fix(ci): scope gunicorn instance .update() scan to namespace aliases - #245
Conversation
Detect walrus-if and match-guard namespace updates, __init_subclass__ subclass definitions, dataclass __post_init__ instantiation, metaclass __new__ hooks, and descriptor __get__ attribute access that mutate workers at import time without being flagged as dynamic. Startup with RATELIMIT_STORAGE_URI=memory:// would otherwise allow multi-worker Gunicorn to bypass per-worker login rate limits and session stores while the panel believes it runs single-worker. Co-authored-by: Alexander Wagner <info@alexanderwagnerdev.com>
PR #244 reintroduced false positives by treating every instance .update({'workers': ...}) as dynamic. Restore PR #197 behavior for import-time scans and extend namespace-alias collection to walrus bindings in if/while tests and match captures on globals(). Co-authored-by: Alexander Wagner <info@alexanderwagnerdev.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_46d6deb6-2edb-4fb3-b3a0-e45043c0304c) |
2 participants
Summary
Fixes CI test failures on PR #244 caused by overly broad instance
.update()detection in the Gunicorn worker AST scanner.Changes
_expression_has_risky_instance_updatefrom import-time statement scanning (restores PR Fix gunicorn workers scan false positives for unrelated .update() calls #197 behavior)if/whiletests andmatchcaptures onglobals().update()heuristics scoped to lambda bodies where receivers cannot be proven staticContext
PR #244 added
_expression_has_risky_instance_updateto_is_dynamic_workers_mutation, which flagged unrelated local dict updates (e.g.settings.update({'workers': 4})) and safe dict-subclass patterns as dynamic.Note
Medium Risk
Changes security-sensitive static analysis for Gunicorn worker counts; incorrect heuristics could falsely block startup or miss dynamic worker overrides.
Overview
Tightens the Gunicorn
workersAST scanner so configs that mutateworkersindirectly are marked dynamic (blocking unsafememory://rate limits with multiple workers).Namespace alias collection now includes walrus bindings in
if/whiletests and barecase ns:captures when matching onglobals()(and similar), so patterns likeif (ns := globals()): ns.update(...)are tracked.Class-hook analysis is expanded: metaclass
__new__, dataclass-style__post_init__,__init_subclass__on base classes, and descriptor__get__access (including fields instantiated from descriptor classes) are treated as import-time or expression-triggered side effects.matchguards that mutateworkersare also classified as dynamic.Adds parametrized tests (
test_security_review_sep17.py) asserting these bypass shapes return(1, True)from_workers_from_gunicorn_config_path.Reviewed by Cursor Bugbot for commit c284c26. Bugbot is set up for automated code reviews on this repo. Configure here.