SDK modernization - #135
Draft
skupriienko wants to merge 35 commits into
Draft
Conversation
…rs, and OWASP security guardrails
… Atheris fuzzing suite
…drails
- Delegate authentication validation and coercion from Client to SecurityGuard (CWE-113, CWE-316).
- Implement strict ingress checks to block empty strings, CRLF/control characters, and invalid Unicode whitespace in credentials.
- Expand property-based test examples ('@example') and add a dedicated unit test suite for auth validation.
- Append discovered token to the fuzzer dictionary.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
…ring sanitization' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…ypes This commit addresses the remaining linter warnings, structural complexities, and missing static typing annotations. Specific changes: - style: Replaced custom '# ruff: ignore' pragmas with standard '# noqa' codes (A004, C901, ARG001, BLE001, RUF027) across all core files. - refactor(endpoint): Extracted registry and dynamic routing logic from '_build_url' into separate '_resolve_registry_route' and '_resolve_dynamic_route' methods to eliminate C901/PLR0915 complexity errors. - docs: Restored comprehensive 'Args:' and 'Returns:' docstring blocks for Client and Endpoint methods to satisfy DOC201. - typing: Restored 'PayloadType' and 'TimeoutType' type hints in endpoint method signatures. - fix(client): Wrapped '__dir__' return in 'sorted(set(...))' to ensure uniqueness and stable ordering of dynamically exposed attributes. - test(fuzz): Appended newly discovered optimal token to the Atheris fuzzer dictionary.
…rage - Safely unpack and validate both bounds of tuple timeouts through SecurityGuard (CWE-400 mitigation). - Add exhaustive live integration tests covering MessageBuilder, TemplateContentBuilder, endpoint streaming pagination, and custom configuration parameters.
- Pin all mutable Action tags ('v7', 'v4', etc.) to 40-character cryptographic SHAs to prevent supply-chain hijacking (fixes Semgrep/Zizmor warnings).
- Add OpenSSF Scorecard workflow ('scorecard.yml') for continuous repository security analysis.
- Integrate 'zizmor' into commit checks to continuously validate GitHub Actions configuration security.
- Add 'osv-scanner' job to the security workflow for lockfile vulnerability analysis.
- Optimize test execution in 'commit_checks.yaml' using '[test]' extras and Codecov integration.
- Add ClusterFuzzLite workflows.
- Fix CWE-113: Prevent HTTP Request Smuggling by sanitizing headers in client.api_call - Fix CWE-1333: Eliminate catastrophic backtracking (ReDoS) in secret extraction regex - Fix CWE-316: Block index and iteration credential extraction on SecretAuth class - Fix CWE-843: Safely cast timeout to float in validate_timeout to prevent TypeErrors - Fix fuzzer dictionary syntax: URL encode control chars and hardcode multiplication strings - ci: Explicitly test package imports and install testing dependencies in commit checks
…inter rules - Corrected Config timeout assignment from class-level to instance-level (self.timeout) to preserve thread-safety and session isolation. - Updated Makefile with a standard .PHONY 'all' target and removed duplicate 'format' definitions to satisfy checkmake. - Modernized Ruff rule ignore selectors in pyproject.toml from legacy rule codes to human-readable names. - Adjusted .pre-commit-config.yaml hooks for clean local and CI execution.
- Removed redundant # type: ignore comments in endpoint.py and guardrails.py to pass mypy strict checks. - Fixed ruff linter configuration in pyproject.toml by replacing the unknown 'unused-import' rule selector with the correct 'F401' rule code. - Cleaned up security.yml workflow parameters.
…orrectly blocked with a ValueError
| assert not math.isnan(config.timeout) | ||
| assert not math.isinf(config.timeout) | ||
| assert config.timeout > 0 | ||
| except (ValueError, TypeError): |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.