Repository navigation
Resolve each relative filename against the source root that has it - #74
Conversation
coverage.py with several `source` roots names each file relative to the root that contains it. DotCov prefixed every relative name with the first root, so in a report with src/ and tests/ roots every test file got a wrong path, and the multi-root warning fired for every such report. With two or more roots, a relative filename now resolves against the one root under which the file exists on disk. When it exists under none (a report read away from its sources) or under several, the first root applies and the report-scoped warning is raised, as before. Single-root and root-less reports are unchanged. On python-sdk's coverage.py report (three roots, 414 files), 413 files now resolve to their real paths; the remaining one, __init__.py, exists under two roots and keeps the warning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 89dc9bc5b5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| string? match = null; | ||
| foreach (var root in document.SourceRoots) | ||
| { | ||
| if (!File.Exists(JoinRoot(root, filename))) continue; |
There was a problem hiding this comment.
On Windows, a Cobertura document with multiple roots can supply \\host\share (normalized to //host/share) and a relative class filename, causing both Parse and ParseAsync to call File.Exists on an attacker-controlled UNC path. This can initiate outbound SMB access, potentially use ambient authentication, and stall parsing while the network request times out; cancellation cannot interrupt the synchronous probe. Avoid probing network roots by default, or require an explicitly trusted/caller-provided source resolver.
Useful? React with 👍 / 👎.
itsdangerous names tests as a second source root, and every measured file exists under exactly one of the two, so DotCov now attributes each file without the warning. The per-file comparison against coverage.py's native JSON still proves the attribution. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins. |
Set 2.0.0 as the package version, the badge action's default and the README's action snippet and release-notes link, and add docs/releases/2.0.0.md. The major version marks that the same report can now count differently: istanbul line totals and coverage.py multi-root paths (#74, #76). The README's migration section now covers 1.x and points 0.x users to the 1.0 notes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Resolve each relative filename against the
<source>root that contains it, instead of always the first one.Problem
coverage.py with several
sourceroots writes each file name relative to the root that contains it. DotCov prefixed every relative name with the first root. On python-sdk's report (rootssrc,src/mcp-types/mcp_types,tests), every test file and everymcp_typesfile got a wrong path, and every multi-root report carried the warning.What changed
FileIdentityAmbiguouswarning is raised, with the same text as before.Verification
fallout Test: 1390 passed.fallout Coverage: line 100.0%, branch 100.0%.__init__.py, exists under two roots and keeps the warning.🤖 Generated with Claude Code