Skip to content

fix(quality): preserve capped reader failures to prevent uncapped reads in diff scans - #120

Merged
alxxjohn merged 1 commit into
mainfrom
alexj/fix-vulnerability-in-codeguard-repository
Aug 18, 2026
Merged

fix(quality): preserve capped reader failures to prevent uncapped reads in diff scans#120
alxxjohn merged 1 commit into
mainfrom
alexj/fix-vulnerability-in-codeguard-repository

Conversation

@alxxjohn

Copy link
Copy Markdown
Contributor

Motivation

  • Prevent diff-mode maintainability checks from bypassing the configured size-capped file reader and performing an uncapped os.ReadFile when the reader returns an error.

Description

  • Change readCurrentTargetFile to honor failures from the configured env.ReadTargetFile by returning the error result rather than falling back to an unconditional os.ReadFile when the callback exists.
  • Keep the direct filesystem os.ReadFile fallback only when no env.ReadTargetFile callback is configured, preserving prior fallback behavior for unconfigured contexts.
  • Add a regression test internal/codeguard/checks/quality/quality_precision_delta_test.go that verifies a reader error (e.g. scan-limit error) is not bypassed by readCurrentTargetFile.

Testing

  • Ran go test ./internal/codeguard/checks/quality and the package tests passed (ok).
  • Ran the maintainability diff tests with go test ./tests/checks -run 'TestMaintainability(PublicSurface|Dependency)GrowthWarnsInDiffScan' -count=1 and they passed (ok).
  • Ran the combined checks used in CI (go test ./internal/codeguard/checks/quality ./tests/checks) and the tests completed successfully.

Codex Task

@alxxjohn
alxxjohn merged commit 2e82480 into main Aug 18, 2026
16 checks passed
@alxxjohn
alxxjohn deleted the alexj/fix-vulnerability-in-codeguard-repository branch August 22, 2026 19:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant