-
fix(security): close clear-text secret gap in env_sync and clear codeql noise (#2256)
frostbyte_neo 发布于
2026-05-20 01:13:25 +00:00 | 1887 次提交 在此版本后已推送到 mainResolves all eight open code-scanning alerts on main.
-
#1019 (high, py/clear-text-storage-sensitive-data): tighten
_is_sensitive_env_key to use underscore-terminal-component matching
instead of suffix matching. Previously bare PASSWORD=foo, TOKEN=foo,
SECRET=foo, and KEY=foo lines slipped past the filter and were
written to plain-text .env. Standalone sensitive names are now caught
while legitimate keys like OPENAI_TOKEN_LIMIT (terminal "limit") and
OPENAI_REASONING_MODEL stay non-sensitive. The DISCORD_PUBLIC_KEY
exception is preserved. Drops the dead # codeql[...] suppression
comment that was not being recognized. -
#1027-#1032 (6x py/ineffectual-statement): drop the redundant
...
bodies after docstrings in tests/benchmarks/_framework/adapters.py
abstract methods. The docstring alone is a valid empty body. -
#1033 (py/unreachable-statement): isolate the raise in
test_activate_restores_env_when_body_raises into a nested helper so
the post-with-pytest.raises assertion is clearly reachable (CodeQL
does not model pytest.raises as exception-suppressing).
Verification: ruff check, ruff format --check, mypy clean on all four
touched files. tests/cli/wizard/ (250 tests) and the affected benchmark
tests (41 tests) pass locally.Co-authored-by: Cursor cursoragent@cursor.com
下载附件
-