Skip to content

fix(security): remediate SonarQube vulnerabilities #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devin-ai-integration wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(security): remediate SonarQube vulnerabilities #77

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions pkg/errors/error.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,15 @@ package errors

import (
"context"
"errors"
"fmt"

"github.com/google/go-github/v72/github"
"github.com/mark3labs/mcp-go/mcp"
)

var errContextMissingGitHubCtxErrors = errors.New("context does not contain GitHubCtxErrors")

type GitHubAPIError struct {
Message string `json:"message"`
Response *github.Response `json:"-"`
Expand Down Expand Up @@ -71,15 +74,15 @@ func GetGitHubAPIErrors(ctx context.Context) ([]*GitHubAPIError, error) {
if val, ok := ctx.Value(GitHubErrorKey{}).(*GitHubCtxErrors); ok {
return val.api, nil // return the slice of API errors from the context
}
return nil, fmt.Errorf("context does not contain GitHubCtxErrors")
return nil, errContextMissingGitHubCtxErrors
}

// GetGitHubGraphQLErrors retrieves the slice of GitHubGraphQLErrors from the context.
func GetGitHubGraphQLErrors(ctx context.Context) ([]*GitHubGraphQLError, error) {
if val, ok := ctx.Value(GitHubErrorKey{}).(*GitHubCtxErrors); ok {
return val.graphQL, nil // return the slice of GraphQL errors from the context
}
return nil, fmt.Errorf("context does not contain GitHubCtxErrors")
return nil, errContextMissingGitHubCtxErrors
}

func NewGitHubAPIErrorToCtx(ctx context.Context, message string, resp *github.Response, err error) (context.Context, error) {
Expand All @@ -95,15 +98,15 @@ func addGitHubAPIErrorToContext(ctx context.Context, err *GitHubAPIError) (conte
val.api = append(val.api, err) // append the error to the existing slice in the context
return ctx, nil
}
return nil, fmt.Errorf("context does not contain GitHubCtxErrors")
return nil, errContextMissingGitHubCtxErrors
}

func addGitHubGraphQLErrorToContext(ctx context.Context, err *GitHubGraphQLError) (context.Context, error) {
if val, ok := ctx.Value(GitHubErrorKey{}).(*GitHubCtxErrors); ok {
val.graphQL = append(val.graphQL, err) // append the error to the existing slice in the context
return ctx, nil
}
return nil, fmt.Errorf("context does not contain GitHubCtxErrors")
return nil, errContextMissingGitHubCtxErrors
}

// NewGitHubAPIErrorResponse returns an mcp.NewToolResultError and retains the error in the context for access via middleware
Expand Down
37 changes: 22 additions & 15 deletions pkg/github/discussions.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,13 @@ import (
"github.com/shurcooL/githubv4"
)

const (
descRepositoryOwner = "Repository owner"
descRepositoryName = "Repository name"
errFailedToGetGQLClient = "failed to get GitHub GQL client: %v"
fmtCategoryLabel = "category:%s"
)

func ListDiscussions(getGQLClient GetGQLClientFn, t translations.TranslationHelperFunc) (tool mcp.Tool, handler server.ToolHandlerFunc) {
return mcp.NewTool("list_discussions",
mcp.WithDescription(t("TOOL_LIST_DISCUSSIONS_DESCRIPTION", "List discussions for a repository")),
Expand All @@ -22,11 +29,11 @@ func ListDiscussions(getGQLClient GetGQLClientFn, t translations.TranslationHelp
}),
mcp.WithString("owner",
mcp.Required(),
mcp.Description("Repository owner"),
mcp.Description(descRepositoryOwner),
),
mcp.WithString("repo",
mcp.Required(),
mcp.Description("Repository name"),
mcp.Description(descRepositoryName),
),
mcp.WithString("category",
mcp.Description("Optional filter by discussion category ID. If provided, only discussions with this category are listed."),
Expand All @@ -51,7 +58,7 @@ func ListDiscussions(getGQLClient GetGQLClientFn, t translations.TranslationHelp

client, err := getGQLClient(ctx)
if err != nil {
return mcp.NewToolResultError(fmt.Sprintf("failed to get GitHub GQL client: %v", err)), nil
return mcp.NewToolResultError(fmt.Sprintf(errFailedToGetGQLClient, err)), nil
}

// If category filter is specified, use it as the category ID for server-side filtering
Expand Down Expand Up @@ -98,7 +105,7 @@ func ListDiscussions(getGQLClient GetGQLClientFn, t translations.TranslationHelp
CreatedAt: &github.Timestamp{Time: n.CreatedAt.Time},
Labels: []*github.Label{
{
Name: github.Ptr(fmt.Sprintf("category:%s", string(n.Category.Name))),
Name: github.Ptr(fmt.Sprintf(fmtCategoryLabel, string(n.Category.Name))),
},
},
}
Expand Down Expand Up @@ -138,7 +145,7 @@ func ListDiscussions(getGQLClient GetGQLClientFn, t translations.TranslationHelp
CreatedAt: &github.Timestamp{Time: n.CreatedAt.Time},
Labels: []*github.Label{
{
Name: github.Ptr(fmt.Sprintf("category:%s", string(n.Category.Name))),
Name: github.Ptr(fmt.Sprintf(fmtCategoryLabel, string(n.Category.Name))),
},
},
}
Expand All @@ -164,11 +171,11 @@ func GetDiscussion(getGQLClient GetGQLClientFn, t translations.TranslationHelper
}),
mcp.WithString("owner",
mcp.Required(),
mcp.Description("Repository owner"),
mcp.Description(descRepositoryOwner),
),
mcp.WithString("repo",
mcp.Required(),
mcp.Description("Repository name"),
mcp.Description(descRepositoryName),
),
mcp.WithNumber("discussionNumber",
mcp.Required(),
Expand All @@ -187,7 +194,7 @@ func GetDiscussion(getGQLClient GetGQLClientFn, t translations.TranslationHelper
}
client, err := getGQLClient(ctx)
if err != nil {
return mcp.NewToolResultError(fmt.Sprintf("failed to get GitHub GQL client: %v", err)), nil
return mcp.NewToolResultError(fmt.Sprintf(errFailedToGetGQLClient, err)), nil
}

var q struct {
Expand Down Expand Up @@ -221,7 +228,7 @@ func GetDiscussion(getGQLClient GetGQLClientFn, t translations.TranslationHelper
CreatedAt: &github.Timestamp{Time: d.CreatedAt.Time},
Labels: []*github.Label{
{
Name: github.Ptr(fmt.Sprintf("category:%s", string(d.Category.Name))),
Name: github.Ptr(fmt.Sprintf(fmtCategoryLabel, string(d.Category.Name))),
},
},
}
Expand All @@ -241,8 +248,8 @@ func GetDiscussionComments(getGQLClient GetGQLClientFn, t translations.Translati
Title: t("TOOL_GET_DISCUSSION_COMMENTS_USER_TITLE", "Get discussion comments"),
ReadOnlyHint: ToBoolPtr(true),
}),
mcp.WithString("owner", mcp.Required(), mcp.Description("Repository owner")),
mcp.WithString("repo", mcp.Required(), mcp.Description("Repository name")),
mcp.WithString("owner", mcp.Required(), mcp.Description(descRepositoryOwner)),
mcp.WithString("repo", mcp.Required(), mcp.Description(descRepositoryName)),
mcp.WithNumber("discussionNumber", mcp.Required(), mcp.Description("Discussion Number")),
),
func(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
Expand All @@ -258,7 +265,7 @@ func GetDiscussionComments(getGQLClient GetGQLClientFn, t translations.Translati

client, err := getGQLClient(ctx)
if err != nil {
return mcp.NewToolResultError(fmt.Sprintf("failed to get GitHub GQL client: %v", err)), nil
return mcp.NewToolResultError(fmt.Sprintf(errFailedToGetGQLClient, err)), nil
}

var q struct {
Expand Down Expand Up @@ -303,11 +310,11 @@ func ListDiscussionCategories(getGQLClient GetGQLClientFn, t translations.Transl
}),
mcp.WithString("owner",
mcp.Required(),
mcp.Description("Repository owner"),
mcp.Description(descRepositoryOwner),
),
mcp.WithString("repo",
mcp.Required(),
mcp.Description("Repository name"),
mcp.Description(descRepositoryName),
),
mcp.WithNumber("first",
mcp.Description("Number of categories to return per page (min 1, max 100)"),
Expand Down Expand Up @@ -356,7 +363,7 @@ func ListDiscussionCategories(getGQLClient GetGQLClientFn, t translations.Transl

