github-spec-kit/tests at 5601830ba38b0c8dec4fd2e6b40eb0335e287fee - github-spec-kit - 网新新思

github/github-spec-kit

mirror of https://github.com/github/spec-kit.git synced 2026-08-03 06:26:30 +08:00

Files

History

Pascal THUET 5601830ba3 harden: bound HTTP reads and enforce strict redirects (#3140 )

* harden: bound HTTP reads and enforce strict redirects

Add a shared _download_security module (read_response_limited,
is_https_or_localhost_http, size constants) and route the GitHub release
and Azure DevOps token network reads through bounded reads so an oversized
response can't exhaust memory.

Add a strict_redirects mode to authentication.open_url: the redirect handler
now rejects any redirect whose target isn't HTTPS (or HTTP to localhost),
composing with the existing per-hop redirect_validator and auth-stripping.
The Azure DevOps token POST is routed through that handler so a 307/308
cannot forward the client_secret body to a non-HTTPS host.

Assisted-by: Codex (model: GPT-5, autonomous)

* test: align HTTP fakes with bounded reads

Assisted-by: Codex (model: GPT-5, autonomous)

* fix: tolerate invalid token response encoding

Assisted-by: Codex (model: GPT-5, autonomous)

* test: align GHES fakes with bounded reads

Assisted-by: Codex (model: GPT-5, autonomous)

* test: reuse shared upgrade HTTP response helper

Assisted-by: Codex (model: GPT-5, autonomous)

* fix: include rejected redirect target in error

Assisted-by: Codex (model: GPT-5, autonomous)

* fix: enforce strict redirects by default

Assisted-by: Codex (model: GPT-5, autonomous)

* fix: close redirect credential and SSRF gaps

Assisted-by: Codex (model: GPT-5, autonomous)

2026-07-22 11:08:32 -05:00

..

fix(bundler): reject non-list 'catalogs' in bundle-catalogs.yml with a clean error (#3623 )

2026-07-22 08:49:20 -05:00

fix(scripts): git-ext PowerShell emits the '# To persist' SPECIFY_FEATURE hint (parity) (#3632 )

2026-07-22 09:00:23 -05:00

chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430 )

2026-07-10 11:47:36 -05:00

Add community bundle submission automation (#3553 )

2026-07-21 18:28:40 +01:00

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00

fix(bundler): guard lazy .hostname ValueError in catalog add_source (#3644 )

2026-07-22 08:21:02 -05:00

feat(workflows): WorkflowResolver standalone (PR 1) (#3557 )

2026-07-21 08:35:25 -05:00

__init__.py

Add modular extension system (#1551 )

2026-02-10 14:27:20 -06:00

auth_helpers.py

feat: Config-driven opt-in authentication registry with multi-platform support (#2393 )

2026-05-07 12:51:20 -05:00

bundler_helpers.py

feat: add specify bundle command (#3070 )

2026-06-19 17:07:20 -05:00

conftest.py

feat(cli): honor SPECIFY_INIT_DIR in the specify CLI project resolver (#3186 )

2026-07-01 15:55:18 -05:00

http_helpers.py

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00

parity_helpers.py

feat(scripts): port create-new-feature, setup-plan and setup-tasks to Python (#3386 )

2026-07-21 11:40:15 -05:00

self_upgrade_helpers.py

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00

test_agent_config_consistency.py

feat: add Factory Droid CLI integration (#822 ) (#3587 )

2026-07-22 07:49:48 -05:00

test_authentication.py

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00

test_branch_numbering.py

feat: make git extension opt-in and remove --no-git at v0.10.0 (#2873 )

2026-06-09 06:13:07 -05:00

test_check_prerequisites_paths_only.py

fix: fall back to feature dir basename for empty CURRENT_BRANCH (#3026 ) (#3229 )

2026-07-01 13:50:53 -05:00

test_check_prerequisites_python_parity.py

feat(scripts): port create-new-feature, setup-plan and setup-tasks to Python (#3386 )

2026-07-21 11:40:15 -05:00

test_check_tool.py

feat: add support for rovodev (#2539 )

2026-06-04 11:34:05 -05:00

test_cli_version.py

feat: add version feature reporting (#2548 )

2026-05-14 12:52:14 -05:00

test_command_template_py_scripts.py

feat(scripts): port create-new-feature, setup-plan and setup-tasks to Python (#3386 )

