fix: apply repository audit remediation#3
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4446db145f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| client_id = auth_config.get("client_id") or os.getenv(f"{env_prefix}_CLIENT_ID", "") | ||
| client_secret = auth_config.get("client_secret") or os.getenv(f"{env_prefix}_CLIENT_SECRET", "") | ||
| token_url = auth_config.get("token_url") or os.getenv(f"{env_prefix}_TOKEN_URL", "") |
There was a problem hiding this comment.
When /api/test_connection passes an explicit auth_config with a blank field, these or os.getenv(...) fallbacks silently mix browser-supplied values with process-wide credentials. For example, if the request includes a new source_client_id but leaves source_client_secret blank while SF_SOURCE_CLIENT_SECRET is set, the endpoint tests with the server secret instead of reporting missing request credentials, so the connection check is no longer isolated to the request data.
Useful? React with 👍 / 👎.
1 participant
Summary
Validation
git diff --checkpassedNo repository visibility or GitHub settings were changed.