mixandClaude Opus 5.5
32f6ed626d
The review of 4433688..0808779 (read-only, a separate agent) found one medium and some lows; all fixed here. Medium, proven by the reviewer: A1's userKey put the typed username into the limiter map whole, and the public forms had no body bound beyond net/http's 10 MiB for a parsed form - each refused request kept up to 10 MiB in memory for fifteen minutes. userKey now holds a 96-bit hash of the folded name, and sign-in, reset, a reset link's page and setup read at most 64 KiB (limitForm, http.MaxBytesReader). TestPublicFormsAreBoundedAndKeysShort. Lows: - Refund skipped the request that filled a bucket (count < max), so a right password at the ceiling left the shared address blocked; Refund now always undoes the Allow it follows. - The reset form did not give the address its attempt back when the name's bucket refused (sign-in did); it does. - A3's day of five links is spent only by a link that goes out, and the price of the pause - anyone knowing a username can pause that owner's reset for a day - is recorded in security.md. - longHeaderLine counted a trailing CR on a header's first line. - test.yml declares permissions: contents: read. Not changed, as the review's nits: the store matches names exactly while the limiter folds them (stricter, said in the comment now); a session from a longer window is honoured until its next Touch (the next request). go test ./internal/web/auth ./internal/milter. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
76 lines
2.5 KiB
YAML
76 lines
2.5 KiB
YAML
name: test
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
# The job reads the repository and nothing else (security audit 2026-10-17,
|
|
# review of stages 2-6).
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
# design-first.sh reads each commit's parent and the template history.
|
|
fetch-depth: 0
|
|
|
|
- name: Design first
|
|
env:
|
|
BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
|
|
HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
run: bash .github/scripts/design-first.sh "$BASE" "$HEAD"
|
|
|
|
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
|
|
with:
|
|
go-version: "1.26"
|
|
cache: true
|
|
cache-dependency-path: |
|
|
go.sum
|
|
test/e2e/go.sum
|
|
|
|
- name: Format
|
|
run: |
|
|
fmt="$(gofmt -l .)"
|
|
if [ -n "$fmt" ]; then
|
|
echo "$fmt"
|
|
echo "gofmt needed on the files above; run 'gofmt -w .'"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Vet
|
|
run: go vet ./...
|
|
|
|
# Unused code, dead branches and the usual slips go vet does not look
|
|
# for. The version is pinned: a new release adds checks, and a check
|
|
# that appears under a push is a red build nobody asked for. 2026.1 is
|
|
# the release for Go 1.26. test/e2e is a module of its own, so ./...
|
|
# skips it; it is checked in its own step below.
|
|
- name: Staticcheck
|
|
run: go run honnef.co/go/tools/cmd/staticcheck@2026.1 ./...
|
|
|
|
- name: Test
|
|
run: go test ./...
|
|
|
|
# Known vulnerabilities in the module's dependencies and in the
|
|
# standard library of this Go, reached from SelfPost's code (security
|
|
# audit 2026-10-17, I4: twelve stdlib advisories went unnoticed until
|
|
# the base image's tag happened to move). Pinned like staticcheck.
|
|
- name: Vulnerabilities
|
|
run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
|
|
|
|
# The e2e module runs only in release.yml, after a release is published;
|
|
# a type error there would first show up then. Compile it here without
|
|
# running it: `go test -run` would still run TestMain, which brings up
|
|
# the whole stand.
|
|
- name: Compile the e2e
|
|
working-directory: test/e2e
|
|
run: |
|
|
go vet ./...
|
|
go test -c -o /dev/null .
|
|
go run honnef.co/go/tools/cmd/staticcheck@2026.1 ./...
|