8000 fix(security): reject option-like package names in adapters; constant-time API key check by devin-ai-integration[bot] · Pull Request #107 · dominicusin/package-maximizer · GitHub
[go: up one dir, main page]
Skip to content

fix(security): reject option-like package names in adapters; constant-time API key check - #107

Merged
dominicusin merged 3 commits into
mainfrom
devin/1791934500-audit-fixes
Oct 18, 2026
Merged

fix(security): reject option-like package names in adapters; constant-time API key check#107
dominicusin merged 3 commits into
mainfrom
devin/1791934500-audit-fixes

Conversation

@devin-ai-integration
@devin-ai-integration devin-ai-integration Bot commented Oct 13, 2026
Copy link
Copy Markdown
Contributor

Summary

Fixes from a code/security audit (bandit, pip-audit, flake8, mypy, manual review).

  • Option injection in metadata adapters (medium): package names from POST /api/v1/propose and CLI propose were passed as positional arguments to apt-cache show, pip show, pacman -Si, npm view and brew info. No shell is involved, but a name like --registry=http://attacker was parsed as a CLI option. Every *MetadataAdapter.fetch() now checks _is_safe_package_name() first: names that start with -, contain whitespace or exceed 256 chars return None without calling subprocess.
  • API key comparison (low): require_api_key now uses hmac.compare_digest instead of !=.
  • Dead code: removed unused imports/variables (autoflake on non-__init__ modules), the unused var_map in maxsat_solver/minisat_solver, and f-strings without placeholders. flake8 --select=F is now clean except for intentional re-exports in __init__.py.
  • New tests/test_audit_fixes.py.

Not changed, needs a maintainer decision:

  • ?api_key= query-string auth leaks the key into access logs; removing it breaks the API.
  • 8 existing mypy errors in solvers/ortools_solver.py from the CamelCase CpModel API.
  • nltk 3.10.3 (PYSEC-2026-3740) comes in transitively through the dev-only safety tool.

Checks

  • make test passes (Python 3.10: 891 passed; Python 3.12 + PuLP 4.0: 888 passed)
  • flake8 critical check passes; black/isort clean
  • docs updated if behavior changed (no user-facing docs affected)

Link to Devin session: https://app.devin.ai/sessions/7a195999dfd146d48fbc98f4bab6707a
Open in Devin Desktop: https://app.devin.ai/desktop/session/7a195999dfd146d48fbc98f4bab6707a?variant=devin
Requested by: @dominicusin

@devin-ai-integration @dominicusin
fix(security): reject option-like package names in adapters; constant…
bd0acce 
…-time API key check; remove dead code

Co-Authored-By: dominicusin <dominicusin@yahoo.com>
@devin-ai-integration
devin-ai-integration Bot commented Oct 13, 2026
Copy link
Copy Markdown
Contributor Author

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

  • Disable automatic comment, CI, and merge conflict monitoring

@coderabbitai
coderabbitai Bot commented Oct 13, 2026 •
edited
Loading
Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 932f767f-cb38-4733-a3eb-b5c472ff9aa4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@read-the-docs-community
read-the-docs-community Bot commented Oct 13, 2026 •
edited
Loading
Copy link
Copy Markdown

Documentation build overview

📚 package-maximizer | 🛠️ Build #35216678 | 📁 Comparing 7f9b612 against latest (1074692)

  🔍 Preview build  

6 files changed · ± 6 modified

± Modified

@dominicusin
dominicusin enabled auto-merge (squash) October 13, 2026 23:26
@devin-ai-integration devin-ai-integration Bot mentioned this pull request Oct 13, 2026
Merged
3 tasks done
@dominicusin
dominicusin merged commit a5788ab into main Oct 18, 2026
16 checks passed
@dominicusin
dominicusin deleted the devin/1791934500-audit-fixes branch October 18, 2026 00:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dominicusin dominicusin dominicusin approved these changes

Assignees

@dominicusin dominicusin

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dominicusin
0