Conversation
…ut and update response logging for clarity
…iff logging and clarifying response message
…nds after autofix, enhance bugbot context loading, and improve documentation for bugbot autofix functionality.
…intent detection and execution flow, enhance logging for better debugging, and streamline payload handling in issue comment processing.
…ection in issue comment processing to improve debugging and traceability.
|
To view this pull requests documentation preview, visit the following URL: Documentation is deployed and generated using docs.page. |
vypbot
added
size: XXL
✨ Feature Actions
🚀 Happy coding! |
…tracting payload functions into a separate module, enhancing code organization and maintainability in issue comment processing.
…ination for fetching changed files, improving performance and reliability in handling large pull requests.
src/usecase/steps/commit/bugbot/build_bugbot_fix_intent_prompt.ts
Outdated
Show resolved
Hide resolved
src/usecase/steps/commit/bugbot/load_bugbot_context_use_case.ts
Outdated
Show resolved
Hide resolved
…PullRequest class to streamline access to review comment data, enhancing code clarity and maintainability across multiple files.
…rove handling of trailing backslashes during truncation. Update tests to cover various scenarios of truncation and backslash management, ensuring correct behavior and preventing escape sequence issues.
…th sanitization for prompt safety in Bugbot prompts. Introduce helper functions to ensure proper formatting and escaping of special characters, enhancing robustness. Update tests to verify sanitization and truncation behavior for findings.
…y and ThinkUseCase by introducing a utility function for escaping special characters. Update related logic to ensure safe processing of user input and improve regex pattern matching. Add tests to verify correct behavior when handling special characters in user mentions and version extraction.
…utility functions, along with associated tests, to streamline the codebase. Update constants and logger by removing deprecated code. This cleanup enhances maintainability and reduces complexity.
…unctions across CLI and GitHub Action modules to streamline the codebase. This includes the elimination of the FileRepository class and related methods, enhancing maintainability and reducing complexity. Update logger and title utilities to reflect these changes.
| /** | ||
| * Returns true if there are uncommitted changes (working tree or index). | ||
| */ | ||
| async function hasChanges(): Promise<boolean> { |
There was a problem hiding this comment.
Duplicate hasChanges function remains
Severity: low
Location: src/usecase/steps/commit/bugbot/bugbot_autofix_commit.ts:163
The hasChanges() function at lines 163-165 is a duplicate that simply calls hasUncommittedChanges(). This unnecessary wrapper adds maintenance burden and confusion. It is called at line 213 and 289.
Suggested fix:
Remove the hasChanges() function and update all callers to use hasUncommittedChanges() directly.
…rage settings and modify CI workflow to run tests with coverage and upload results to Codecov. Adjust status types in branch_repository.d.ts for clarity.
Welcome to Codecov 🎉Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests. Thanks for integrating Codecov - We've got you covered ☂️ |
| /** | ||
| * Returns true if there are uncommitted changes (working tree or index). | ||
| */ | ||
| async function hasChanges(): Promise<boolean> { |
There was a problem hiding this comment.
Redundant hasChanges wrapper function
Severity: low
Location: src/usecase/steps/commit/bugbot/bugbot_autofix_commit.ts:163
The hasChanges() function at lines 163-165 is a redundant wrapper that simply calls hasUncommittedChanges(). This adds unnecessary code complexity and maintenance burden. The function is used at lines 213 and 289.
Suggested fix:
Remove the hasChanges() wrapper function and update all callers to use hasUncommittedChanges() directly.
…ndling and commit notifications. Add tests for branch selection logic based on configuration, improve logging for skipped actions, and ensure proper handling of commit prefixes. Update existing tests to cover new scenarios and edge cases, enhancing overall robustness.
…s by adding scenarios for handling resolved findings, verifying command execution, and managing issue and pull request numbers. Update existing tests to improve robustness and ensure proper logging for various edge cases. Additionally, refine type definitions in branch_repository.d.ts for clarity.
… prevent auto-running during tests by checking for JEST_WORKER_ID. Update branch_repository.d.ts for clarity in status type definitions. Ensure proper CLI argument parsing only when not in test environment.
…logic to prevent auto-running during tests by checking for JEST_WORKER_ID. Export program instance in CLI modules for better accessibility. Enhance test coverage by adding scenarios for error handling and command execution, ensuring robust logging and proper management of exit codes. Update type definitions for clarity in CLI and GitHub Action modules.
