fix(review): low-severity findings bundle - #19
Open
MarkAtwood wants to merge 2 commits into
Open
Conversation
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Batch of low-severity review findings: - gen-sbom: write CycloneDX/SPDX atomically (temp + os.replace) so a crash/ENOSPC mid-write cannot leave a truncated document; special files (/dev/null) still write directly. - gen-sbom: dedup --srcs on realpath, so foo.c and ./foo.c collapse instead of tripping the merkle duplicate-basename guard. - validate_sbom.py: catch OSError (not just FileNotFoundError) and reject non-dict top-level JSON, instead of an unhandled traceback. - compdb frontend: honour -U (a later undefine cancels an earlier -D), and, when --root is given, skip sources resolving outside it (a compile_commands.json is untrusted input). - sbom.cmake: a second wolfglass_add_sbom() call gets a name-qualified target instead of colliding on the hardcoded "sbom" target. - sbom-driver: scrub Windows absolute paths (C:\...) too, not only Unix; return "" for an empty --version-macro rather than matching the first quoted string in the header. - selftest.yml: declare permissions: contents: read (least privilege). Adds tests/test_low_findings.py. Deliberately skipped: SHA-pinning of GitHub-owned actions (repo does not require it), a backslash-continued #define in parse_options_h (single-line in practice; upstream flagged it awareness-only), and a merkle known-answer vector (no external oracle exists; order/content/basename property tests already cover it).
There was a problem hiding this comment.
Pull request overview
This PR bundles a set of low-severity hardening fixes across SBOM generation/validation, the compilation-database frontend, and CI, with a new regression test suite (tests/test_low_findings.py) and workflow wiring to ensure these cases stay covered.
Changes:
- Make
gen-sbomwrite CycloneDX/SPDX outputs atomically and deduplicate--srcsonrealpath. - Harden
validate_sbom.pyerror handling and reject non-object top-level JSON. - Improve path/macro handling across
sbom-driver.py,compdb_sbom.py, and CMake SBOM target naming; wire new regression tests into CI.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
tests/test_low_findings.py |
Adds regression tests covering the bundled low-severity findings. |
share/validate_sbom.py |
Improves robustness: broader read-error handling and top-level JSON type validation. |
share/sbom-driver.py |
Enhances absolute-path scrubbing and guards version-macro extraction. |
share/gen-sbom |
Adds atomic JSON writing and realpath-based --srcs dedup; uses atomic writer for outputs. |
share/frontends/compdb_sbom.py |
Honors -U undefines and restricts sources to --root when provided. |
share/build/sbom.cmake |
Avoids target-name collision on multiple wolfglass_add_sbom() calls. |
.github/workflows/selftest.yml |
Restricts workflow permissions and runs the new low-findings test suite. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+10
to
+22
| from importlib.machinery import SourceFileLoader | ||
|
|
||
| REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) | ||
| SHARE = os.path.join(REPO, "share") | ||
| GEN_SBOM = os.path.join(SHARE, "gen-sbom") | ||
| VALIDATE = os.path.join(SHARE, "validate_sbom.py") | ||
|
|
||
| gs = SourceFileLoader("gen_sbom", GEN_SBOM).load_module() | ||
| drv = SourceFileLoader("sbom_driver", os.path.join(SHARE, "sbom-driver.py") | ||
| ).load_module() | ||
| compdb = SourceFileLoader( | ||
| "compdb_sbom", os.path.join(SHARE, "frontends", "compdb_sbom.py") | ||
| ).load_module() |
Comment on lines
+130
to
+135
| if root_abs: | ||
| real = os.path.realpath(fpath) | ||
| if real != root_abs and not real.startswith(root_abs + os.sep): | ||
| sys.stderr.write( | ||
| f"WARNING: skipping source outside --root: {fpath}\n") | ||
| continue |
Comment on lines
+146
to
+149
| set(_sbom_target sbom) | ||
| if(TARGET sbom) | ||
| set(_sbom_target sbom-${SB_NAME}) | ||
| endif() |
Comment on lines
+44
to
+47
| # Absolute path at the start of a token: a Unix path (/home/...) or a Windows | ||
| # drive path (C:\Users\... or C:/Users/...). Redacted so a host path never | ||
| # leaks into the SBOM regardless of the build host OS. | ||
| _ABS_PATH = re.compile(r'^([A-Za-z]:[\\/]|/)[^ ]*') |
Comment on lines
+112
to
+118
| tmp = f'{path}.tmp' | ||
| try: | ||
| with open(tmp, 'w') as f: | ||
| json.dump(obj, f, indent=2) | ||
| f.write('\n') | ||
| os.replace(tmp, path) | ||
| except OSError: |
sameehj
force-pushed
the
master
branch
4 times, most recently
from
July 24, 2026 14:09
3ab77f9 to
9bdf5b7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Batch of low-severity review findings (SBOM-gpex.20). Each has a regression test in
tests/test_low_findings.py(8 tests).os.replace) so a crash/ENOSPC can't leave a truncated document; special files (/dev/null) still write directly. Dedup--srcson realpath, sofoo.cand./foo.ccollapse instead of tripping the merkle duplicate-basename guard.OSError(not justFileNotFoundError) and reject non-dict top-level JSON, instead of an unhandled traceback.-U(a later undefine cancels an earlier-D); when--rootis given, skip sources resolving outside it (compile_commands.json is untrusted input).wolfglass_add_sbom()call gets a name-qualified target instead of colliding on the hardcodedsbomtarget.C:\...) too; return""for an empty--version-macrorather than matching the first quoted string.permissions: contents: read.Deliberately skipped (documented in the commit): SHA-pinning GitHub-owned actions (repo doesn't require it), a backslash-continued
#define(single-line in practice; upstream flagged it awareness-only), the grep exit-2 case (already fixed in #5), and a merkle known-answer vector (no genuinely external oracle; existing order/content/basename property tests cover it).Overlaps other open PRs only in different regions:
gen-sbom(#15/#17),sbom.cmake(#17),sbom-driver.py(#12),selftest.yml(several).