[agent] cleanup: Fix proxy security and testing monkeypatch support - #374
[agent] cleanup: Fix proxy security and testing monkeypatch support#374google-labs-jules[bot] wants to merge 2 commits into
Conversation
…tMiddleware tests Refactored `extract_client_ip_from_forwarded` to evaluate `TRUSTED_PROXY_COUNT` dynamically at runtime rather than as a default function argument at import time, preventing issues where tests could not successfully `monkeypatch` the module global. Additionally, corrected the trusted proxy check to allow `trusted_proxy_count >= 0` rather than `> 0`, so direct proxy simulations (where `TRUSTED_PROXY_COUNT=0` but X-Forwarded-For headers are present) resolve to the rightmost IP instead of falling through to the highly vulnerable leftmost spoofable IP. Updated multiple `test_proxy_security.py` tests to properly apply `monkeypatch` on the module to control test states accurately. Tests were updated and assert successful operation of the middleware.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Merging to
After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here |
Reviewer's GuideFixes client IP extraction logic in agent security to handle a trusted proxy count of zero correctly and makes the function easier to monkeypatch, while updating proxy-related tests to use pytest’s monkeypatch fixture and align expectations with the corrected behavior. Flow diagram for updated extract_client_ip_from_forwarded proxy count handlingflowchart TD
A["Call extract_client_ip_from_forwarded"] --> B{trusted_proxy_count is None}
B -->|Yes| C["Set trusted_proxy_count = TRUSTED_PROXY_COUNT"]
B -->|No| D["Use provided trusted_proxy_count"]
C --> E["Parse forwarded into ips list"]
D --> E
E --> F{trusted_proxy_count >= 0}
F -->|No| G["Fallback: return fallback_ip"]
F -->|Yes| H["Compute idx = -(trusted_proxy_count + 1)"]
H --> I{"abs(idx) <= len(ips)"}
I -->|Yes| J["Return ips[idx] (supports trusted_proxy_count = 0)"]
I -->|No| G
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- In
extract_client_ip_from_forwarded, consider explicitly validating thattrusted_proxy_countis non-negative (or documenting behavior for negative values) before using it, so misconfigurations don't silently change IP extraction behavior. - In
test_rate_limiter_proxy_logic, the assertion changed to expect"127.0.0.1"but the preceding comment still refers to sanitizing invalid IPs to"unknown"; update the comment to match the current behavior to avoid confusion.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In `extract_client_ip_from_forwarded`, consider explicitly validating that `trusted_proxy_count` is non-negative (or documenting behavior for negative values) before using it, so misconfigurations don't silently change IP extraction behavior.
- In `test_rate_limiter_proxy_logic`, the assertion changed to expect `"127.0.0.1"` but the preceding comment still refers to sanitizing invalid IPs to `"unknown"`; update the comment to match the current behavior to avoid confusion.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
Jules Session Analysis: This PR has merge conflicts. Recommended fix: |
I have successfully merged |
…tMiddleware tests Refactored `extract_client_ip_from_forwarded` to evaluate `TRUSTED_PROXY_COUNT` dynamically at runtime rather than as a default function argument at import time, preventing issues where tests could not successfully `monkeypatch` the module global. Additionally, corrected the trusted proxy check to allow `trusted_proxy_count >= 0` rather than `> 0`, so direct proxy simulations (where `TRUSTED_PROXY_COUNT=0` but X-Forwarded-For headers are present) resolve to the rightmost IP instead of falling through to the highly vulnerable leftmost spoofable IP. Updated multiple `test_proxy_security.py` tests to properly apply `monkeypatch` on the module to control test states accurately. Resolved upstream merge conflicts and re-verified all tests pass.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
1 participant
Agent Report Summary
backend/src/agent/security.pyto fix IP extraction proxy count boundary logic and fix the function's default parameters for mocking. Modifies multiple tests acrosstest_api_security.py,test_rate_limiter_proxy.py, andtest_proxy_security.pyto usemonkeypatchsafely.Scan Results
Verification
cd backend && uv run pytest tests/Risk Assessment
Machine Metadata
PR created automatically by Jules for task 13424727956599722460 started by @MasumRab
Summary by Sourcery
Adjust proxy client IP extraction logic and align rate limiting behavior with trusted proxy configuration, updating tests to safely override proxy settings via pytest monkeypatch.
Bug Fixes:
Tests: