Repository navigation
test: kill the surviving mutants in the external source and URL safety helpers - #1790
Conversation
…y helpers
Pin the behaviour of the seven Group D helpers with in-process tests: the
exact cncf.io and GitHub page URLs, headers, Link rel="next" parsing and
same-origin guard of the fetch walkers, the real git invocations in
git-source.mjs (depth-1 clone, trimmed HEAD, inherited stdio), every month
name and both changelog regex anchors, the remoteTarget and decodeEntities
boundaries, and the artworkUrls image-syntax pattern on its own. The scoped
mutation score rises from 77.48% (437 killed, 47 survived, 80 without
coverage) to 97.87% (550 killed, 2 timeouts, 12 survived, 0 without
coverage). The twelve survivors are equivalent: cncf-wp-api.mjs L32 ('1'
default, Number('') also ends the walk at page 1), github.mjs L61 (the
missing-header fallback never matches rel="next"), project-assets.mjs L88
(a dotless file never carries a mirrorable extension), L121 and L126 (http
URLs are rejected by artworkPath either way), uri-safety.mjs L86 (a global
replace removes every character with or without +), L111 and L163 (both
regexes can only match at index 0 for the inputs that reach them),
url-safety.mjs L126 (value is already a string past the requireNonEmptyString
guard), L142 (only observable with a protocols entry no URL.protocol can
equal) and L192 (path and field of an error list isSafeUrl discards).
Refs cncf#1788
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
✅ Deploy Preview for endusers ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CodeQL flagged the hand-rolled regex escape of the page URL as an incomplete sanitization; an exact message match needs no escaping. Refs cncf#1788 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
|
Overlap warning: this PR and open hold-gated #1792 ( Beyond the mechanical conflict, the two PRs add duplicated coverage:
Options: (a) land this PR first and have #1792 rebase and drop its duplicated Everything else in the diff (cncf-wp-api, git-source, lib-github, generate-changelog, project-assets) is disjoint from all open hold-gated PRs. The deletions in 🐝 Hive Agent: — hive: agent=scanner backend=copilot model=kimi-k3 copilot=1.0.88 |
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
There was a problem hiding this comment.
Read the full diff against main at 6ba9dc8 and ran the touched suites locally after npm ci: 90/90 pass across cncf-wp-api, git-source, generate-changelog, lib-github, project-assets, plus the extended uri-safety cases (15/15). Test-only as stated; the WP-API tests stub globalThis.fetch and restore it, and the git-source tests shim PATH with saved/restored env, so nothing reaches the network. Looks correct to me.
Two things for the maintainer merging this:
-
Conflict with #1792. Both PRs edit
tests/uri-safety.test.mjs— the same header comment (lines 8–16) and the same three behaviours (highest code point, bare&colon, mid-pathremoteTargetanchors). I read both diffs in full: overlapping in substance, different in text, so whichever merges second needs a rebase. #1792 is the hive's targeted fix for #1791; this PR'suri-safetyhunk is a superset forremoteTargetboundaries but covers slightly differentdecodeEntitiescases (	here vs&sol+ thenormalizeUricollapse there). -
The
REMOTE_TARGETSrow['http:\\\\', 'http://']pins hostless output. It matches current behaviour (the lookahead atscripts/lib/uri-safety.mjs:148fails with nothing after the separators, and the rewrite at:163then returns'http://'), but the comment above that code says a value with no host "fetches nothing to report". #1792's body records that inconsistency as a possible production change; ifremoteTargetis later fixed to returnnullfor host-less values, this row (and thehttp://?xrow) will need updating. Worth a maintainer's eye on whether to pin it now.
No defects found; this is a solid strengthening of the external-source tests.
— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88
…rayDeclaration (#1807) Annotate the 41 surviving mutants that the backlog groups in #1788 verified as equivalent (#1789, #1790, #1793, #1794, #1795) with Stryker disable directives that carry the reason, so they report as Ignored instead of Survived and no longer surface as mutation findings. Exclude the ArrayDeclaration mutator in stryker.config.mjs: every instance that survived on main seeded an accumulator or fallback whose contents are unobservable. Hoist the landscape source URL in DirectoryFreshness into a const so its directive can attach outside the JSX. Document the directive placement rules in CONTRIBUTING. Refs #1788 Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com> Co-authored-by: mrbobbytables <mrbobbytables@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Group D of the surviving-mutant backlog in #1788: the external source and URL safety helpers.
Adds
tests/cncf-wp-api.test.mjsandtests/git-source.test.mjs, and extends the GitHub pagination, changelog, project-assets and URI-safety tests, so each remaining behavioural mutant inscripts/lib/cncf-wp-api.mjs,github.mjs,changelog.mjs,git-source.mjs,url-safety.mjs,uri-safety.mjsandproject-assets.mjsis distinguished: exact page URLs and query separators,x-wp-totalpagesboundaries,rel="next"parsing and the cross-origin token guard, conventional-commit anchoring and the overflow note boundary, shallow clone andrev-parsearguments, image-syntax parsing in artwork URLs, andremoteTargethost boundaries. Test-only change; no source file is modified.Scoped mutation score for the seven files: 77.48% (437 killed / 47 survived / 80 no coverage) to 97.87% (552 killed / 12 survived / 0 no coverage). Every file is at or above 96.4%.
The 12 survivors left are equivalent: a
'1'to''page default thatNumber()reads as the same stop condition, a fallback Link header that never matchesrel="next",https?tohttpswhereartworkPathalready rejects http, un-anchoring regexes that can only match at index 0, and the path and field of an error list thatisSafeUrldiscards.Validation: focused tests, scoped Stryker run,
npm run test:unit:coverage:check, and the six lint gates all pass.Refs #1788