2026-07-21 11:40:15 -05:00

test_commands_package.py

feat(cli): add py script type & Python interpreter resolution (#3278 ) (#3285 )

2026-07-01 16:34:46 -05:00

test_console_imports.py

chore(tests): fix ruff lint violations in tests/ (#2827 )

2026-06-03 16:02:26 -05:00

test_create_new_feature_python_parity.py

feat(scripts): port create-new-feature, setup-plan and setup-tasks to Python (#3386 )

2026-07-21 11:40:15 -05:00

test_download_security.py

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00

test_extension_registration.py

chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430 )

2026-07-10 11:47:36 -05:00

test_extension_skills.py

feat: update Bob integration to skills-based layout for Bob 2.0 (#3415 )

2026-07-21 09:20:20 -05:00

test_extension_update_hardening.py

chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430 )

2026-07-10 11:47:36 -05:00

test_extensions.py

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00

test_github_http.py

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00

test_github_workflows.py

Add community bundle submission automation (#3553 )

2026-07-21 18:28:40 +01:00

test_init_dir_cli.py

feat(cli): honor SPECIFY_INIT_DIR in the specify CLI project resolver (#3186 )

2026-07-01 15:55:18 -05:00

test_init_dir.py

feat(scripts): add SPECIFY_INIT_DIR to target a member project from the repo root (#2892 )

2026-06-19 12:05:42 -05:00

test_live_transient_windows.py

fix: disable Rich Live transient mode on Windows to prevent PS 5.1 hang (#2938 )

2026-06-17 06:48:42 -05:00

test_merge.py

chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430 )

2026-07-10 11:47:36 -05:00

test_post_process.py

feat(integrations): generalize post-processing to all format types (#3311 )

2026-07-07 11:35:43 -05:00

test_presets.py

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00

test_ps1_encoding.py

fix: PS 5.1 compat — replace non-ASCII chars in shipped PowerShell scripts (#2709 )

2026-05-26 13:18:34 -05:00

test_registrar_path_traversal.py

Harden command registration path handling (#3088 )

2026-06-22 10:25:29 -05:00

test_security_workflow.py

ci: add dependency audit workflow (#3138 )

2026-07-22 05:20:55 -05:00

test_self_upgrade_detection.py

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00

test_self_upgrade_execution.py

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00

test_self_upgrade_guidance.py

feat(cli): implement specify self upgrade (#2475 )

2026-06-03 12:04:54 -05:00

test_self_upgrade_verification.py

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00

test_setup_plan_feature_json.py

fix(scripts): fall through to grep/sed when python3 is a broken stub in feature.json parser (#3312 )

2026-07-08 07:45:01 -05:00

test_setup_plan_no_overwrite.py

fix(scripts): route 'Plan template not found' per --json in setup-plan.ps1 (parity with bash) (#3241 )

2026-06-29 16:37:40 -05:00

test_setup_plan_python_parity.py

feat(scripts): port create-new-feature, setup-plan and setup-tasks to Python (#3386 )

2026-07-21 11:40:15 -05:00

test_setup_tasks_python_parity.py

feat(scripts): port create-new-feature, setup-plan and setup-tasks to Python (#3386 )

2026-07-21 11:40:15 -05:00

test_setup_tasks.py

chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430 )

2026-07-10 11:47:36 -05:00

test_shared_infra_integrity.py

feat(extensions): verify catalog archive sha256 before install (#3080 )

2026-06-24 14:52:24 -05:00

test_skill_placeholder_py.py

feat(scripts): port create-new-feature, setup-plan and setup-tasks to Python (#3386 )

2026-07-21 11:40:15 -05:00

test_timestamp_branches.py

chore: add pre-commit config and fix trailing whitespace/end-of-file (#3430 )

2026-07-10 11:47:36 -05:00

test_upgrade.py

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00

test_utils_assets_imports.py

feat: make git extension opt-in and remove --no-git at v0.10.0 (#2873 )

2026-06-09 06:13:07 -05:00

test_utils.py

harden: reject shell=True in run_command (#3132 )

2026-06-24 13:05:21 -05:00

test_version_imports.py

chore(tests): fix ruff lint violations in tests/ (#2827 )

2026-06-03 16:02:26 -05:00

test_workflow_run_without_project.py

fix(workflows): route run/resume errors to stderr under --json (#3352 )

2026-07-07 14:52:36 -05:00

test_workflows.py

harden: bound HTTP reads and enforce strict redirects (#3140 )

2026-07-22 11:08:32 -05:00