🐛 fix: match selected security policies by exact path - #5199
🐛 fix: match selected security policies by exact path#5199bilaldeveloper4312 wants to merge 2 commits into
Conversation
Signed-off-by: Muhammad Bilal Mukhtar <designbybilal9@gmail.com>
dosubot
Bot
added
the
size:S
bilaldeveloper4312
changed the title
noqt
left a comment
noqt
left a comment
There was a problem hiding this comment.
NOQT independently reviewed current head f2848a6.
The change is narrowly scoped: ExactPath preserves the existing basename fallback by default and is enabled only when Security-Policy rereads a path it already selected. The two focused exact-path cases and TestSecurityPolicy pass with Go 1.25.6; go vet ./checks/fileparser ./checks/raw and git diff --check also pass. The wider affected-package run still hits existing Windows workflow-fixture failures, which I reproduced on unchanged base d1fab88 as well.
This fixes the reported misread: a selected root SECURITY.md no longer matches .review-pro/node/security.md by basename.
Approved. One non-blocking hardening suggestion: add a SecurityPolicy-level regression containing both the selected policy and a same-basename nested file, so the caller's ExactPath wiring is protected as well as the matcher itself.
Signed-off-by: Muhammad Bilal Mukhtar <designbybilal9@gmail.com>
|
I filed #5198, so a note from the reporting side in case it helps a reviewer. The shape here is the right one. Gating the fallback per call rather than changing One detail worth knowing when you check the fix. The affected repo scores 3, not 0, and the difference is diagnostic rather than cosmetic. With the wrong file read, the three probes land like this:
The third one passes because it tests On the fixture. I see the tests use
I could not build scorecard in my own environment to confirm the fix end-to-end against that repo — the module download times out here — so I am not claiming to have verified it, only that the analysis and the approach line up. |
3 participants
Fixes #5198\n\nSecurity-Policy first discovers an approved policy path, but its content pass previously allowed a basename fallback. An unrelated nested security.md could therefore be read instead of the selected policy.\n\nThis adds an ExactPath option to the shared matcher and uses it only for Security-Policy content reads, preserving existing basename fallback behavior for other callers.\n\nValidation:\n- go test ./checks/fileparser ./checks/raw (Go 1.26.1, GitHub Codespaces)