[scanner] fix: add comprehensive error branch tests for missions/share.go by clubanderson · Pull Request #19222 · kubestellar/console

clubanderson · 2026-06-19T17:52:01Z

Fixes #18759

Adds comprehensive unit tests covering previously untested error branches in missions/share.go:

ShareToSlack error paths:

Empty text field validation
Text exceeding slackMaxTextBytes (10KB cap)
Invalid JSON body parsing

ShareToGitHub error paths:

Body exceeding missionsGitHubShareMaxBytes (413)
Missing required fields (repo, filePath, content, branch)
Path traversal in filePath (security validation)
Invalid branch name
GitHub fork API failure (502)
Fork response missing full_name
Invalid JSON body parsing

validateSlackWebhookURL edge cases:

Userinfo in URL (SSRF bypass vector)
Explicit port specification
Wrong path prefix
Invalid URL parsing

…F validation Adds table-driven tests covering SSRF bypass shapes, allowlist enforcement, and env var parsing: - validateSlackWebhookURL: 20 new test cases for SSRF bypass attempts (prefix attack, port injection, userinfo, scheme variations, host manipulation) - isRepoAllowedForShareWithList: edge cases (empty repo, partial matches, slashes, nil/empty allowlist) - resolveAllowedShareRepos: whitespace handling, env var parsing, single/multiple repos All tests validate error messages for better diagnostics and cover security-critical allowlist logic per #18759. Signed-off-by: hive-scanner <hive-scanner@kubestellar.io>

…e.go Adds tests covering previously untested error paths: - ShareToSlack: empty text, text exceeds max size, invalid body - ShareToGitHub: body too large (413), missing required fields, invalid filePath (path traversal), invalid branch, fork failure, fork missing full_name, invalid JSON body - validateSlackWebhookURL: userinfo bypass, explicit port, wrong path prefix, invalid URL parsing Signed-off-by: Andy Anderson <andy@clubanderson.com>

kubestellar-prow · 2026-06-19T17:52:07Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign eeshaansa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

github-actions · 2026-06-19T17:52:08Z

🐝 Hi @clubanderson! I'm kubestellar-hive[bot], an automation bot for this repo.

Trusted users — org members and contributors with write access — can mention @kubestellar-hive in a comment to trigger repo automation.
On issues, that mention queues an automated fix attempt. On pull requests, it records extra context for existing automation.
This is not an interactive Q&A bot, so mentions should be treated as requests for automation rather than a conversation.

Automation may take a moment to start, and follow-up happens through workflow activity rather than chat replies.

github-actions · 2026-06-19T17:52:09Z

👋 Hey @clubanderson — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

Claude Code (Opus 4.5 / 4.6) — recommended

GitHub Copilot

Cursor

Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

This is an automated message.

netlify · 2026-06-19T17:52:11Z

✅ Deploy Preview for kubestellarconsole ready!

Name	Link
🔨 Latest commit	`4bd2661`
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/6a35870eec39ac0008d0b933
😎 Deploy Preview	https://deploy-preview-19222.console-deploy-preview.kubestellar.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Pull request overview

Adds unit tests to improve coverage for security- and reliability-critical error branches in missions/share.go, particularly around Slack webhook SSRF validation and GitHub share request validation/upstream failure handling.

Changes:

Expands share_test.go with handler-level tests for Slack sharing, allowlist resolution, repo allowlist checks, and Slack webhook URL validation.
Adds share_error_test.go to cover additional ShareToSlack / ShareToGitHub error branches (oversized payloads, missing fields, invalid path/branch, fork failures, invalid JSON).
Adds extra Slack webhook URL edge-case tests intended to catch SSRF bypass shapes.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
pkg/api/handlers/missions/share_test.go	Adds broader handler + validation test coverage, but currently introduces compilation failures and a couple of incorrect expectations.
pkg/api/handlers/missions/share_error_test.go	Adds error-branch tests for Slack/GitHub sharing, but currently doesn’t compile due to missing helper + a duplicate test name.

