Fix Gunicorn thread-pool worker mutation bypass in config scanner

[cursor]

Security fix (High)

Issue: #252

Location: config.py

Impact: A gunicorn.conf.py that leaves workers = 1 for static analysis but mutates workers at import time via ThreadPoolExecutor.submit(...).result() or multiprocessing.pool.ThreadPool.map(...) could start multiple Gunicorn workers while the panel keeps memory:// rate limiting and per-worker sessions, multiplying login brute-force throughput and weakening logout/session guarantees.

Remediation: Treat import-time ThreadPool.map and submit(...).result() callbacks that mutate workers like existing threading.Thread.start() detection in the Gunicorn config AST scanner. Regression cases added in tests/test_gunicorn_indirect_workers_bypass.py.

Closes #252.

  

---

Note

High Risk
Changes security-sensitive static analysis of Gunicorn worker counts; incorrect detection could leave session/rate-limit assumptions wrong when extra workers run.

Overview
Closes a static-analysis bypass where gunicorn.conf.py could mutate workers at import time through ThreadPool.map or ThreadPoolExecutor.submit without being flagged as dynamic.

The Gunicorn config AST pipeline now tracks ThreadPool / ThreadPoolExecutor imports (including aliases and module-qualified calls), binds pool instances from assignments and with blocks, and treats map, submit, and mutating initializer callbacks like existing eager consumers of risky lazy iterators. _call_consumes_mutating_lazy_iterator is refactored into smaller helpers and extended with these thread-pool cases; new binding slots are wired into operator_bindings before import-time mutation checks.

Regression coverage adds direct pool examples to the dynamic bypass suite plus a dedicated parametrized test for aliases, saved receivers, named callbacks, nested risky iterables, initializers, and a negative case for a custom submit stub.

^{Reviewed by Cursor Bugbot for commit a6fb45c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 66d6d67a-1a4c-49b5-a816-93f7045eab91

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_e17554ff-aa6a-4359-b56b-5e3590251ff3)

[AlexanderWagnerDev]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a75b47a6ba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_1fc46923-d1a9-4086-8719-92e87dcbd0d9)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ce6dcf35-e25f-497b-8e71-fb989304f5b0)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_6a862271-3aa6-40b3-8083-b4ccea0fb8d2)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_24fd24ad-8fd3-4233-8a76-5cc8e152773b)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud