Skip to content

NO-ISSUE: Reduce false positives #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sk-ilya merged 2 commits into from
Jun 22, 2026
Merged

NO-ISSUE: Reduce false positives #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f453f55
NO-ISSUE: Reduce false positives
sk-ilya Jun 22, 2026
184d84f
NO-ISSUE: Add yamllint config and GitHub Actions workflow
sk-ilya Jun 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 18 additions & 1 deletion .coderabbit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,9 @@ reviews:
# package-lock.json, Cargo.lock) are deliberately kept so the supply-chain
# path_instructions block fires on them.
- "!yarn.lock"
# Keycloak realm exports: config data with dev client secrets and
# RFC 6238 TOTP defaults, not reviewable code.
- "!**/realm.json"
Comment on lines +29 to +31

@coderabbitai coderabbitai Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Narrow the realm.json exclusion to explicit dev fixture paths.

Line 31 currently excludes every realm.json in the repo, which can hide security-relevant realm configuration changes from review. Scope this to known local/dev export directories instead of a global wildcard.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.coderabbit.yaml around lines 29 - 31, The exclusion pattern
`!**/realm.json` on line 31 is too broad and excludes realm.json files from
everywhere in the repository, which can hide security-relevant configuration
changes from code review. Replace this global wildcard pattern with explicit
path exclusions that target only the known local and dev fixture directories
where realm.json exports are typically stored (for example, paths like dev
fixtures or local export directories). This ensures that only intentional
non-reviewable files are excluded while allowing security-relevant realm
configuration changes in other locations to be reviewed.


auto_review:
enabled: true
Expand Down Expand Up @@ -342,13 +345,23 @@ reviews:
keys, credentials. Also flag base64 strings >32 chars in config,
URLs with embedded credentials, variables named api_key/secret/
token/password assigned string literals.

EXCEPTION: Do NOT flag default admin/admin credentials in
developer setup or maintenance scripts (e.g., Keycloak token
requests with username=admin, password=admin). These are
standard defaults for local development environments.
mode: "error"
Comment on lines +349 to 353

@coderabbitai coderabbitai Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

The admin/admin exception is too broad for “maintenance scripts.”

This wording can suppress real credential findings in scripts that may run outside localhost workflows. Restrict the carve-out to explicit local-dev contexts (path + host constraints), not generic maintenance usage.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.coderabbit.yaml around lines 349 - 353, The EXCEPTION rule for admin/admin
credentials in the Keycloak section is too broad by permitting generic
"maintenance scripts" without constraints. Restrict the exception to explicitly
reference local-dev contexts only, adding path-based constraints (e.g., specific
docker-compose or local setup files) and host constraints (e.g.,
localhost/127.0.0.1) to prevent the rule from suppressing real credential
findings in production or non-local scripts.


- name: "no-weak-crypto"
instructions: |
Flag MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB mode usage.
Flag custom crypto implementations. Flag non-constant-time
comparison of secrets or tokens. Do NOT flag RSA 2048.
comparison of secrets or tokens.

EXCEPTION: Do NOT flag RSA 2048. Do NOT flag md5sum or
sha1sum when used for non-cryptographic purposes (file change
detection, checksums, cache keys). Do NOT flag HmacSHA1 for
TOTP/OTP configuration (RFC 6238 default algorithm).
Comment on lines +361 to +364

@coderabbitai coderabbitai Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Constrain weak-crypto carve-outs with explicit non-security boundaries.

The current exception text can let insecure SHA1/MD5 usage slip through if labeled as checksum/cache logic. Add explicit prohibition for auth, signatures, password hashing, token integrity, and untrusted-input paths.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.coderabbit.yaml around lines 361 - 364, The EXCEPTION text for weak-crypto
detection is too permissive and allows insecure SHA1/MD5 usage to bypass checks
if labeled as checksums or cache logic. Enhance the exception text in the
weak-crypto carve-out section to explicitly prohibit the use of these algorithms
for authentication, digital signatures, password hashing, token integrity
verification, and processing untrusted input, ensuring clear security boundaries
that prevent insecure patterns from being overlooked.

mode: "error"

- name: "no-injection-vectors"
Expand All @@ -357,6 +370,10 @@ reviews:
eval/exec on untrusted data, pickle.loads on untrusted input,
yaml.load without SafeLoader, os.system with variables,
dangerouslySetInnerHTML with user data.

EXCEPTION: Do NOT flag jq filter string interpolation when
the variable originates from a prior jq extraction on the
same local file, not from user input.
Comment on lines +374 to +376

@coderabbitai coderabbitai Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

jq interpolation exception needs a stronger trust-boundary check.

“Prior jq extraction from the same local file” is insufficient when file contents can be attacker-controlled. Require the source file to be repository-controlled/static and keep interpolation strictly data-only.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.coderabbit.yaml around lines 374 - 376, The jq filter string interpolation
exception rule in the EXCEPTION block needs to strengthen its trust-boundary
validation. Currently it allows interpolation when the variable originates from
a prior jq extraction on the same local file, but this is insufficient since
file contents can be attacker-controlled. Update the exception to additionally
verify that the source file is repository-controlled or static (not dynamically
loaded or user-supplied), and enforce that interpolation remains strictly
data-only without allowing arbitrary filter expressions. This ensures the
exception only applies when both the extraction source and the interpolated
value are from trusted, non-malleable origins.

mode: "error"

- name: "container-privileges"
Expand Down
30 changes: 30 additions & 0 deletions .github/workflows/yamllint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
---
name: Lint YAML

on:
push:
branches:
- main
pull_request:
branches:
- main

permissions:
contents: read

jobs:
yamllint:
name: yamllint
runs-on: ubuntu-latest

steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false

Comment thread
coderabbitai[bot] marked this conversation as resolved.
- name: Install yamllint
run: pip install --user yamllint

- name: Run yamllint
run: yamllint --strict .
26 changes: 26 additions & 0 deletions .yamllint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
---
extends: default

rules:
line-length: disable
document-start: disable
indentation:
spaces: 2
indent-sequences: true
check-multi-line-strings: false
comments:
require-starting-space: true
ignore-shebangs: true
min-spaces-from-content: 1
truthy:
allowed-values: ["true", "false"]
check-keys: false
trailing-spaces: enable
braces:
min-spaces-inside: 0
max-spaces-inside: 0
brackets:
min-spaces-inside: 0
max-spaces-inside: 0
empty-lines:
max: 1
Loading