fix(security): validate client trace identifiers - #352
Conversation
|
Important Review available on request
Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthrough
ChangesTrace ID 검증
Estimated code review effort: 2 (Simple) | ~10 minutes Mergeability Score: ⚪ Minimal · up to This localized change bounds client trace identifiers and falls back to the server request ID for invalid values; no actionable merge-blocking risk remains after normal checks and independent review. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@src/test/java/com/clearfolio/viewer/controller/ApiExceptionHandlerTraceIdValidationTest.java`:
- Around line 20-68: Extend ApiExceptionHandlerTraceIdValidationTest with a case
where both the X-Trace-Id header and the exchange request ID are unsafe, then
assert that handleBadRequest returns a UUID.randomUUID()-style trace ID rather
than either input. Configure the exchange or request-ID source to provide the
unsafe server request ID and verify the fallback branch is exercised.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 0c147ae0-8fc6-4b18-90e5-a23f535a582e
📒 Files selected for processing (2)
src/main/java/com/clearfolio/viewer/controller/ApiExceptionHandler.javasrc/test/java/com/clearfolio/viewer/controller/ApiExceptionHandlerTraceIdValidationTest.java
|
@opencode-agent review Review exact head Review read-only; preserve independent reviewer identity. Do not mutate the branch, synthesize author approval, weaken protection, or merge. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='eb0a32e87e7470469c8fa0f8c67d9583654bef57'
head='82e566d511289f3bc83e4bf77c1dcc2b3ad16bc4'
printf '%s\n' '== Commit identities =='
git show -s --format='%H%n%P%n%s' "$base"
git show -s --format='%H%n%P%n%s' "$head"
printf '%s\n' '== Exact commit-range diff (name-status) =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Exact commit-range diff =='
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
src/main/java/com/clearfolio/viewer/controller/ApiExceptionHandler.java \
src/test/java/com/clearfolio/viewer/controller/ApiExceptionHandlerTraceIdValidationTest.java
printf '%s\n' '== Source outline =='
ast-grep outline src/main/java/com/clearfolio/viewer/controller/ApiExceptionHandler.java --items all
printf '%s\n' '== Test outline =='
ast-grep outline src/test/java/com/clearfolio/viewer/controller/ApiExceptionHandlerTraceIdValidationTest.java --items all
printf '%s\n' '== Trace-ID selection call sites and related tests =='
rg -n -C 5 --glob '*.java' \
'X-Trace-Id|TRACE_ID|traceId|request\.getRequestId\(\)|UUID\.randomUUID\(\)' \
src/main/java src/test/javaLength of output: 201667 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='eb0a32e87e7470469c8fa0f8c67d9583654bef57'
head='82e566d511289f3bc83e4bf77c1dcc2b3ad16bc4'
printf '%s\n' '== Commit identities =='
git show -s --format='base: %H%nparents: %P%nsubject: %s' "$base"
git show -s --format='head: %H%nparents: %P%nsubject: %s' "$head"
printf '%s\n' '== Changed files in exact range =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Focused exact diff =='
git diff --no-ext-diff --unified=30 "$base" "$head" -- \
src/main/java/com/clearfolio/viewer/controller/ApiExceptionHandler.java \
src/test/java/com/clearfolio/viewer/controller/ApiExceptionHandlerTraceIdValidationTest.java
printf '%s\n' '== Handler source =='
cat -n src/main/java/com/clearfolio/viewer/controller/ApiExceptionHandler.java
printf '%s\n' '== Added regression test source =='
cat -n src/test/java/com/clearfolio/viewer/controller/ApiExceptionHandlerTraceIdValidationTest.java
printf '%s\n' '== Existing handler-focused tests =='
fd -a 'ApiExceptionHandler.*Test\.java' src/test/java/com/clearfolio/viewer/controller \
-x sh -c 'echo "== $1 =="; rg -n -C 3 "X-Trace-Id|traceId|request\\.getId\\(\\)" "$1"' sh {}Length of output: 37142
No findings. The exact range changes only trace-ID handling and its regression tests.
The tests cover path-like client input, unsafe client and server values, oversized client input, and a valid conventional identifier. The reviewed change does not extend into tenant or authentication behavior. You are interacting with an AI system. |
1 participant
Objective
Bound the client-controlled
X-Trace-Iddiagnostic boundary so API error envelopes cannot echo arbitrary path-like or oversized identifiers while still preserving a conventional opaque correlation identifier.Fresh exact state — 2026-08-11
4bd555bab85741dbfa6fce9ee18e748f14d75551;main:55d7ae8647208e301f282350f076eeddaba61d11;31414660717: success;31414660570: success;31414660667: success;31414660610: success;Test-first evidence
RED
Test-only head
64a5ee31f5ac5e659f0966d84aaa2011b08a29c1added focused regressions without changing production. Exact-head CI Maven job93539677347checked out that SHA and ran 499 tests. Exactly two intended tests failed: protected code echoed../../tenant-secretand a 129-character client trace identifier instead of falling back to the server request id. The bounded conventional identifier case remained green. Security Scan and Semgrep were already green on the RED head.GREEN
Current production code validates
X-Trace-Idagainst a bounded opaque identifier grammar: one leading ASCII alphanumeric followed by at most 127 ASCII alphanumeric, dot, underscore, colon or hyphen characters. Invalid or oversized client identifiers are ignored in favor of the server request id; if that server identifier is also unsuitable, the existing generated UUID fallback remains authoritative.The exact-head regression proves path-like and oversized values are not echoed while
req-20260811_02:17.55remains accepted. Exact-head CI, Security Scan, SAST and fuzz are all GREEN.Scope
Merge gate
Move to Ready for ordinary independent review. Keep this exact head unchanged. Merge or auto-merge may complete only after live repository protection still sees every applicable required check passing, zero valid unresolved findings, and a counted approving review from a qualifying independent reviewer with write access. Automated comments, checks, statuses and model output are evidence, not approval.
Summary by CodeRabbit