 import (
-	"os"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
 	"testing"

+	"github.com/gofiber/fiber/v2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )


+	app, _ := setupMissionsTest()
+
+	payload := map[string]string{
+		"webhookUrl": slackMock.URL + "/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXX",
+		"text":       "Test mission shared",
+	}


-	validURL := "https://hooks.slack.com/services/T00/B00/XXX"
-	err := validateSlackWebhookURL(validURL)
-	assert.NoError(t, err)
+func TestMissions_ShareToSlack_Success(t *testing.T) {


+		{"trailing dot in host", "https://hooks.slack.com./services/T00/B00/XXX", true, "host must be hooks.slack.com"},
+		{"percent encoded @", "https://hooks.slack.com%40attacker.evil/services/T00/B00/XXX", true, ""},
+		{"double slash path", "https://hooks.slack.com//services/T00/B00/XXX", false, ""},
+		{"backslash in path", "https://hooks.slack.com/services\\T00\\B00\\XXX", false, ""},
+		{"path without /services/", "https://hooks.slack.com/T00/B00/XXX", true, "path must begin with /services/"},
+		{"empty path", "https://hooks.slack.com", true, "path must begin with /services/"},


+
+// ---------- ShareToSlack error branches ----------
+


+
+// ---------- ShareToSlack error branches ----------
+
+func TestMissions_ShareToSlack_EmptyText(t *testing.T) {


+	assert.Equal(t, 400, resp.StatusCode)
+}
+
+func TestMissions_ShareToSlack_WebhookReturnsError(t *testing.T) {


github-actions · 2026-06-19T18:15:10Z

Thank you for your contribution! Your PR has been merged.

Check out what's new:

KubeStellar Console — Live multi-cluster dashboard
Marketplace — Community extensions
Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

github-actions · 2026-06-19T18:15:55Z

❌ Post-Merge Verification: failed

Commit: afc24daba1c950ba95e5ded092b2a6863941a3ad
Specs run: smoke.spec.ts
Report: https://github.com/kubestellar/console/actions/runs/27841763022

github-actions · 2026-06-19T18:21:46Z

Post-merge build verification passed ✅

Both Go and frontend builds compiled successfully against merge commit afc24daba1c950ba95e5ded092b2a6863941a3ad.

clubanderson added 2 commits June 19, 2026 12:32

Copilot AI review requested due to automatic review settings June 19, 2026 17:52

kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Jun 19, 2026

kubestellar-prow Bot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Jun 19, 2026

github-actions Bot added the tier/1-lightweight label Jun 19, 2026

Copilot started reviewing on behalf of clubanderson June 19, 2026 17:52 View session

Copilot AI reviewed Jun 19, 2026

View reviewed changes

Merge branch 'main' into scanner/fix-18759

4bd2661

clubanderson merged commit afc24da into main Jun 19, 2026
22 of 29 checks passed

kubestellar-prow Bot deleted the scanner/fix-18759 branch June 19, 2026 18:15

github-actions Bot mentioned this pull request Jun 19, 2026

[quality] missions/share.go coverage at 0% — security-critical SSRF validation and allowlist untested #18759

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[scanner] fix: add comprehensive error branch tests for missions/share.go#19222

[scanner] fix: add comprehensive error branch tests for missions/share.go#19222
clubanderson merged 3 commits into
mainfrom
scanner/fix-18759

clubanderson commented Jun 19, 2026

Uh oh!

kubestellar-prow Bot commented Jun 19, 2026

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

netlify Bot commented Jun 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		// ---------- ShareToSlack error branches ----------

		func TestMissions_ShareToSlack_EmptyText(t *testing.T) {

Uh oh!

Conversation

clubanderson commented Jun 19, 2026

Uh oh!

kubestellar-prow Bot commented Jun 19, 2026

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

netlify Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kubestellarconsole ready!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

github-actions Bot commented Jun 19, 2026

❌ Post-Merge Verification: failed

Uh oh!

github-actions Bot commented Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify Bot commented Jun 19, 2026 •

edited

Loading