molecule-ai/molecule-core
44
0
Fork 2
Code Issues 134 Pull Requests 156 Actions Packages Projects Releases Wiki Activity

fix(handlers): add rows.Err() checks in channels.go + remove duplicate EncryptSensitiveFields (CWE-312) #1221

Open
core-be wants to merge 3 commits from fix/channels-rows-err-and-cwe312 into staging
pull from: fix/channels-rows-err-and-cwe312
merge into: molecule-ai:staging
Conversation 17 Commits 3 Files Changed 2
+55 -9

3 Commits

Author SHA1 Message Date
core-be 7533265b99 fix(handlers): add rows.Err() checks in channels.go List() and Webhook()
CI / Shellcheck (E2E scripts) (pull_request) Blocked by required conditions
Details
CI / Canvas Deploy Reminder (pull_request) Blocked by required conditions
Details
CI / Python Lint & Test (pull_request) Blocked by required conditions
Details
CI / all-required (pull_request) Blocked by required conditions
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Blocked by required conditions
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Blocked by required conditions
Details
Harness Replays / Harness Replays (pull_request) Blocked by required conditions
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Blocked by required conditions
Details
audit-force-merge / audit (pull_request) Has been skipped
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 18s
Details
Harness Replays / detect-changes (pull_request) Successful in 28s
Details
gate-check-v3 / gate-check (pull_request) Successful in 26s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 30s
Details
qa-review / approved (pull_request) Successful in 27s
Details
sop-tier-check / tier-check (pull_request) Successful in 38s
Details
security-review / approved (pull_request) Successful in 43s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 1m17s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 1m24s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 1m21s
Details
CI / Detect changes (pull_request) Successful in 1m27s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m33s
Details
CI / Canvas (Next.js) (pull_request) Successful in 17m8s
Details
CI / Platform (Go) (pull_request) Failing after 18m25s
Details
sop-checklist / all-items-acked (pull_request) [info tier:low] acked: 2/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +2 — body-unfilled: comprehensive-testing, l
Details 
Two handlers iterated DB rows without checking rows.Err() after the
rows.Next() loop. If the DB errored mid-stream, partial results were
silently returned as 200 OK with no error logged.

Fixes:
- List(): added rows.Err() check after the channel scan loop. Logs
  workspaceID + error on failure but still returns partial results.
- Webhook(): same fix for the channel-lookup rows.Next() loop.

Cherry-picked from fix/channels-rows-err onto fresh staging base.
Also includes CWE-312 fix (duplicate EncryptSensitiveFields removal).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-15 17:51:54 +00:00
core-be 6c313fe7a2 fix(channels): remove duplicate EncryptSensitiveFields call (CWE-312) 
channels.go Create() was calling EncryptSensitiveFields twice in a row
(lines 146–153 and 155–162). Both encrypt the same config; the second
call is a no-op that wastes CPU. The duplicate was introduced in
commit 989912da as part of PR #1193 and never removed.

Also removes a stale CI re-trigger comment.

CWE-312: Cleartext Storage of Sensitive Information.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-15 17:50:46 +00:00
core-be 740d3cbd42 fix(handlers/channels_test): use RowError() to trigger rows.Err() in List test 
The previous approach of adding a second row with matching columns does
not trigger rows.Err() in sqlmock v1.5.2. rows.Err() is only set
when RowError(n, err) or SetError(err) is called explicitly.

Use RowError(0, errors.New("connection lost")) instead — this causes
Scan() to fail on row 0 and sets rows.Err() so the handler's new
rows.Err() check is exercised by the test.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-15 17:50:46 +00:00