Revise PR #242: bearer token still crosses origins on redirect, plus a missing route - #262
Revise PR #242: bearer token still crosses origins on redirect, plus a missing route#262jaylfc wants to merge 1 commit into
Conversation
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
Warning Review limit reached
Next review available in: 5 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| headers["Authorization"] = f"Bearer {registry_token}" | ||
| req = urllib.request.Request(url, headers=headers, method="GET") | ||
| try: | ||
| with urllib.request.urlopen(req, timeout=30) as resp: |
There was a problem hiding this comment.
[WARNING]: urllib.request.urlopen follows redirects by default
The PR title flags "bearer token still crosses origins on redirect". While Python 3.10+ strips the Authorization header on cross-origin redirects, the fetcher still follows the redirect blindly. Consider using a custom HTTPRedirectHandler to prevent cross-origin redirects or explicitly handle them.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| raise UnauthorizedError(f"HTTP {exc.code} from {url}") from exc | ||
| if exc.code == 404: | ||
| raise NotFoundError(f"HTTP 404 from {url}") from exc | ||
| raise |
There was a problem hiding this comment.
[WARNING]: raise re-raises raw urllib.error.HTTPError for non-401/403/404 HTTP errors
The docstring promises only RefFetchError subclasses or ValueError, but callers must also handle raw urllib.error.HTTPError for server errors (500, 502, etc.). Consider wrapping them in RefFetchError for API consistency.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| ) | ||
| _reject_dot_segments(path) | ||
| encoded_path = urllib.parse.quote(path, safe="/") | ||
| base = files_url.rstrip("/") if files_url else files_url |
There was a problem hiding this comment.
[WARNING]: base = files_url.rstrip("/") if files_url else files_url does not validate None
When files_url is None (possible for direct callers of the public resolve_ref_uri), the subsequent f-string produces the malformed URL "None/api/projects/..." instead of failing fast. Consider validating files_url at the start of the function.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 3 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (5 files)
Fix these issues in Kilo Cloud Reviewed by step-3.7-flash · Input: 62.7K · Output: 23.6K · Cached: 471.6K |
BLOCKED and closing. Byte-identical to the branch it revises.Control: the same command on Fourth no-op revision today. STEP 0 carried the work forward and nothing after it ran, so all three blockers from my review of #242 persist: the bearer token still crosses origins on redirect, Closing rather than leaving it open, because an open |
1 participant
CARD TITLE (intent, not commit subject): Revise PR #242: bearer token still crosses origins on redirect, plus a missing route
Autonomous build of board card tsk-revvkw.
Files:
taosmd/config.py | 47 +++++++++
taosmd/ref_fetch.py | 153 ++++++++++++++++++++++++++++++
taosmd/remote.py | 8 ++
taosmd/service.py | 62 +++++++++++-
tests/test_ref_fetch.py | 247 ++++++++++++++++++++++++++++++++++++++++++++++++
5 files changed, 516 insertions(+), 1 deletion(-)