Repository navigation
Conversation
…tor docs Coverage (H6): the old 75/70/75/75 global threshold was never met (actual ~17%) and CI hid it with continue-on-error. - jest: per-file thresholds hold the security core (ssrf, rate-limit, workflow-graph, urw) and the execute-workflow route near their current 90-100%; global is a ratchet floor at today's measured level - ci: single blocking `pnpm test:ci` step replaces test + non-blocking coverage - verified: dropping ssrf tests fails the ssrf threshold Docs (H5): CONTRIBUTING project structure / node-type steps / Node 22 now match the code (builder in app/builder, validation + codegen in @charliesu/workflow-core, security controls in lib/security); remove link to a private docs path; TESTING.md, testing-guide.md and ci.md show real coverage numbers and the enforced policy. eslint: ignore generated coverage/ and Playwright report dirs.
#28) ## Description H5 + H6: make coverage thresholds honest and blocking; refresh stale contributor docs. ## Type of Change - [x] Documentation update - [x] Security improvement (CI now enforces coverage on security-critical modules) ## Testing pnpm test:ci passes (538 tests). Dropping ssrf tests fails the ssrf threshold (enforcement verified). Lint 0 errors, type-check clean, build OK. ## Security Impact Regressions in SSRF / rate-limit / cycle-detection / URW / execute-route test coverage now fail CI. ## Details Coverage (H6): the old 75/70/75/75 global threshold was never met (actual ~17%) and CI hid it with continue-on-error. - jest: per-file thresholds hold the security core (ssrf, rate-limit, workflow-graph, urw) and the execute-workflow route near their current 90-100%; global is a ratchet floor at today's measured level - ci: single blocking `pnpm test:ci` step replaces test + non-blocking coverage - verified: dropping ssrf tests fails the ssrf threshold Docs (H5): CONTRIBUTING project structure / node-type steps / Node 22 now match the code (builder in app/builder, validation + codegen in @charliesu/workflow-core, security controls in lib/security); remove link to a private docs path; TESTING.md, testing-guide.md and ci.md show real coverage numbers and the enforced policy. eslint: ignore generated coverage/ and Playwright report dirs.
…hex form The WHATWG URL parser rewrites embedded IPv4 in IPv6 hosts to hex before the guard sees them: http://[::ffff:169.254.169.254]/ arrives as [::ffff:a9fe:a9fe]. isBlockedIpv6 only matched the dotted ::ffff:a.b.c.d form, so loopback / private / cloud-metadata targets written this way passed checkOutboundUrl — an SSRF bypass on the HTTP Request node. - ssrf.ts: decode hex-embedded IPv4 (::ffff:x:y mapped and deprecated ::x:y compatible) and re-apply the IPv4 block rules - tests: new cases go through checkOutboundUrl (the engine's call path), covering hex/expanded IPv6 forms plus decimal/octal/hex IPv4 hosts (already safe via parser normalization); red before, green after - tutorial 01: A5 note + post-release finding + parser-differential lab Found while pointing the builder validation panel at the same guard.
…ecks lib/security/validation-engine.ts powers the builder's Validation panel but had 0% coverage and its own copy of the SSRF/cycle rules, which had drifted from what the server enforces: - missed [::1], IPv4-mapped IPv6, CGNAT 100.64/10, 0/8, *.internal, *.local, and non-http schemes (file:, gopher: were only "insecure HTTP") -> panel reported "SSRF Prevention: passed" for targets the server blocks - substring matching flagged public hosts like notlocalhost.com Now checkSSRF delegates to checkOutboundUrl (lib/security/ssrf.ts) and cycle detection to detectWorkflowCycle (workflow-graph.ts), so the panel shows exactly what execution enforces. HTTP-not-HTTPS stays a warning; unparseable URLs stay a warning. - 46 tests (structure, SSRF parity incl. URL-normalized forms, PII count without echoing values, score bounds, API-key requirements) - coverage: 0% -> 100% lines / 94% branches; per-file threshold added - TESTING.md: updated numbers (603 tests, ~19% overall)
#29) ## Description Cover lib/security/validation-engine.ts (0% → 100% lines) and make its SSRF/cycle checks delegate to lib/security/ssrf.ts + workflow-graph.ts — the builder panel had drifted from what the server enforces (false "passed" on [::1], CGNAT, *.internal, file:; false positive on notlocalhost.com). ## Type of Change - [x] Security improvement ## Testing 46 new tests; per-file coverage threshold added. test:ci 603 tests pass; lint 0 errors; type-check clean; build OK. ## Security Impact Validation panel now shows exactly what execution enforces (single source of truth).
#30) …ecks lib/security/validation-engine.ts powers the builder's Validation panel but had 0% coverage and its own copy of the SSRF/cycle rules, which had drifted from what the server enforces: - missed [::1], IPv4-mapped IPv6, CGNAT 100.64/10, 0/8, *.internal, *.local, and non-http schemes (file:, gopher: were only "insecure HTTP") -> panel reported "SSRF Prevention: passed" for targets the server blocks - substring matching flagged public hosts like notlocalhost.com Now checkSSRF delegates to checkOutboundUrl (lib/security/ssrf.ts) and cycle detection to detectWorkflowCycle (workflow-graph.ts), so the panel shows exactly what execution enforces. HTTP-not-HTTPS stays a warning; unparseable URLs stay a warning. - 46 tests (structure, SSRF parity incl. URL-normalized forms, PII count without echoing values, score bounds, API-key requirements) - coverage: 0% -> 100% lines / 94% branches; per-file threshold added - TESTING.md: updated numbers (603 tests, ~19% overall)
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Promote dev → main.
parser's hex form, e.g. [::ffff:a9fe:a9fe] = cloud metadata (fix(security): block IPv4-mapped IPv6 SSRF targets in URL-normalized … #29)
Validation panel now uses the same SSRF/cycle rules the server enforces (test(security): cover validation-engine; delegate its SSRF + cycle ch… #30)
refreshed (chore(ci): enforce honest coverage thresholds; refresh stale contribu… #28)
Testing
Combined dev verified locally: type-check clean, lint 0 errors, test:ci 603 tests +
coverage thresholds, build OK.
Security Impact
Closes an SSRF bypass on the HTTP Request node. Residual: DNS rebinding (documented).