🛡️ Sentinel: [CRITICAL] Fix incomplete DSN secret redaction and over-redaction - #745
🛡️ Sentinel: [CRITICAL] Fix incomplete DSN secret redaction and over-redaction#745seonghobae wants to merge 12 commits into
Conversation
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Warning Review limit reached
Next review available in: 25 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Comment |
|
@opencode-agent @cwl-noema-review @coderabbitai Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
requested_head="7832d5bc3a2fb61b8ee7fd677f208defe6a82dfc"
echo "== Checked-out head =="
git rev-parse HEAD
echo "== Requested commit exists =="
git cat-file -t "$requested_head"
echo "== Files changed by requested head =="
git diff-tree --no-commit-id --name-status -r "$requested_head"
echo "== Diff stat =="
git show --stat --oneline --decorate --no-renames "$requested_head"
echo "== Candidate Python source/test/document outlines =="
fd -t f -e py . | while IFS= read -r file; do
if rg -q -i 'dsn|redact|secret|sanitize|urllib\.parse' "$file"; then
echo "--- $file"
ast-grep outline "$file" --items all --type function,class 2>/dev/null || true
fi
done
echo "== Changed-file patch =="
git show --format= --no-ext-diff --unified=80 "$requested_head" -- \
':!CHANGELOG.md' ':!*.md'
echo "== Changed documentation =="
git show --format= --no-ext-diff --unified=40 "$requested_head" -- '*.md' CHANGELOG.md
echo "== GitHub PR metadata, checks, and reviews =="
gh pr view 745 --repo ContextualWisdomLab/pg-erd-cloud \
--json number,headRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviews,comments
echo "== GitHub review threads (unresolved only) =="
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='pg-erd-cloud' \
-F number=745 \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) { nodes { author { login } body } }
}
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 49972 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="72afe6db712b145baaba084f64a1ff4fb36d9fd0"
head="7832d5bc3a2fb61b8ee7fd677f208defe6a82dfc"
echo "== Full PR-range changed files =="
git diff --name-status "$base" "$head"
echo "== Full PR-range diff stat =="
git diff --stat "$base" "$head"
echo "== Full PR-range patch =="
git diff --no-ext-diff --unified=100 "$base" "$head"
echo "== backend/app/dsn_redaction.py at exact head =="
cat -n backend/app/dsn_redaction.py
echo "== backend/tests/test_dsn_redaction.py at exact head =="
cat -n backend/tests/test_dsn_redaction.py
echo "== docs/doctoring/dsn_secret_redaction.md at exact head =="
cat -n docs/doctoring/dsn_secret_redaction.md
echo "== CHANGELOG.md DSN entry at exact head =="
rg -n -C2 'DSN.*redaction|비밀정보' CHANGELOG.md
echo "== Call sites of redact_dsn_error_message =="
ast-grep run --pattern 'redact_dsn_error_message($MSG, $DSN)' --lang python backend
echo "== Final assignment sanitizer patterns =="
rg -n -P '(?i)(password|secret|token)\s*[=:]' backend/app/dsn_redaction.py backend/tests/test_dsn_redaction.pyLength of output: 29785 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Error-boundary integration =="
sed -n '1,115p' backend/app/db_introspect.py
echo "== Existing DSN redaction integration tests =="
sed -n '1,125p' backend/tests/test_snapshot_job.py
sed -n '120,180p' backend/tests/test_db_introspect.py
echo "== Form-plus and Unicode-boundary test evidence across backend tests =="
rg -n -C3 -P '(?:\?[^"\s]*[A-Za-z0-9_]*(?:token|secret|password)[A-Za-z0-9_]*=[^"\s]*\+|unquote_plus|café|\\w)' \
backend/tests backend/app/dsn_redaction.py
echo "== PR commits in reviewed range =="
git log --format='%H %s' "${base:-72afe6db712b145baaba084f64a1ff4fb36d9fd0}..7832d5bc3a2fb61b8ee7fd677f208defe6a82dfc"
echo "== Working tree state =="
git status --shortLength of output: 12835
I found one remaining test-coverage issue. P2 — Add a form-query The remaining requested checks pass by inspection:
CodeRabbit status is still pending. GitHub reports You are interacting with an AI system. |
|
@opencode-agent Please review exact current head |
|
@cwl-noema-review Please independently review exact current head |
|
@opencode-agent review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/pg-erd-cloud"
pr_number="745"
head="ed2a216f3a7390442bb49efa441bd99510842e60"
echo "== Exact head =="
git rev-parse HEAD
git cat-file -t "$head"
echo "== Protected main and PR range =="
base="$(git merge-base origin/main "$head")"
printf 'base=%s\nhead=%s\n' "$base" "$head"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo "== Changed-file patch =="
git diff --no-ext-diff --unified=100 "$base" "$head"
echo "== Relevant Python outlines =="
for file in backend/app/dsn_redaction.py backend/tests/test_dsn_redaction.py; do
if [ -f "$file" ]; then
