Harden console Slack webhook config#76
Conversation
The console app still committed a Slack incoming webhook while related common-app credential hardening is already covered by separate open PRs. This keeps the fix limited to console config, documents the runtime variables, and adds a static guard for regression checks. Constraint: Bounty scope needs to avoid overlapping existing S3, service-token, Cloudinary, and third-party credential PRs Rejected: Touch common/config/main.php | already covered by open third-party credential PRs Confidence: medium Scope-risk: narrow Directive: Keep this PR scoped to console Slack config unless the existing broader third-party credential PR is closed without merge Tested: python scripts/check-console-slack-hardening.py; python -m py_compile scripts/check-console-slack-hardening.py; git diff --check Not-tested: php -l console/config/main.php because php is not installed locally
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR secures Slack webhook configuration by moving from hardcoded values in code to environment variables. The console configuration reads from ChangesSlack Webhook Security Hardening
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
scripts/check-console-slack-hardening.py (1)
22-23: ⚡ Quick winUse a whitespace-tolerant pattern for Slack URL wiring check.
Line 22 currently depends on an exact PHP formatting string, so benign style changes can fail the guard. Prefer a regex that matches
'url' => $consoleSlackWebhookUrlwith flexible spacing/quotes.Proposed diff
from pathlib import Path +import re @@ - if "'url' => $consoleSlackWebhookUrl" not in text: + if not re.search(r"['\"]url['\"]\s*=>\s*\$consoleSlackWebhookUrl\b", text): failures.append("console/config/main.php does not wire the Slack client URL through the env-backed value")🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/check-console-slack-hardening.py` around lines 22 - 23, The current check in check-console-slack-hardening.py looks for the exact literal "'url' => $consoleSlackWebhookUrl" which is brittle; replace that equality check with a regex search that tolerates flexible spacing and either single or double quotes around the key and arrow (e.g. pattern like r"""['"]url['"]\s*=>\s*\$consoleSlackWebhookUrl"""), compile with re.IGNORECASE if desired, and use re.search(text) instead of the string containment test so the failures.append branch only triggers when the pattern is truly absent.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@scripts/check-console-slack-hardening.py`:
- Around line 22-23: The current check in check-console-slack-hardening.py looks
for the exact literal "'url' => $consoleSlackWebhookUrl" which is brittle;
replace that equality check with a regex search that tolerates flexible spacing
and either single or double quotes around the key and arrow (e.g. pattern like
r"""['"]url['"]\s*=>\s*\$consoleSlackWebhookUrl"""), compile with re.IGNORECASE
if desired, and use re.search(text) instead of the string containment test so
the failures.append branch only triggers when the pattern is truly absent.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7d391e70-20ea-4e22-ad17-e80c103193fd
📒 Files selected for processing (3)
console/config/main.phpdocs/console-slack-env.mdscripts/check-console-slack-hardening.py
CodeRabbit flagged docstring coverage on the small regression checker. Adding module and function docstrings keeps the PR quality signal clean without changing behavior. Constraint: Keep the update limited to the checker script Confidence: high Scope-risk: narrow Tested: python scripts/check-console-slack-hardening.py; python -m py_compile scripts/check-console-slack-hardening.py; git diff --check
CodeRabbit noted that the checker depended on exact PHP spacing. Switching the URL wiring check to a small regex keeps the guard focused on behavior instead of formatting. Constraint: Preserve the existing checker scope and avoid changing runtime PHP behavior Confidence: high Scope-risk: narrow Tested: python scripts/check-console-slack-hardening.py; python -m py_compile scripts/check-console-slack-hardening.py; git diff --check
|
Follow-up on the CodeRabbit nit: the Slack URL wiring guard is already regex-based in Fresh verification:
|
1 participant
/claim #55
Scope
This is a small, separate console Slack webhook hardening slice.
It does not touch the existing common app Slack config or the already-open third-party credential hardening PR. The change is limited to the console app configuration and keeps the shared
SLACK_WEBHOOK_URLas a fallback for deployments that use one Slack webhook across app surfaces.Changes:
console/config/main.php.CONSOLE_SLACK_WEBHOOK_URLfirst, then falls back toSLACK_WEBHOOK_URL.docs/console-slack-env.mdfor the runtime variables.scripts/check-console-slack-hardening.pyto prevent reintroducing a checked-in console Slack webhook.Safety Boundary
No live Slack workspace, AWS/IAM, candidate data, production services, or private account data were accessed. This PR only changes checked-in config wiring, documentation, and a static regression check. It does not include secret values.
Demo
Privacy-safe demo video: https://github.com/firstedition0123/studenthub/releases/download/console-slack-demo-20260515/studenthub-console-slack-demo.mp4
Verification
python scripts/check-console-slack-hardening.py # Console Slack webhook hardening check passed. python -m py_compile scripts/check-console-slack-hardening.py git diff --checkTargeted search of
console/config/main.phpconfirmed that the checked-in Slack webhook URL pattern is no longer present.PHP lint was not run locally because the
phpexecutable is not installed in this environment. The PHP change is limited to assigning an env-backed value before the existing config array and wiring that value into the Slack client URL.