🧹 Janitor: Validate output format before processing URL#140
🧹 Janitor: Validate output format before processing URL#140
Conversation
- Moves `formatters` lookup in `handler` to occur before URL normalization and fetching. - Adds `TestHandler_InvalidFormat_NoFetch` to verify that invalid formats do not trigger network requests. - Updates `.jules/janitor.md` with the new pattern. Co-authored-by: lucasew <15693688+lucasew@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Summary of ChangesHello @lucasew, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly improves the efficiency and resilience of the API by implementing an "early exit" strategy for requests with invalid output formats. By validating the requested format at the very beginning of the request handling process, the system avoids unnecessary and potentially costly operations such as fetching external content, thereby conserving resources and mitigating potential denial-of-service attack vectors. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request effectively addresses a resource-wasting issue by moving the output format validation to the beginning of the request handler. The 'fail fast' approach is a great improvement. The implementation is clean, and the new regression test TestHandler_InvalidFormat_NoFetch correctly verifies that no network request is made for invalid formats. I have one suggestion regarding the new test to improve its robustness for parallel execution.
| func TestHandler_InvalidFormat_NoFetch(t *testing.T) { | ||
| // This test ensures that an invalid format fails immediately without attempting to fetch the URL. | ||
| oldClient := httpClient | ||
| defer func() { httpClient = oldClient }() |
There was a problem hiding this comment.
For improved test robustness, consider using t.Cleanup instead of defer. t.Cleanup is the modern Go practice for test cleanup and behaves more predictably, especially in complex test scenarios with subtests or t.Fatal.
Additionally, be aware that modifying this global httpClient makes tests stateful and not safe to run in parallel with t.Parallel(). While this PR follows an existing pattern, for future work, protecting access to this global with a sync.Mutex would be a good improvement to allow for parallel test execution.
| defer func() { httpClient = oldClient }() | |
| t.Cleanup(func() { httpClient = oldClient }) |
1 participant
What Changed
Moved the output format validation check to the beginning of the
handlerfunction inapi/index.go. Added a regression testTestHandler_InvalidFormat_NoFetchinapi/index_test.go.Why This Helps
Previously, the application would parse the URL, resolve it, and fetch the content (potentially downloading up to 2MB) even if the requested output format (e.g.,
?format=invalid) was not supported. This wasted resources (bandwidth, CPU) and increased the attack surface for DoS. By validating the format early, we "fail fast" and reject invalid requests immediately.Before
?url=...&format=badAfter
?url=...&format=badVerification
./mise run testTestHandler_InvalidFormat_NoFetchpasses (confirms no network request is made).PR created automatically by Jules for task 15649003222395193027 started by @lucasew