Skip to content

fix(gittensor): guard Gittensor repo name normalization - #437

Merged
JSONbored merged 1 commit into
mainfrom
codex/fix-vulnerability-in-repositoryfullname-handling
Jun 6, 2026
Merged

fix(gittensor): guard Gittensor repo name normalization#437
JSONbored merged 1 commit into
mainfrom
codex/fix-vulnerability-in-repositoryfullname-handling

Conversation

@JSONbored

Copy link
Copy Markdown
Owner

Motivation

  • Upstream Gittensor JSON can include non-string repositoryFullName values which caused .toLowerCase() calls to throw and crash contributor profile builds.
  • The change aims to treat external Gittensor repo names as untrusted JSON and safely coerce or ignore malformed values so profile construction remains available.

Description

  • Treat repositoryFullName as unknown and add asString() in src/gittensor/api.ts so non-string values map to the existing empty-string fallback before entering snapshots.
  • Replace direct .toLowerCase() usages with a new normalizedRepoName() helper in src/signals/engine.ts and use it when deduping repo names for label aggregation.
  • Add regression tests that exercise malformed/malformed-object repo names in test/unit/gittensor-api.test.ts and test/unit/signals-coverage.test.ts to ensure malformed upstream payloads are treated as absent rather than crashing.

Testing

  • Ran npx vitest run test/unit/gittensor-api.test.ts test/unit/signals-coverage.test.ts and the targeted tests passed.
  • Ran the repository unit test command npm run test:unit -- test/unit/gittensor-api.test.ts test/unit/signals-coverage.test.ts and the run succeeded.
  • Ran type checking with npm run typecheck and it completed successfully.

Codex Task

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jun 6, 2026

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
gittensory-ui 8b71dda Commit Preview URL

Branch Preview URL
Jun 06 2026, 01:09 AM

@dosubot dosubot Bot added the size:S label Jun 6, 2026
@ghost

ghost commented Jun 6, 2026

Copy link
Copy Markdown

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal Result Evidence Action
Gate result ⚠️ Skipped #437 is no longer open. No action.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

@ghost ghost added the gittensory:reviewed label Jun 6, 2026
@JSONbored JSONbored changed the title Guard Gittensor repo name normalization fix(gittensor): Guard Gittensor repo name normalization Jun 6, 2026
@github-actions github-actions Bot added the gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. label Jun 6, 2026
@JSONbored JSONbored self-assigned this Jun 6, 2026
@JSONbored JSONbored changed the title fix(gittensor): Guard Gittensor repo name normalization fix(gittensor): guard Gittensor repo name normalization Jun 6, 2026
@JSONbored
JSONbored merged commit 2e5e84c into main Jun 6, 2026
12 checks passed
@JSONbored
JSONbored deleted the codex/fix-vulnerability-in-repositoryfullname-handling branch June 6, 2026 10:04
@github-project-automation github-project-automation Bot moved this from Todo to Done in gittensory - v1 roadmap Jun 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier.

Projects

No open projects
Status: Done

Development

Successfully merging this pull request may close these issues.

1 participant