GeezerVison is showing github.com — fix(github): treat collaborator 404 as unauthorized for ignore · SocketDev/socket-python-cli@3a9cc7a
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: socketsecurity/core/scm/github.py +13Lines changed: 13 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
|
4 | 4 | from dataclasses import dataclass |
5 | 5 |
|
6 | 6 | from git import Optional |
| 7 | +from socketdev.exceptions import APIFailure |
7 | 8 |
|
8 | 9 | from socketsecurity import USER_AGENT |
9 | 10 | from socketsecurity.core import log |
@@ -273,6 +274,18 @@ def is_ignore_authorized(self, comment: Comment) -> bool: |
273 | 274 | permission = ( |
274 | 275 | result["permission"].casefold() in self.WRITE_PERMISSIONS |
275 | 276 | ) |
| 277 | + except APIFailure as error: |
| 278 | + # GitHub returns 404 when the user is not a collaborator (or |
| 279 | + # the caller cannot see the repo). Comments were already listed |
| 280 | + # with this token, so 404 is the outsider case, not missing |
| 281 | + # scope, and must not fail open under enforce. |
| 282 | + if error.status_code == 404: |
| 283 | + permission = False |
| 284 | + else: |
| 285 | + log.warning( |
| 286 | + f"Could not read GitHub repository permission for {author}: {error}" |
| 287 | + ) |
| 288 | + permission = None |
276 | 289 | except Exception as error: |
277 | 290 | log.warning( |
278 | 291 | f"Could not read GitHub repository permission for {author}: {error}" |
|
Collapse file
Copy file name to clipboardExpand all lines: tests/unit/test_ignore_authorization.py +12Lines changed: 12 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
|
8 | 8 | from types import SimpleNamespace |
9 | 9 |
|
10 | 10 | import pytest |
| 11 | +from socketdev.exceptions import APIFailure |
11 | 12 |
|
12 | 13 | from socketsecurity.core.classes import Comment |
13 | 14 | from socketsecurity.core.scm.github import Github |
@@ -81,6 +82,17 @@ def test_github_unreadable_permission_honors_the_command_with_a_warning(caplog): |
81 | 82 | assert "without verifying write access" in caplog.text |
82 | 83 |
|
83 | 84 |
|
| 85 | +def test_github_404_means_the_commenter_is_not_a_collaborator(): |
| 86 | + """GitHub returns 404 when the user is not a collaborator. That is the |
| 87 | + drive-by case this gate exists to block, not an undetermined lookup.""" |
| 88 | + github = _github( |
| 89 | + raises=APIFailure("Request failed: 404 Client Error", status_code=404) |
| 90 | + ) |
| 91 | + comment = _comment(user={"login": "outsider"}, author_association="NONE") |
| 92 | + |
| 93 | + assert github.is_ignore_authorized(comment) is False |
| 94 | + |
| 95 | + |
84 | 96 | def test_github_strict_rejects_when_permission_cannot_be_read(caplog): |
85 | 97 | github = _github(raises=Exception("403 Forbidden"), policy="strict") |
86 | 98 |
|
|