(magpie) branch perf/security-4b-sync updated: fix(security-issue-sync): match the CVE-tool host with a pattern in the guardrail check

[po...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch perf/security-4b-sync
in repository https://gitbox.apache.org/repos/asf/magpie.git


The following commit(s) were added to refs/heads/perf/security-4b-sync by this push:
     new 30d9dfc0 fix(security-issue-sync): match the CVE-tool host with a pattern in the guardrail check
30d9dfc0 is described below

commit 30d9dfc0cb359e0b3e63eeb8f99c6611f6149649
Author: Jarek Potiuk <po...@apache.org>
AuthorDate: Mon Oct 19 17:12:27 2026 +0200

    fix(security-issue-sync): match the CVE-tool host with a pattern in the guardrail check
    
    CodeQL read `"cveprocess.apache.org" in sentence` as an incomplete URL
    substring sanitization (py/incomplete-url-substring-sanitization). The
    check scans proposal text for the CVE-tool URL in a reporter email; it
    sanitises nothing. A host-anchored pattern says so and keeps the same
    cases flagged.
    
    Generated-by: Claude Opus 5
---
 .../security-management/src/security_management/issue_sync/render.py  | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/security-management/src/security_management/issue_sync/render.py b/tools/security-management/src/security_management/issue_sync/render.py
index 357d540a..e8aad6cc 100644
--- a/tools/security-management/src/security_management/issue_sync/render.py
+++ b/tools/security-management/src/security_management/issue_sync/render.py
@@ -62,6 +62,8 @@ _CROSS = re.compile(
     r"also reported against|cross-project|other apache projects|sister project|the same finder also",
     re.IGNORECASE,
 )
+# The CVE-tool host as a URL host, not a substring check: this scans text, it sanitises nothing.
+_CVE_TOOL_URL = re.compile(r"(?:https?://)?(?<![\w.-])cveprocess\.apache\.org(?![\w-])", re.IGNORECASE)
 _BREAK = re.compile(r"(?<=[.!?])\s+")
 
 
@@ -93,7 +95,7 @@ def check(data: Mapping[str, Any]) -> dict[str, Any]:
             if other.search(sentence) or _CROSS.search(sentence):
                 found.append(OTHER_ASF)
             if kind == "email":
-                if "cveprocess.apache.org" in sentence:
+                if _CVE_TOOL_URL.search(sentence):
                     found.append(LINK_CVE)
             elif kind in MARKDOWN:
                 if _bare_cves(sentence):