Skip to content

Commit e6edad1

Browse files
easonLiangWorldedtecheasonliang28edelauna
authored
fix(api): require HTTPS for custom Google Gemini base URLs (CWE-319) (#2033)
* fix(api): require HTTPS for custom Google Gemini base URLs (CWE-319) googleGeminiBaseUrl is user-editable (settings, imported profiles) and the @google/genai client keeps API-key authentication for custom endpoints, so a cleartext base URL would send the API key over an insecure endpoint (CWE-319). Validate the endpoint before any request in createMessage and completePrompt: HTTPS is required; plain HTTP is accepted only for loopback test proxies (localhost, [::1], and literal 127.0.0.0/8 IPv4 hosts). Hostnames that merely resemble the loopback range (127.example.test, 127.0.0.a, 127.0.0.1.a, foo127.bar) or fall outside it (10.0.0.1) are rejected, as are non-HTTP schemes such as ftp://localhost and malformed URLs. Violations surface as a structured ApiProviderError before the request is built, so the key never leaves the process. Carved out of the abort-signal provider rollout (fork PR 1303) at the maintainer's request so the endpoint policy can be reviewed independently of the cancellation changes. * chore(lint): limit Stryker directive comments to 300 characters * test(api): cover Gemini HTTPS accept path and completePrompt rejects * docs(agents): require accept and reject tests for guards --------- Co-authored-by: Eason Liang <[email protected]> Co-authored-by: Elliott de Launay <[email protected]>
1 parent e4e112e commit e6edad1

8 files changed

Lines changed: 663 additions & 9 deletions

File tree

‎.coderabbit.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,9 @@ reviews:
7979
Require regression coverage at the lowest valid harness with behavior-focused
8080
assertions, including relevant negative, error, false/unset, and boundary cases.
8181
Check cleanup and deterministic async behavior and prefer shared typed test helpers.
82+
For guards and validators, require tests for both the accept path and the reject path
83+
through every public entry point; a reject-only matrix cannot catch a guard that rejects
84+
good input.
8285
Visible webview changes require a durable Playwright component snapshot; behavior-only
8386
changes do not.
8487
Reject weak assertions on values that could take multiple forms: .toBeDefined() or

‎AGENTS.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ Prefer the narrowest test layer that proves the behavior. This follows standard
5454
- Use `apps/vscode-e2e` only when the behavior depends on the real VS Code extension host, VS Code workspace APIs, extension activation, webview/extension messaging, file watcher behavior, or a complete user workflow.
5555
- Keep e2e tests focused on high-value smoke coverage across boundaries. Avoid placing detailed protocol, parsing, storage, retry, or edge-case assertions in e2e when they can be covered reliably at a lower layer.
5656
- When fixing a regression, add the regression test at the lowest layer that would have failed for the bug. Add an e2e test only if lower-level tests cannot represent the failure mode.
57+
- For a guard or validator, test the accept path and the reject path through every public entry point. A test that only rejects bad input does not prove the guard still accepts good input.
58+
- Use `it.each` for repeated cases and share the setup in a helper. Do not copy a test body per input.
59+
- A `Stryker disable` comment states the reason in one sentence. ESLint `max-len` limits it to 300 characters.
5760

5861
## Task Lifecycle Changes
5962

0 commit comments

Comments
 (0)