fix(security): remove vulnerable python-ecdsa JWT dependency path - #743
fix(security): remove vulnerable python-ecdsa JWT dependency path#743seonghobae wants to merge 11 commits into
Conversation
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Warning Review limit reached
Next review available in: 10 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughOIDC JWT 검증 라이브러리를 ChangesOIDC JWT 검증 마이그레이션
Data Dictionary Export 기록
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant OIDCProvider
participant authpy
participant PyJWT
OIDCProvider->>authpy: JWK 제공
authpy->>PyJWT: PyJWK(jwk).key 변환
authpy->>PyJWT: 알고리즘 및 클레임 검증
PyJWT-->>authpy: 검증 결과 또는 PyJWTError
authpy-->>OIDCProvider: 검증 결과 또는 HTTP 401
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
seonghobae
changed the title
|
@opencode-agent Please review exact current head |
|
@cwl-noema-review Please independently review exact current head |
|
@opencode-agent Apply one bounded scope repair on exact current head |
|
@opencode-agent review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_sha="0aaaae0015d7b5893ea6e602184b602943878d52"
echo '== Exact checkout and merge base =='
git rev-parse HEAD
git status --short
git branch --show-current
base_ref="$(git merge-base HEAD origin/main)"
printf 'merge-base=%s\n' "$base_ref"
git diff --name-status "$base_ref"...HEAD
echo '== Focused structural map =='
for f in backend/app/auth.py backend/tests/test_auth_security.py backend/pyproject.toml CHANGELOG.md docs/doctoring/jwt-verification-and-library-migration.md; do
if [ -f "$f" ]; then
echo "-- $f"
ast-grep outline "$f" --view expanded || true
fi
done
echo '== Authentication implementation and tests =='
sed -n '1,280p' backend/app/auth.py
sed -n '1,360p' backend/tests/test_auth_security.py
echo '== Dependency declarations and all tracked lock candidates =='
sed -n '1,260p' backend/pyproject.toml
fd -HI '(^|.*)(lock|requirements).*' backend -t f -x sh -c '
echo "-- $1"
rg -n -i -C2 "(python-jose|types-python-jose|ecdsa|pyjwt|cryptography)" "$1" || true
' sh {}
echo '== Repository-wide forbidden dependency references, excluding Git internals =='
rg -n -i -C2 '(python-jose|types-python-jose|(^|[-_])ecdsa([<>=!~ \[\],;]|$))' \
-g '!**/.git/**' . || true
echo '== Documentation diffs =='
git diff --no-ext-diff --unified=80 "$base_ref"...HEAD -- \
CHANGELOG.md \
docs/doctoring/jwt-verification-and-library-migration.md \
.jules/sentinel.md || true
echo '== Exact commit verification =='
git cat-file -e "${expected_sha}^{commit}"
git diff --no-ext-diff --stat "$base_ref"...HEAD
echo '== GitHub PR, changed files, and commit checks =='
gh pr view 743 --repo ContextualWisdomLab/pg-erd-cloud \
--json number,headRefOid,baseRefName,changedFiles,files,statusCheckRollup,reviewDecision \
--jq '{number, headRefOid, baseRefName, changedFiles, reviewDecision, files: [.files[].path], checks: [.statusCheckRollup[] | {name, status, conclusion, detailsUrl}]}'
gh api "repos/ContextualWisdomLab/pg-erd-cloud/commits/${expected_sha}/check-runs?per_page=100" \
--jq '.check_runs[] | {name,status,conclusion,details_url,started_at,completed_at}'
gh api "repos/ContextualWisdomLab/pg-erd-cloud/commits/${expected_sha}/statuses" \
--jq '.statuses[] | {context,state,target_url,description,updated_at}'Length of output: 42793 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_sha="0aaaae0015d7b5893ea6e602184b602943878d52"
base_ref="$(git merge-base HEAD origin/main)"
echo '== Verifier implementation: complete relevant range =='
sed -n '237,365p' backend/app/auth.py
