Repository navigation
fix: bound the component descriptor name, so a license source cannot outgrow its own contract - #42
Conversation
PackageLicense.Source is a component name and is bounded at the gate; descriptor validation asked only that a name be non-blank. So a matcher with a 257-byte name was a valid component whose provenance the source gate silently erased -- the shape of the bug #31 fixed, one layer down. A shared maxComponentNameLength now lives with ComponentDescriptor, validateComponentDescriptor enforces it (bounded, valid UTF-8, no control characters, measured trimmed the way the source gate measures), and maxLicenseSourceLength references it by name so the two domains cannot drift again. Control characters are refused for the reason the source gate refuses them: the name reaches published documents, and a newline corrupts SPDX's tag form. This rejects descriptors that validated before, so it ships in a minor release with a release-notes callout. Closes #32 Co-Authored-By: Claude Fable 5.1 <[email protected]>
|
Warning Review limit reachedNext included review available in 45 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 78a7cc2351
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Trimming before the new checks let a control character at an edge
through ("\nmatcher") and let unbounded padding ride past a bound that
exists to be a resource limit, while the descriptor kept the untrimmed
value. Validation does not rewrite the name, so what passes must be
what gets marshaled. The source gate trims before measuring, which only
shrinks, so every name accepted here still survives there.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
1 participant
Closes #32.
What was wrong
PackageLicense.Sourceis documented as a component name and bounded at its gate.validateComponentDescriptorasked only that a name be non-blank. So a matcher named with 257 bytes was a valid component, and passing that name to the license set normalizer had its source silently erased one layer down from where the name was accepted.The fix
The shape the issue asked for:
maxComponentNameLengthlives incomponent.gonext toComponentDescriptor, with the contract documented on the type.validateComponentDescriptorrefuses a name over the bound, one that is not valid UTF-8, or one carrying a control character. The name is measured trimmed, the way the source gate measures it, so the two agree on every value. All four kinds go through it.maxLicenseSourceLength = maxComponentNameLength, replacing the coincidental tie to the contact-name allowance. The decline note recorded inpackage.gois replaced with the reason the two are now tied.Control characters are rejected because the issue asked whether they should be, and the answer is the same one the source gate already gives: the name reaches published documents, and a newline corrupts SPDX's line-oriented tag form.
The new test pins both halves: the descriptor gate's accept and reject sets across all four validators, and the actual contract, that every name descriptor validation accepts survives as a license source.
Release note
The conformance suite stays green and the change is API-additive, so the CLI's example-plugin compile check is unaffected.
Verification
🤖 Generated with Claude Code