…rios for handling non-git repository errors and validating issue number inputs. Introduce JSON output verification for the CLI command. Update common action tests to handle non-Error exceptions gracefully. This improves robustness and error handling in the CLI and action execution logic.
…nfig to exclude test files. Remove obsolete test type definitions across CLI and GitHub Action modules, enhancing code clarity and maintainability. Update branch_repository.d.ts to clarify status type definitions.
✨ Feature Actions
🚀 Happy coding! |
| const unresolvedIds = unresolvedWithBody.map((p) => p.id); | ||
| const unresolvedFindings: UnresolvedFindingSummary[] = unresolvedWithBody.map((p) => ({ | ||
| id: p.id, | ||
| title: extractTitleFromBody(p.fullBody) || p.id, |
There was a problem hiding this comment.
ReDoS vulnerability when extracting title from untrusted PR comments
Severity: medium
Location: src/usecase/steps/commit/bugbot/detect_bugbot_fix_intent_use_case.ts:92
In detect_bugbot_fix_intent_use_case.ts lines 92-93, extractTitleFromBody is called on p.fullBody which contains untrusted issue/PR comment data from external users. The extractTitleFromBody function uses regex /^##\s+(.+)$/m without any input length limits, making it vulnerable to ReDoS attacks with malicious input containing many newlines and hash characters.
Suggested fix:
Add input length validation before calling extractTitleFromBody, or truncate the fullBody to a reasonable limit (e.g., 4000 chars) before extracting the title.
3 participants
Based on the PR template, branch diff, issue description, and documentation, here is the filled PR description:
📌 Summary
This PR introduces the Bugbot Autofix feature, allowing users to request fixes for detected vulnerabilities directly from issue comments or pull request review comments. Users can simply say "fix it", "fix them", or reference specific findings, and OpenCode will interpret the request, apply fixes in its workspace, run verification commands (build/test/lint), and automatically commit and push the changes. This significantly speeds up the resolution of security vulnerabilities and code quality issues by enabling direct interaction with Bugbot findings.
The feature also introduces Do User Request functionality for generic code changes (e.g., "add a test", "refactor this") that are not tied to specific Bugbot findings.
🎯 Related Issues / Tickets
🧩 Scope of Changes
Added:
bugbot-fix-verify-commandsUpdated:
contents: writepermission for commit/push operations🛠️ Technical Details
ProjectRepository.isActorAllowedToModifyFiles(). For organization-owned repos, the actor must be an org member; for user-owned repos, the actor must be the owner.<!-- copilot-bugbot finding_id:"..." resolved:true|false -->) embedded in issue/PR comments to track which findings are open vs resolved.getHeadBranchForIssue).npm run build, npm test) are executed to ensure changes don't break the build before committing.git add -A, commits with a message likefix(#N): bugbot autofix - resolve finding-1, finding-2, and pushes to the remote.🔍 How to Test
contents: writepermission andbugbot-fix-verify-commandsis configured.🧪 Test Coverage
Test files added/updated:
detect_bugbot_fix_intent_use_case.test.ts- Intent detection flowbugbot_autofix_use_case.test.ts- Autofix application flowbugbot_autofix_commit.test.ts- Git commit/push operationsuser_request_use_case.test.ts- Do user request flowissue_comment_use_case.test.ts- Full issue comment flowpull_request_review_comment_use_case.test.ts- Full PR comment flowproject_repository.test.ts- Permission checks🚀 Deployment Notes
Details:
issue_commentandpull_request_review_commentevents must includepermissions: contents: writeto allow the action to commit and push autofix changes.bugbot-fix-verify-commandsshould be configured via repository variables (e.g.,BUGBOT_AUTOFIX_VERIFY_COMMANDS) to specify build/test/lint commands to run after fixes.🔒 Security Considerations
Details:
..) and absolute paths.📈 Performance Impact
Details:
📝 Notes for Reviewers
docs/bugbot/covering detection, autofix, do-user-request, configuration, and examples.✅ Checklist
📚 Additional Context
docs/bugbot/for detailed guides on detection, autofix, and do-user-request flows.docs/plan-bugbot-autofix.mdcontains the full implementation plan and architecture details..cursor/rules/bugbot.mdcand.cursor/rules/usecase-flows.mdcwith technical reference for developers.