echo '== Verifier tests: claim, error, PyJWK, and key-contract ranges =='
sed -n '240,500p' backend/tests/test_auth_security.py
sed -n '550,690p' backend/tests/test_auth_security.py
echo '== Exact source and test diffs =='
git diff --no-ext-diff --unified=100 "$base_ref"...HEAD -- \
backend/app/auth.py \
backend/tests/test_auth_security.py
echo '== Exact dependency and lock diffs =='
git diff --no-ext-diff --unified=30 "$base_ref"...HEAD -- \
backend/pyproject.toml \
backend/requirements.lock \
backend/requirements-dev.lock
echo '== PyJWT lock entries and transitive references =='
for f in backend/requirements.lock backend/requirements-dev.lock; do
echo "-- $f"
rg -n -A8 -B3 '^pyjwt==' "$f"
rg -n -C3 '^[[:alnum:]_.-]+==.*$|# via' "$f" | rg -i -C2 'pyjwt|python-jose|types-python-jose|ecdsa' || true
done
echo '== Documentation paths: tracked status and diff presence =='
for f in CHANGELOG.md docs/doctoring/jwt-verification-and-library-migration.md .jules/sentinel.md; do
printf '%s: ' "$f"
if git cat-file -e "HEAD:$f" 2>/dev/null; then
printf 'tracked at HEAD; '
git diff --quiet "$base_ref"...HEAD -- "$f" && echo 'unchanged' || echo 'changed'
else
echo 'not tracked at HEAD'
fi
done
echo '== Current exact-head GitHub checks =='
gh api "repos/ContextualWisdomLab/pg-erd-cloud/commits/${expected_sha}/check-runs?per_page=100" \
--jq '.check_runs | map({name,status,conclusion,details_url,completed_at})'
gh pr view 743 --repo ContextualWisdomLab/pg-erd-cloud \
--json headRefOid,reviewDecision,statusCheckRollup \
--jq '{headRefOid, reviewDecision, checks: [.statusCheckRollup[] | select(.name != null) | {name,status,conclusion,detailsUrl}]}'Length of output: 145070
Verified results:
The documentation evidence does not match the stated PR objective on this exact head:
The current-head gates are not complete. You are interacting with an AI system. |
Acknowledged. I have restored |
Acknowledged. The migration successfully uses PyJWT in a standards-aligned way with appropriate algorithm and issuer/audience boundaries, without |
I have executed the requested scope repair by resetting |
1 participant
Security objective
Remove the
python-jose[cryptography]dependency path that introduces the pure-Pythonecdsapackage affected by the Minerva P-256 timing side-channel advisory (CVE-2024-23342 / GHSA-wj6h-64fc-37mp / PYSEC-2026-1325, High). This is a bounded dependency and verifier migration; it does not rely on the inaccurate claim thatpython-josehas no maintainers.Implementation
python-jose[cryptography]withPyJWT[crypto]>=2.13.0;types-python-joseand the transitiveecdsalock entries;jwt.PyJWK(jwk).key;exp,iss,jti, and conditionallyaudwhen an OIDC audience is configured;jwt.PyJWTErrorwithout swallowing unrelated programming errors;Scope corrections
.jules/sentinel.mdentry in847aa133b75e30922013b1610a1447967a335574;mainin0aaaae0015d7b5893ea6e602184b602943878d52;Standards and evidence
docs/doctoring/jwt-verification-and-library-migration.mdrecords the security contract and APA 7 references for RFC 7519, RFC 8725, the July 2026rfc8725bisInternet-Draft being monitored, PyJWT 2.13.0, python-jose 3.5.0, and the relevant advisory.CHANGELOG.mdrecords the migration.Current-head merge contract
Current head:
0aaaae0015d7b5893ea6e602184b602943878d52.Before merge, the exact current head must prove:
python-jose,types-python-jose, andecdsaare absent from both hash locks;PyJWT[crypto]andcryptographyare hash-pinned;No release is proposed until the repository-wide release acceptance gates are satisfied.