Skip to content

feat: Add upload url validation before making requests#120

Open
calvin-codecov wants to merge 2 commits intomainfrom
cy/validate_none_service
Open

feat: Add upload url validation before making requests#120
calvin-codecov wants to merge 2 commits intomainfrom
cy/validate_none_service

Conversation

@calvin-codecov
Copy link
Copy Markdown
Contributor

@calvin-codecov calvin-codecov commented Apr 9, 2026

Closes https://github.com/codecov/core-engineering/issues/52

  • Adds validation for service url part of create_commit, empty_upload, send_create_report, send_reports_result, send_reports_result_get, upload_completion requests

Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 2fe07af. Configure here.

Comment thread codecov-cli/codecov_cli/services/report/__init__.py Outdated
Copy link
Copy Markdown
Collaborator

@thomasrockhu-codecov thomasrockhu-codecov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I'm a little removed with what we actually require to validate, and I'd probably back off mostly to just the service instead of doing slug also. Just my 2 cents to perhaps prevent an issue downstream


upload_url = enterprise_url or CODECOV_INGEST_URL
url = f"{upload_url}/upload/{service}/{slug}/commits"
service_part = (service or "").strip()
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would service ever be empty? rather, is the "" necessary

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

service is typed as Optional string. If a CI adapter doesn't return anything for it as a fallback or if the user doesn't provide through the arguments, it will be none

upload_url: str,
service: str,
slug: typing.Optional[str],
default_base_url_for_error: str = CODECOV_INGEST_URL,
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure we need this param

f"Invalid Codecov base URL {upload_url!r}. Use an absolute http(s) URL with a host "
f"(default: {default_base_url_for_error})."
)
if not slug or not str(slug).strip():
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know if slug is always given to us. This isn't a sure thing, I'd double-check. Perhaps we get the slug after decoding the token

f"Pass --git-service with one of: {allowed}"
)
if service not in _CODECOV_UPLOAD_SERVICES:
allowed = ", ".join(sorted(_CODECOV_UPLOAD_SERVICES))
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure we need to create allowed at this level, can probably just go above the if not service: line

@calvin-codecov calvin-codecov force-pushed the cy/validate_none_service branch from 1033ba9 to 0c43195 Compare April 14, 2026 21:37
Comment thread codecov-cli/codecov_cli/services/commit/__init__.py
Copy link
Copy Markdown
Collaborator

@thomasrockhu-codecov thomasrockhu-codecov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make sure to test this locally first

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants