fix(security): reject future-dated validation evidence - #445
Conversation
|
Warning Review limit reached
Next review available in: 21 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| } else if (updatedAtMs > Date.now()) { | ||
| failures.push("updated_at cannot be in the future"); |
There was a problem hiding this comment.
📝 Info: Date-only timestamps ahead of UTC now fail closed
A date-only updated_at parses to midnight UTC (security-checklist.mjs:43). For an authoring timezone ahead of UTC, that instant can be later than Date.now(), so removing the 24h grace at security-checklist.mjs:71 now rejects it. This matches the PR's stated fail-closed intent.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Scope
Fail closed when security validation evidence claims an
updated_attimestamp later than the current observation time. The existing diagnostic already says future timestamps are invalid, but production allowed a 24-hour future grace window.Test-first repair
890a9837e562bbcaca88b8406e17786f595d170d: realistic security evidence one hour in the future must fail withupdated_at cannot be in the future.8f513d049cd92f2f5022b3d085d8cb02e265b821: remove the unintended 24-hour future allowance; any parsed future timestamp is rejected.scripts/lib/security-checklist.mjsandtest/security-checklist.test.ts.Existing ISO/impossible-calendar validation, owner/reference checks, checklist behavior, and security gate thresholds are unchanged.
Merge boundary
Draft until application CI, reviewer-ci, and eligible central Security Scan are terminal-success on the unchanged exact head, review/thread state is clean, protected
mainremains the live base, and central Security Scan authority is freshly revalidated.