Skip to content

[WRONG BRANCH] fix(issue-quality): bound reproduction matching cost - #36

Draft
luvs01 wants to merge 1 commit into
mainfrom
codex/propose-fix-for-regex-vulnerability
Draft

[WRONG BRANCH] fix(issue-quality): bound reproduction matching cost#36
luvs01 wants to merge 1 commit into
mainfrom
codex/propose-fix-for-regex-vulnerability

Conversation

@luvs01

@luvs01 luvs01 commented Aug 7, 2026

Copy link
Copy Markdown
Owner

Motivation

  • The unanchored filename alternative in the reproduction regex allowed pathological backtracking on long non-matching tokens, enabling a CPU-exhaustion vector during issue validation.
  • The validation logic ran expensive Markdown normalization and path matching against untrusted issue text, so a cheap preflight was needed to avoid quadratic work.

Description

  • Anchor the filename alternative in REPRO_PATH_RE by changing "[\\w.@-]+\\.(?:json|...)\\b" to "(?:^|[^\\w.@-])[\\w.@-]+\\.(?:json|...)\\b" to prevent mid-token quadratic backtracking.
  • Stop using the combined ACTIONABLE_REPRO_RE and instead test REPRO_COMMAND_RE and REPRO_FAILURE_RE first, only evaluating REPRO_PATH_RE when the cleaned text contains path-like characters.
  • Add a cheap preflight check in hasActionableReproductionDetail to return early for long plain tokens that contain no actionable syntax before running clean() and heavier path/fence logic.
  • Add a regression test checks long non-matching reproduction tokens in linear time that asserts hasActionableReproductionDetail("a".repeat(60_000)) completes quickly and remains false.

Testing

  • Ran the focused script tests with node --test .github/scripts/issue-quality.test.cjs, which passed all tests including the new performance regression (113 tests passing).
  • Ran bun run typecheck and bun run privacy:scan, both of which succeeded.
  • Ran git diff --check with no issues reported.
  • An attempt to run the entire bun run test suite in this environment was not completed due to unrelated timeouts and test-time constraints, and uncovered unrelated failures/timeouts outside the changed files; the fix itself is covered by the focused tests above.

Summary by CodeRabbit

  • Bug Fixes

    • Improved detection of actionable reproduction details in issue submissions.
    • Prevented false matches for unsupported file names and malformed reproduction content.
    • Preserved handling of cleaned and non-empty fenced content.
  • Performance

    • Added safeguards to keep validation responsive when processing unusually long, non-matching input.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@github-actions github-actions Bot changed the title fix(issue-quality): bound reproduction matching cost [WRONG BRANCH] fix(issue-quality): bound reproduction matching cost Aug 7, 2026
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown

⏳ DRAFT

  • wrong target branch (main); retarget to dev.

What to do

  • Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

@github-actions
github-actions Bot marked this pull request as draft August 7, 2026 07:13
@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

Changes

Reproduction detection

Layer / File(s) Summary
Bounded reproduction matching and validation
.github/scripts/issue-quality.cjs, .github/scripts/issue-quality.test.cjs
REPRO_PATH_RE now requires a valid token boundary before supported filenames. hasActionableReproductionDetail performs early syntax checks, tests command and failure patterns separately, and checks paths only when path-like characters exist. A regression test verifies that a 60,000-character non-matching token completes within 500 ms.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: wibias, ingwannu

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: bounding reproduction matching cost.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/propose-fix-for-regex-vulnerability

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the bug Something isn't working label Aug 7, 2026
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown

Deterministic PR hygiene checks passed.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/scripts/issue-quality.test.cjs:
- Around line 657-662: Update the long-token input in “checks long non-matching
reproduction tokens in linear time” to append an unsupported extension such as
“.unknown”, ensuring REPRO_PATH_RE is exercised. Keep the false assertion and
existing timing threshold unchanged.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 470dacad-612f-4e85-953b-295424563c1c

📥 Commits

Reviewing files that changed from the base of the PR and between 2468502 and b4e14a8.

📒 Files selected for processing (2)
  • .github/scripts/issue-quality.cjs
  • .github/scripts/issue-quality.test.cjs

Comment on lines +657 to +662
it("checks long non-matching reproduction tokens in linear time", () => {
const startedAt = performance.now();
assert.equal(hasActionableReproductionDetail("a".repeat(60_000)), false);
assert.ok(performance.now() - startedAt < 500, "actionable reproduction check took too long");
});

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Exercise REPRO_PATH_RE in the performance test.

The current input contains no path marker. .github/scripts/issue-quality.cjs returns at Line 1106 before REPRO_PATH_RE runs at Line 1112. This test cannot detect a regression in the bounded filename alternative at Line 1090.

Use a long token with an unsupported extension, such as "a".repeat(60_000) + ".unknown", and keep the false assertion and timing check.

Proposed test adjustment
-    assert.equal(hasActionableReproductionDetail("a".repeat(60_000)), false);
+    assert.equal(
+      hasActionableReproductionDetail("a".repeat(60_000) + ".unknown"),
+      false,
+    );
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
it("checks long non-matching reproduction tokens in linear time", () => {
const startedAt = performance.now();
assert.equal(hasActionableReproductionDetail("a".repeat(60_000)), false);
assert.ok(performance.now() - startedAt < 500, "actionable reproduction check took too long");
});
it("checks long non-matching reproduction tokens in linear time", () => {
const startedAt = performance.now();
assert.equal(
hasActionableReproductionDetail("a".repeat(60_000) + ".unknown"),
false,
);
assert.ok(performance.now() - startedAt < 500, "actionable reproduction check took too long");
});
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/scripts/issue-quality.test.cjs around lines 657 - 662, Update the
long-token input in “checks long non-matching reproduction tokens in linear
time” to append an unsupported extension such as “.unknown”, ensuring
REPRO_PATH_RE is exercised. Keep the false assertion and existing timing
threshold unchanged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aardvark bug Something isn't working codex

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant