fix: bug fixes, security headers, and resilience improvements - #2
Merged
Conversation
Bug fixes: - web_security: guard int() parse of rate-limit env var with try/except, fallback to 60 - web: extend scan_id from 12 to 20 hex chars (less collision-prone) - web: remove hardcoded CORS origins; make them dynamic from configured host/port - web: add comment explaining why background task re-validates inputs - cli: reject --port values outside 1-65535 before starting the web server - cli: call _validate_flags() before _run_plan to catch conflicting flag pairs - cache_manager: fix misleading docstring (uses path+size+mtime, not file content) - scanner: document that max_files is intentionally not enforced in scan_project Security improvements: - web: add HTTP security-headers middleware (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy) - web: import Response so middleware type annotation is correct Tests: - test_web_rate_limit: add test for non-integer env var falling back to default - test_security_hardening: add test for security headers on /api/health - test_security_hardening: add test that CORS reflects configured port - test_cli_plan: add test for invalid port rejection - test_cli_plan: add test that _validate_flags is respected before --plan Agent-Logs-Url: https://github.com/canblmz1/Project-Prompt-Generator/sessions/f1dcb32b-a53f-40c7-9d47-673a5fc64b72 Co-authored-by: canblmz1 <116688414+canblmz1@users.noreply.github.com>
…-XSS-Protection header Agent-Logs-Url: https://github.com/canblmz1/Project-Prompt-Generator/sessions/f1dcb32b-a53f-40c7-9d47-673a5fc64b72 Co-authored-by: canblmz1 <116688414+canblmz1@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
canblmz1
May 9, 2026 15:28
View session
canblmz1
marked this pull request as ready for review
May 10, 2026 12:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Özet / Summary
Kodun baştan sona incelemesiyle bulunan hatalar düzeltildi, güvenlik iyileştirmeleri yapıldı ve yeni testler eklendi. Merge işlemi sana düşüyor.
Bug Fixes
web_security.pyint(raw_limit)geçersiz env var'da crash → sunucu düşüyortry/except+ varsayılan 60'a fallbackweb.pyscan_id12 karakter (çarpışma riski)web.pylocalhost:8787'ye hardcodedhost:port'a göre dinamik hale getirildicli.py--portaralığı doğrulanmıyor (0 veya 99999 kabul ediliyordu)cli.py--plankullanıldığında_validate_flags()çağrılmıyorducache_manager.pyscanner.pymax_filesparametresi fonksiyon içinde hiç kullanılmıyorSecurity Improvements
X-Content-Type-Options: nosniffX-Frame-Options: DENYReferrer-Policy: strict-origin-when-cross-originNew Tests
/api/healthyanıtında güvenlik başlıkları doğrulanıyor--planöncesi çakışan flagler yakalanıyorTest Results