Repository navigation
test(security): bound hostile input and gate releases on runtime advisories #567
Description
Context
Auditing main found one real defect: client-controlled JSON depth can produce a 5xx (Python 3.11: depth >= 1000; 3.12/3.13: depth 10000), tracked as its own bug. The 5xx/formatter/auth tests from PR #569 already pass on main on 3.11-3.14, so they are proof, not a fix. Release-time advisory gating and scan hygiene are the remaining required gaps.
Acceptance Checklist
- Default 5xx responses and failing custom formatters expose no exception text, body, Pydantic input, credential or header (sync/async, SDK request and testing helper), covered by regression tests.
- Client-controlled JSON depth never yields a 5xx; over-deep bodies return the sanitized
400 Invalid JSONon every supported interpreter. - Decorators never change a route's
auth_level; docs state auth is host-owned andexpose_internal_errorsis unsafe for production. - The Bandit gate fails on empty, missing or unparsable scans and covers
src,examples,scriptsandtools. -
publishis blocked by any known advisory in the exact candidate wheel's runtime closure on 3.11-3.14; tool errors fail closed and are distinguishable from advisories; development-dependency audit stays report-only. - Semgrep runs a supported release; scan outputs upload with
if: always(); no secrets or payloads are retained.
Out of scope
An expiring-exception framework (add when a first exception exists), regex redaction, a custom security report schema, Azure IaC findings that need real Azure to verify.
References
JSON-depth, Bandit-scope, Semgrep-version and spike-lane issues are tracked separately.
Activity
[-]security: strengthen validation trust boundaries and security evidence[/-][+]test(security): prove validation trust boundaries and strengthen security evidence[/+][-]test(security): prove validation trust boundaries and strengthen security evidence[/-][+]test(security): bound hostile input and gate releases on runtime advisories[/+]yeongseon commentedon Oct 24, 2026
Rewrote the body to outcome-focused criteria. The original asked for severity-aware policy with expiring exceptions, redacted machine-readable evidence and Job Summaries, which led to roughly 1,500 lines of tooling in #569. The audit reproduced one real product defect (JSON depth), confirmed the other trust-boundary behaviors already hold, and found the real gate gaps (no release advisory gate; Bandit passes on empty scope; Semgrep runs 1.36.0). Previous text is in the edit history.
fix(adapter): return 400 for JSON nested beyond a portable depth limit (
yeongseon commentedon Oct 26, 2026
Keep this tracker open. Main contains #583 (portable JSON depth) and #587 (expanded fail-closed Bandit), but oversized integer parsing still needed #591/Closes #585. Supported Semgrep is proposed separately in draft #592/Refs #579; its required-check seeded-finding proof is not complete. publish-pypi.yml currently has no exact-wheel runtime advisory audit job in publish.needs, so release advisory acceptance remains unmet on main; the old #569 draft must not be merged as a shortcut. No statement that existing disclosure/auth tests pass on main is a claim that the additional requested proof or advisory release gate has landed. Security-sensitive filtering/release changes require explicit human maintainer authorization.