test output and was interrupted (not a regression in the linked-issue change).
  • Running coverage for the single test file with --coverage exercised the tests but the coverage remapping failed downstream with TypeError: jsTokens is not a function (an unrelated coverage remapping/tooling issue).
  • npm audit --audit-level=moderate could not complete in this environment (npm audit endpoint returned 403 Forbidden).

Codex Task

@superagent-security

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@codecov

codecov Bot commented Jul 8, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.65%. Comparing base (1ec9f94) to head (bc7ecf5).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #4089   +/-   ##
=======================================
  Coverage   93.65%   93.65%           
=======================================
  Files         384      384           
  Lines       35865    35868    +3     
  Branches    13160    13160           
=======================================
+ Hits        33589    33592    +3     
  Misses       1618     1618           
  Partials      658      658           
Files with missing lines Coverage Δ
src/db/repositories.ts 96.71% <100.00%> (+<0.01%) ⬆️
🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@loopover-orb loopover-orb Bot added the gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. label Jul 8, 2026
@loopover-orb

loopover-orb Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

Review updated: 2026-07-08 03:25:41 UTC

2 files · 1 blocker · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

  • No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

Concerns raised — review before merging

  • No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
Signal Result Evidence
Code review ❌ 1 blocker No AI review summary
Linked issue ✅ Linked #123
Related work ✅ No active overlap found No same-issue or scoped active PR overlap found.
Change scope ✅ 20/20 Low review scope from cached public metadata (1 linked issue).
Validation posture ✅ 25/25 PR body includes validation/test evidence.
Contributor workload ✅ 10/10 Author activity: 51 registered-repo PR(s), 43 merged, 505 issue(s).
Contributor context ✅ Confirmed Gittensor contributor JSONbored; Gittensor profile; 51 PR(s), 505 issue(s).
Gate result ❌ Blocking Repo-configured hard blocker found.
Linked issue satisfaction

Not yet addressed
The issue asks for a new contributor reconciliation reporting feature (official vs cached GitHub totals, mismatch reasons, reconciliation threading into outcome history), but the PR only fixes an unrelated regex bug in extractLinkedIssueNumbersWithOverflow to prevent code-span text from bridging closing keywords to issue numbers. The diff contains no reconciliation logic, totals comparison, or out

Review context
  • Author: JSONbored
  • Role context: owner (maintainer lane)
  • Public audience mode: oss maintainer
  • Lane context: Repository is configured for direct PR review.
  • Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
  • Official Gittensor activity: 51 PR(s), 505 issue(s).
  • PR-specific overlap: none found.
Contributor next steps
  • Treat this as maintainer-lane context rather than normal contributor-lane activity.
Signal definitions
  • Related work = same linked issue, overlapping active PRs, or title/path similarity.
  • Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
  • Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
  • Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
  • Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed


💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

  • Re-run Gittensory review

@loopover-orb loopover-orb Bot added the manual-review Gittensor contributor context label Jul 8, 2026
@JSONbored
JSONbored force-pushed the codex/propose-fix-for-linked-issue-vulnerability branch from 9303bb4 to bc7ecf5 Compare July 8, 2026 02:50
@JSONbored
JSONbored merged commit 1b64336 into main Jul 8, 2026
10 checks passed
@JSONbored
JSONbored deleted the codex/propose-fix-for-linked-issue-vulnerability branch July 8, 2026 03:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. manual-review Gittensor contributor context

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant