 Jason WoltjeandClaude Sonnet 4.5
|
5d683d401e
|
fix(#121): Remediate security issues from ORCH-121 review
Priority Fixes (Required Before Production):
H3: Add rate limiting to webhook endpoint
- Added slowapi library for FastAPI rate limiting
- Implemented per-IP rate limiting (100 req/min) on webhook endpoint
- Added global rate limiting support via slowapi
M4: Add subprocess timeouts to all gates
- Added timeout=300 (5 minutes) to all subprocess.run() calls in gates
- Implemented proper TimeoutExpired exception handling
- Removed dead CalledProcessError handlers (check=False makes them unreachable)
M2: Add input validation on QualityCheckRequest
- Validate files array size (max 1000 files)
- Validate file paths (no path traversal, no null bytes, no absolute paths)
- Validate diff summary size (max 10KB)
- Validate taskId and agentId format (non-empty)
Additional Fixes:
H1: Fix coverage.json path resolution
- Use absolute paths resolved from project root
- Validate path is within project boundaries (prevent path traversal)
Code Review Cleanup:
- Moved imports to module level in quality_orchestrator.py
- Refactored mock detection logic into separate helper methods
- Removed dead subprocess.CalledProcessError exception handlers from all gates
Testing:
- Added comprehensive tests for all security fixes
- All 339 coordinator tests pass
- All 447 orchestrator tests pass
- Followed TDD principles (RED-GREEN-REFACTOR)
Security Impact:
- Prevents webhook DoS attacks via rate limiting
- Prevents hung processes via subprocess timeouts
- Prevents path traversal attacks via input validation
- Prevents malformed input attacks via comprehensive validation
Co-Authored-By: Claude Sonnet 4.5 <[email protected]>
|
2026-02-04 11:50:05 -06:00 |
|
 jason.woltjeandClaude Sonnet 4.5
|
f45dbac7b4
|
feat(#147): Implement core quality gates (TDD - GREEN phase)
Implement four quality gates enforcing non-negotiable quality standards:
1. BuildGate: Runs mypy type checking
- Detects compilation/type errors
- Uses strict mode from pyproject.toml
- Returns GateResult with pass/fail status
2. LintGate: Runs ruff linting
- Treats warnings as failures (non-negotiable)
- Checks code style and quality
- Enforces rules from pyproject.toml
3. TestGate: Runs pytest tests
- Requires 100% test pass rate (non-negotiable)
- Runs without coverage (separate gate)
- Detects test failures and missing tests
4. CoverageGate: Measures test coverage
- Enforces 85% minimum coverage (non-negotiable)
- Extracts coverage from JSON and output
- Handles edge cases gracefully
All gates implement QualityGate protocol with check() method.
All gates return GateResult with passed/message/details.
All implementations achieve 100% test coverage.
Files created:
- src/gates/quality_gate.py: Protocol and result model
- src/gates/build_gate.py: Type checking enforcement
- src/gates/lint_gate.py: Linting enforcement
- src/gates/test_gate.py: Test execution enforcement
- src/gates/coverage_gate.py: Coverage enforcement
- src/gates/__init__.py: Module exports
Related to #147
Co-Authored-By: Claude Sonnet 4.5 <[email protected]>
|
2026-02-01 18:25:16 -06:00 |
|