feat(apps): replace +html-publish cwd hard-reject with credential-file scan#1072
Merged
Conversation
…e scan The previous --path == "." block was a coarse heuristic: it caught the common foot-gun of publishing a repo root, but also rejected legitimate clean cwds, and let a ./dist with a forgotten .env ship the secret through anyway (the sensitive-paths scanner was advisory and never ran on the Execute path). Move the gate from path shape to path content: - Validate now walks --path candidates and rejects publishes that include well-known credential files (.env / .env.* / .npmrc / .netrc / .git-credentials / .aws/credentials / .gcloud/credentials* / .docker/config.json / .kube/config). Living in Validate (not DryRun) means dry-run returns non-zero on hit too, so the dry-run preview matches Execute. - Narrow the credential pattern set. .git/, SSH private keys, *.pem and *.key are out of scope -- they're not env-token files and the false-positive rate (public certs, docs about key formats) is high. - Add --allow-sensitive as the escape hatch for legitimate cases (e.g. a docs site shipping .env.example on purpose). DryRun surfaces the waived list in sensitive_waived so the caller can relay it. - Drop the cwd defense-in-depth in runHTMLPublish. A clean cwd is now a valid publish target. The lark-apps skill and the html-publish reference are updated to describe the new gate, the override flag, and the patterns now explicitly out of scope.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughRefine html-publish credential validation: narrow detected sensitive paths, add an ChangesHTML Publish Credential Validation
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
the
size/M
🚀 PR Preview Install Guide🧰 CLI updatenpm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@78cd9c0e3a2fe33bd7f112d1c6c7eed5b71b08f5🧩 Skill updatenpx skills add larksuite/cli#feat/apps-sensitive-block -y -g |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1072 +/- ##
==========================================
+ Coverage 67.79% 67.90% +0.10%
==========================================
Files 591 592 +1
Lines 55237 55410 +173
==========================================
+ Hits 37448 37625 +177
+ Misses 14680 14673 -7
- Partials 3109 3112 +3 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@skills/lark-apps/SKILL.md`:
- Line 48: The documentation entry uses the glob ".gcloud/credentials*" which
implies files like "credentials_old" would be blocked, but the
implementation/tests only match "credentials" and "credentials.*"; update the
wording to replace ".gcloud/credentials*" with a precise description such as
".gcloud/credentials and .gcloud/credentials.*" (or explicitly state that only
the exact file name and dotted extensions are matched) so the doc aligns with
the actual matcher behavior and avoids false expectations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 278378ff-6a15-4729-910a-39644fded08b
📒 Files selected for processing (7)
shortcuts/apps/apps_html_publish.goshortcuts/apps/apps_html_publish_test.goshortcuts/apps/sensitive_paths.goshortcuts/apps/sensitive_paths_test.goskills/lark-apps/SKILL.mdskills/lark-apps/references/lark-apps-html-publish.mdtests/cli_e2e/apps/apps_html_publish_dryrun_test.go
The .gcloud/credentials pattern matched a non-existent path: gcloud's actual config dir is ~/.config/gcloud/ (XDG-based), and the real credential files there are credentials.db / access_tokens.db / application_default_credentials.json -- none of which would land under a .gcloud/ segment in a publish payload. Drop the rule rather than fix it: the realistic gcloud foot-gun would require recognizing the .config/gcloud/* tree by file basename, which is a broader change than the targeted env/cred scan in this PR. The remaining 7 patterns (.env / .env.* / .npmrc / .netrc / .git-credentials / .aws/credentials / .docker/config.json / .kube/config) cover the common Node/Python/CLI-tooling foot-guns.
Collaborator
Author
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. 🤖 Generated with Claude Code - If this code review was useful, please react with 👍. Otherwise, react with 👎. |
… itself isSensitiveRelPath anchors cloud-SDK matchers on adjacent parent/file segments (.aws/credentials, .docker/config.json, .kube/config), but walker strips that parent via filepath.Rel when --path is the conventional parent dir (e.g. ./.aws), yielding a bare RelPath="credentials" that slipped through silently. Same bypass for the single-file form --path ./.aws/credentials (walker sets RelPath = Base(rootPath)). Wrap the scan in isSensitiveCandidate: keep the fast RelPath scan, and on miss fall back to filepath.Abs(AbsPath) so the parent segment is visible again. isSensitiveRelPath itself is unchanged; existing tests still pin its pure-function contract.
… lint The previous fix called filepath.Abs(c.AbsPath) — banned by the repo's forbidigo rule because shortcuts must not reach into the filesystem for path resolution. Reframe the same fix without fs access: re-prepend the root's basename (or, for the single-file form, the parent dir's basename of rootPath) to RelPath and re-scan only the parent-anchored credential pairs (.aws/credentials, .docker/config.json, .kube/config). Leaf matchers (.env / .npmrc / ...) stay scoped to RelPath — incidentally closing a latent false-positive where --path /home/alice/.env/dist would have flagged every file under it just because .env appeared in the absolute path.
liangshuo-1
approved these changes
May 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The previous
--path == "."block inapps +html-publishwas a coarse heuristic: it caught the common foot-gun of publishing a repo root, but also rejected legitimate clean cwds, and let a./distwith a forgotten.envship the secret through anyway (the sensitive-paths scanner was advisory and never ran on the Execute path). This PR replaces the path-shape gate with a content-based credential-file scan.Changes
Validate.Validatenow walks--pathcandidates and rejects publishes that include well-known credential files. Living inValidate(notDryRun) means dry-run returns non-zero on hit too, so the dry-run preview matches what Execute would do..env,.env.*,.npmrc,.netrc,.git-credentials,.aws/credentials,.docker/config.json,.kube/config. Explicitly out of scope (false-positive rate too high, or wrong real-world path):.git/SCM history, SSH private keys (id_rsa*/id_ed25519*etc.),*.pem/*.key,.aws/config, gcloud's config tree (real location is~/.config/gcloud/, not~/.gcloud/).--allow-sensitiveas the escape hatch for legitimate cases (e.g. a docs site shipping.env.exampleon purpose).DryRunsurfaces the waived list in asensitive_waivedfield so the caller can relay it to the user.runHTMLPublish. A clean cwd is now a valid publish target.lark-appsskill and thelark-apps-html-publishreference to describe the new gate, the override flag, and the patterns now explicitly out of scope.Test Plan
go test ./shortcuts/apps/ ./tests/cli_e2e/apps/ ./cmd/auth/passesgo vet ./...cleangofmt -l shortcuts/apps/ tests/cli_e2e/apps/cleanapps +html-publish --helplists--allow-sensitive--allow-sensitiveoverrides; truncation in the validation error messageRelated Issues
Summary by CodeRabbit
New Features
Bug Fixes
Documentation
Tests