Repository navigation
Validate static credentials before client role selection - #312
Conversation
|
All 21 checks passed for the credential-only head. To avoid another full CI cycle after #306 merges, I am stacking this branch on the exact run-close head already in review. The credential change stays separate in the final main diff. Next: test the combined branch, obtain Security confirmation at its new head, and merge only after #306. Owner: sdk-python. |
|
|
Security exact-head PASS for The constructor validates all three supplied static-token options before base-URL normalization, HTTP-client construction, discovery, or control/worker role selection. It rejects leading or trailing Unicode whitespace and any C0/C1 control character anywhere, without trimming or returning the value. The exception names only
All 21 current checks are complete and green across Python 3.10–3.15, integration, package, regression corpus, lint, analysis and target-branch qualification. My local host lacked this repository's Python dependencies, so I did not claim an additional local run; the source/fixture audit and authoritative CI are the evidence. No Security blocker remains at this exact head. Any source change requires counter-review. |
Refs #304.
A token copied from a Secret file with a trailing newline currently reaches HTTP and produces repeated 401s. Validate every supplied
token,control_tokenandworker_tokenduring construction, before role selection. Refuse edge whitespace or control characters without trimming or exposing any value. PreserveNone, empty strings and existing role precedence.Copies the canonical Server credential fixture unchanged. Its common Unicode scalar cases cover every token option, and its pre-selection vectors cover masked or unused malformed tokens. Additional checks preserve empty/None behavior, discovery order and role precedence.
Validation: the new test fails on current main because the constructor accepts a leading tab. With the fix, 1,108 shared-vector and client tests pass; Ruff, mypy and the public-boundary scan pass. GitHub CI remains required before merge. Publication and installed-package verification will be recorded on #304.