From e2d4266756c159a173c0ebaec6d4b97097b422c8 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 09:37:07 +0000 Subject: [PATCH 1/2] Fix argument injection vulnerability in get_pr_status Co-authored-by: sheepdestroyer <1377479+sheepdestroyer@users.noreply.github.com> --- scripts/get_pr_status.py | 5 ++++- tests/test_get_pr_status.py | 7 +++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/scripts/get_pr_status.py b/scripts/get_pr_status.py index 5c131d70..1c9da288 100644 --- a/scripts/get_pr_status.py +++ b/scripts/get_pr_status.py @@ -16,7 +16,10 @@ def get_pr_status(pr_id: str = "") -> None: """Fetches and prints the status of a PR using gh CLI.""" cmd = ["gh", "pr", "view"] if pr_id: - cmd.append(pr_id) + if not str(pr_id).isdigit(): + print("Error: Invalid PR ID format. Must be numeric.", file=sys.stderr) + sys.exit(1) + cmd.append(str(pr_id)) cmd.extend(["--json", "state,reviewDecision,statusCheckRollup"]) try: diff --git a/tests/test_get_pr_status.py b/tests/test_get_pr_status.py index f5fcbf55..64efd6de 100644 --- a/tests/test_get_pr_status.py +++ b/tests/test_get_pr_status.py @@ -99,3 +99,10 @@ def test_get_pr_status_null_checks(mock_run_cmd, capsys): assert "PR Status: OPEN" in captured.out assert "Review Decision: REVIEW_REQUIRED" in captured.out assert "Checks: 0/0 passed" in captured.out + +def test_get_pr_status_invalid_pr_id(capsys): + with pytest.raises(SystemExit) as e: + get_pr_status("invalid_id") + assert e.value.code == 1 + captured = capsys.readouterr() + assert "Error: Invalid PR ID format. Must be numeric." in captured.err From fa2f08107d9eca8b731a8ff1931f4cc858b39bba Mon Sep 17 00:00:00 2001 From: boy Date: Fri, 24 Jul 2026 12:39:43 +0200 Subject: [PATCH 2/2] refactor(scripts): normalize PR ID input and add unit test cases --- scripts/get_pr_status.py | 10 ++++++---- tests/test_get_pr_status.py | 15 +++++++++++++++ 2 files changed, 21 insertions(+), 4 deletions(-) diff --git a/scripts/get_pr_status.py b/scripts/get_pr_status.py index 1c9da288..444ab3ce 100644 --- a/scripts/get_pr_status.py +++ b/scripts/get_pr_status.py @@ -16,10 +16,12 @@ def get_pr_status(pr_id: str = "") -> None: """Fetches and prints the status of a PR using gh CLI.""" cmd = ["gh", "pr", "view"] if pr_id: - if not str(pr_id).isdigit(): - print("Error: Invalid PR ID format. Must be numeric.", file=sys.stderr) - sys.exit(1) - cmd.append(str(pr_id)) + pr_str = str(pr_id).strip() + if pr_str: + if not pr_str.isdigit(): + print("Error: Invalid PR ID format. Must be numeric.", file=sys.stderr) + sys.exit(1) + cmd.append(pr_str) cmd.extend(["--json", "state,reviewDecision,statusCheckRollup"]) try: diff --git a/tests/test_get_pr_status.py b/tests/test_get_pr_status.py index 64efd6de..2ceb087d 100644 --- a/tests/test_get_pr_status.py +++ b/tests/test_get_pr_status.py @@ -106,3 +106,18 @@ def test_get_pr_status_invalid_pr_id(capsys): assert e.value.code == 1 captured = capsys.readouterr() assert "Error: Invalid PR ID format. Must be numeric." in captured.err + +@patch("scripts.get_pr_status.run_cmd") +def test_get_pr_status_numeric_int_and_padded_string(mock_run_cmd, capsys): + mock_data = { + "state": "OPEN", + "reviewDecision": "APPROVED", + "statusCheckRollup": [] + } + mock_run_cmd.return_value = json.dumps(mock_data) + + get_pr_status(123) + mock_run_cmd.assert_called_with(["gh", "pr", "view", "123", "--json", "state,reviewDecision,statusCheckRollup"]) + + get_pr_status(" 456 ") + mock_run_cmd.assert_called_with(["gh", "pr", "view", "456", "--json", "state,reviewDecision,statusCheckRollup"])