fix(security): detect indirect asyncio.to_thread Gunicorn worker bypasses - #261
Conversation
…tions Extend the Gunicorn config AST scan to flag event-loop run_until_complete and asyncio.run(async def) wrappers that mutate workers via asyncio.to_thread, so memory:// rate-limit and session guards fail closed like other bypasses. Fixes #259 and #260. Co-authored-by: Alexander Wagner <info@alexanderwagnerdev.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@codex review |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_b26e013e-8a1b-410b-84d1-2d4a9c5f1c63) |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c7187ec37e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_1326a2b6-2866-4628-b258-b8a20212871c) |
|
@codex review |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_cfe4be31-b622-44bc-8d61-a49e000a625a) |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5037af87e1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_69af86e1-b495-4041-a97c-ef39d9728f0f) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_deae0213-8810-45a2-9505-8caa47be12ef) |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 38102c69bc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_c4b79925-280d-438b-8b52-74a43153febf) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_258a2113-5b01-4010-96ca-b617c16f47df) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_7b5b1075-2756-4b83-8bef-02fd954c5bff) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_46879d20-146c-4509-9223-1d2fd17411cb) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_87f7df4e-ef44-4e70-8a59-d9d447436611) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_ca5a75d7-7eb0-4bee-a302-29fa0f6e6253) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_81549437-5daa-4092-8dae-9a349502fe3b) |
|
2 participants
Extend the Gunicorn config AST scan to detect indirect asyncio.to_thread worker mutations (event loop run_until_complete and asyncio.run async wrappers), closing startup bypasses for memory:// rate limits and session guards. Fixes #259 and #260.
Note
Medium Risk
Changes security-sensitive Gunicorn worker static analysis with a large, complex AST model where misclassification could cause false dynamic flags or missed bypasses.
Overview
Extends Gunicorn config static analysis so import-time paths that mutate
workersvia indirect asyncio (not onlyasyncio.run(asyncio.to_thread(...))) are treated as dynamic, closing startup bypasses for rate limits and session guards.The scan now builds richer asyncio binding indexes (named constants instead of magic indices) and tracks aliases and source order for
run,to_thread, loop factories,Runner, and awaitable consumers (gather,shield,wait_for). It follows async wrappers (nested helpers, static class methods, deferred awaitables,to_threadpassed as parameters) with local import/shadowing awareness, and flagsRunner.run,loop.run_until_complete, and generalizedasyncio.runwhen the coroutine can reach worker-mutatingto_threadcallbacks. Compound-statement walking now includesasync withandfor/whileelsebranches. Tests add parametrized cases for previously missed bypass shapes and patterns that must stay static.Reviewed by Cursor Bugbot for commit 7ca91bc. Bugbot is set up for automated code reviews on this repo. Configure here.