[I] Tracking: script-router execution timeout hardening, CODEOWNERS activation, and test-coverage gaps [dubbo-go]

["AlexStocks (via GitHub)" <gi...@apache.org>]

AlexStocks opened a new issue, #3566:
URL: https://github.com/apache/dubbo-go/issues/3566

   ## Motivation
   
   During a code-quality audit of this repo (driven by `CODE_REVIEW_GUIDE.md` v1.0 and
   `security-review-2026-07-30.md`), several gaps between the documented process and the
   actual code/process were found. This issue tracks them as actionable items so they can be
   driven one by one.
   
   ## Items
   
   ### 1. 🔴 Script router DoS — missing execution timeout (Blocker)
   - **Location**: `cluster/router/script/instance/js_instance.go`.
     `runScript()` executes `j.rt.RunProgram(pg)` without any interrupt deadline, and
     `initCallArgs()` only calls `j.rt.ClearInterrupt()` (which clears an existing interrupt
     but never sets one).
   - **Risk**: a script that loops forever (e.g. `while (true) {}`) blocks the handling
     goroutine indefinitely → denial of service. (Ref: `CODE_REVIEW_GUIDE.md` §4.2.2)
   - **Fix direction**: wrap `RunProgram` with `time.AfterFunc` that calls
     `j.rt.Interrupt(...)`, plus `defer timer.Stop()`. A `-race` test should guard it.
   
   ### 2. 🟡 CODEOWNERS are placeholder handles
   - `CODEOWNERS` uses virtual handles (`@dubbo-go/cluster-maintainers`, etc.) that do not
     resolve, so GitHub never routes review requests. Replace them with real teams/committers
     so PR review assignment actually works (the exact risk warned in `CODE_REVIEW_GUIDE.md` §1).
   
   ### 3. 🟡 Test-coverage gaps in high-risk concurrent modules
   - `global/` 25 source files → 1 test file; `common/` 55 → 11; `cluster/` 95 → 28.
     These are concurrency-heavy modules. Add core-path and `-race` tests, and consider a
     codecov floor to stop the gaps from widening.
   
   ## Plan
   - [ ] Fix script-router execution timeout + add `-race` test (PR)
   - [ ] Replace CODEOWNERS placeholders with real owners
   - [ ] Add tests for `global/` and `common/` core paths + `-race`
   - [ ] (Optional) Recurring review-clinic using real PRs as teaching material
   
   Will drive these item-by-item and link the PRs back here.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org