echo "--- $file"
ast-grep outline "$file" --items all --type function,class
fi
done
echo "== Redaction implementation =="
if [ -f backend/app/dsn_redaction.py ]; then
cat -n backend/app/dsn_redaction.py
fi
echo "== Redaction tests =="
if [ -f backend/tests/test_dsn_redaction.py ]; then
cat -n backend/tests/test_dsn_redaction.py
fi
echo "== Doctoring =="
if [ -f docs/doctoring/dsn_secret_redaction.md ]; then
cat -n docs/doctoring/dsn_secret_redaction.md
fi
echo "== Integration call sites =="
ast-grep run --pattern 'redact_dsn_error_message($MSG, $DSN)' --lang python backend || true
echo "== PR state, reviews, and checks =="
gh pr view "$pr_number" --repo "$repo" \
--json headRefOid,baseRefName,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
echo "== Unresolved review threads =="
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='pg-erd-cloud' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) { nodes { author { login } body } }
}
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 44747
I found one blocking scope and documentation issue. P2 — Remove The implementation checks pass by inspection:
I cannot submit You are interacting with an AI system. |
|
Exact-head independent review requested for |
|
@opencode-agent review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/pg-erd-cloud"
pr_number="745"
head="74a8b57ca3fb45e375c35bcc442b5565a677b898"
echo "== Exact commit =="
git rev-parse HEAD
git cat-file -t "$head"
echo "== PR head and protected base =="
gh pr view "$pr_number" --repo "$repo" \
--json headRefOid,baseRefName,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
base="$(git merge-base origin/main "$head")"
printf 'base=%s\nhead=%s\n' "$base" "$head"
echo "== PR scope against main =="
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo "== Sentinel delta check =="
git diff --name-status "$base" "$head" -- .jules/sentinel.md
git diff --quiet "$base" "$head" -- .jules/sentinel.md && echo "No .jules/sentinel.md delta"
echo "== Changed source and test outlines =="
for file in backend/app/dsn_redaction.py backend/tests/test_dsn_redaction.py; do
echo "--- $file"
ast-grep outline "$file" --items all --type function,class
done
echo "== Production implementation =="
cat -n backend/app/dsn_redaction.py
echo "== Unit tests =="
cat -n backend/tests/test_dsn_redaction.py
echo "== Doctoring =="
cat -n docs/doctoring/dsn_secret_redaction.md
echo "== Changelog DSN entry =="
rg -n -C3 -i 'dsn|redaction|secret' CHANGELOG.md
echo "== Integration call sites =="
ast-grep run --pattern 'redact_dsn_error_message($MSG, $DSN)' --lang python backend || true
echo "== API, database, dependency, and workflow delta =="
git diff --name-only "$base" "$head" | rg -n '(?i)(openapi|api|schema|migration|database|package(-lock)?\.json|requirements.*\.txt|poetry\.lock|pyproject\.toml|\.github/workflows|workflow|credential|secret)' || true
echo "== Unresolved review threads =="
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='pg-erd-cloud' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) { nodes { author { login } body } }
}
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 21940 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/pg-erd-cloud"
pr_number="745"
head="74a8b57ca3fb45e375c35bcc442b5565a677b898"
base="$(git merge-base origin/main "$head")"
echo "== Exact commit and documentation =="
git rev-parse HEAD
cat -n docs/doctoring/dsn-secret-redaction.md
echo "== Documentation references =="
rg -n -C2 '(?i)(urllib|unquote|unquote_plus|OWASP|References|APA|Python)' \
docs/doctoring/dsn-secret-redaction.md
echo "== Changelog exact delta =="
git diff --no-ext-diff --unified=20 "$base" "$head" -- CHANGELOG.md
echo "== Redaction integration call sites =="
ast-grep run --pattern 'redact_dsn_error_message($MSG, $DSN)' --lang python backend || true
echo "== Integration contexts =="
rg -n -C4 '\bredact_dsn_error_message\s*\(' backend --glob '*.py'
echo "== Contract-sensitive changed paths =="
git diff --name-only "$base" "$head" | rg -n \
'(?i)(^\.github/workflows/|(^|/)(openapi|swagger)|migration|alembic|schema|database|package(-lock)?\.json$|requirements.*\.txt$|poetry\.lock$|pyproject\.toml$|credential)' \
|| true
echo "== Fresh exact-head PR checks and approval state =="
gh pr view "$pr_number" --repo "$repo" \
--json headRefOid,baseRefName,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
echo "== Unresolved review threads =="
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='pg-erd-cloud' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) { nodes { author { login } body } }
}
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 34112
Static inspection found no blocking code or scope issue.
I cannot submit GitHub currently reports Re-request approval after all required checks complete successfully on this same SHA. You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review Please perform a fresh security and correctness review of exact head |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/pg-erd-cloud"
pr_number="745"
head="05c683d89d76b0729d47739cb3bb1f073f984fb5"
echo "== Exact checked-out commit =="
git rev-parse HEAD
echo "== Requested commit object =="
git cat-file -t "$head"
echo "== PR metadata and current exact-head checks =="
gh pr view "$pr_number" --repo "$repo" \
--json headRefOid,baseRefName,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
echo "== Base and changed files against protected main =="
base="$(git merge-base origin/main "$head")"
printf 'base=%s\nhead=%s\n' "$base" "$head"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo "== Complete main-to-head patch =="
git diff --no-ext-diff --unified=100 "$base" "$head"
echo "== Relevant Python structure =="
for file in backend/app/dsn_redaction.py backend/tests/test_dsn_redaction.py; do
if [ -f "$file" ]; then
printf '\n--- %s\n' "$file"
ast-grep outline "$file" --items all --type function,class
fi
done
echo "== DSN redaction implementation =="
cat -n backend/app/dsn_redaction.py
echo "== DSN redaction tests =="
cat -n backend/tests/test_dsn_redaction.py
echo "== Doctoring documentation candidates =="
fd -t f -i '*dsn*redaction*.md' docs 2>/dev/null | sort | while IFS= read -r file; do
printf '\n--- %s\n' "$file"
cat -n "$file"
done
echo "== Redaction call sites =="
ast-grep run --pattern 'redact_dsn_error_message($MSG, $DSN)' --lang python backend || true
echo "== Contract-sensitive changes =="
git diff --name-only "$base" "$head" | rg -n \
'(?i)(^\.github/workflows/|(^|/)(openapi|swagger)|migration|alembic|schema|database|package(-lock)?\.json$|requirements.*\.txt$|poetry\.lock$|pyproject\.toml$|credential)' \
|| true
echo "== Unresolved review threads =="
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='pg-erd-cloud' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) { nodes { author { login } body } }
}
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)]'Length of output: 28824
I found three blocking findings.
The exact-head check runs show success for CI, Security Scan components, Semgrep, CodeQL, Strix, and CodeRabbit. GitHub still reports I cannot approve this head until the findings are fixed and the required current-head review state succeeds. You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review Please perform a fresh independent review of current head |
1 participant
Security objective
Prevent database-driver error messages from disclosing DSN-derived passwords, tokens, and equivalent secret assignments without corrupting unrelated text through over-redaction.
Implemented fix
urllib.parse.unquote, so a literal+remains a plus;urllib.parse.unquote_plus, so form-encoded plus signs retain their space semantics;(?<!\w)…(?!\w);urllib.parsecontract and OWASP logging guidance;.jules/sentinel.mdaddition so the PR is limited to the authoritative product, tests, changelog, and doctoring scope;CHANGELOG.mdwithout changing API, database, dependency, or workflow contracts.Exact-head validation
Current exact head:
05c683d89d76b0729d47739cb3bb1f073f984fb5.Successful exact-head gates:
No predecessor-head, queued, pending, cancelled, skipped-required, or absent result is treated as passing. Merge remains prohibited until fresh current-head automated review, a qualifying independent non-author approval, and every repository and branch-protection gate are satisfied.