client, err := getGQLClient(ctx)
if err != nil {
return mcp.NewToolResultError(fmt.Sprintf("failed to get GitHub GQL client: %v", err)), nil
return mcp.NewToolResultError(fmt.Sprintf(errFailedToGetGQLClient, err)), nil
}
var q struct {
Repository struct {
Expand Down
26 changes: 16 additions & 10 deletions pkg/github/pullrequests.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,12 @@ import (
"github.com/github/github-mcp-server/pkg/translations"
)

const (
errFailedToGetPullRequest = "failed to get pull request"
errFailedToGetCurrentUser = "failed to get current user"
errFailedToGetLatestReviewForCurrentUser = "failed to get latest review for current user"
)

// GetPullRequest creates a tool to get details of a specific pull request.
func GetPullRequest(getClient GetClientFn, t translations.TranslationHelperFunc) (mcp.Tool, server.ToolHandlerFunc) {
return mcp.NewTool("get_pull_request",
Expand Down Expand Up @@ -59,7 +65,7 @@ func GetPullRequest(getClient GetClientFn, t translations.TranslationHelperFunc)
pr, resp, err := client.PullRequests.Get(ctx, owner, repo, pullNumber)
if err != nil {
return ghErrors.NewGitHubAPIErrorResponse(ctx,
"failed to get pull request",
errFailedToGetPullRequest,
resp,
err,
), nil
Expand Down Expand Up @@ -695,7 +701,7 @@ func GetPullRequestStatus(getClient GetClientFn, t translations.TranslationHelpe
pr, resp, err := client.PullRequests.Get(ctx, owner, repo, pullNumber)
if err != nil {
return ghErrors.NewGitHubAPIErrorResponse(ctx,
"failed to get pull request",
errFailedToGetPullRequest,
resp,
err,
), nil
Expand Down Expand Up @@ -1025,7 +1031,7 @@ func CreateAndSubmitPullRequestReview(getGQLClient GetGQLClientFn, t translation
"prNum": githubv4.Int(params.PullNumber),
}); err != nil {
return ghErrors.NewGitHubGraphQLErrorResponse(ctx,
"failed to get pull request",
errFailedToGetPullRequest,
err,
), nil
}
Expand Down Expand Up @@ -1119,7 +1125,7 @@ func CreatePendingPullRequestReview(getGQLClient GetGQLClientFn, t translations.
"prNum": githubv4.Int(params.PullNumber),
}); err != nil {
return ghErrors.NewGitHubGraphQLErrorResponse(ctx,
"failed to get pull request",
errFailedToGetPullRequest,
err,
), nil
}
Expand Down Expand Up @@ -1240,7 +1246,7 @@ func AddPullRequestReviewCommentToPendingReview(getGQLClient GetGQLClientFn, t t

if err := client.Query(ctx, &getViewerQuery, nil); err != nil {
return ghErrors.NewGitHubGraphQLErrorResponse(ctx,
"failed to get current user",
errFailedToGetCurrentUser,
err,
), nil
}
Expand Down Expand Up @@ -1268,7 +1274,7 @@ func AddPullRequestReviewCommentToPendingReview(getGQLClient GetGQLClientFn, t t

if err := client.Query(context.Background(), &getLatestReviewForViewerQuery, vars); err != nil {
return ghErrors.NewGitHubGraphQLErrorResponse(ctx,
"failed to get latest review for current user",
errFailedToGetLatestReviewForCurrentUser,
err,
), nil
}
Expand Down Expand Up @@ -1377,7 +1383,7 @@ func SubmitPendingPullRequestReview(getGQLClient GetGQLClientFn, t translations.

if err := client.Query(ctx, &getViewerQuery, nil); err != nil {
return ghErrors.NewGitHubGraphQLErrorResponse(ctx,
"failed to get current user",
errFailedToGetCurrentUser,
err,
), nil
}
Expand Down Expand Up @@ -1405,7 +1411,7 @@ func SubmitPendingPullRequestReview(getGQLClient GetGQLClientFn, t translations.

if err := client.Query(context.Background(), &getLatestReviewForViewerQuery, vars); err != nil {
return ghErrors.NewGitHubGraphQLErrorResponse(ctx,
"failed to get latest review for current user",
errFailedToGetLatestReviewForCurrentUser,
err,
), nil
}
Expand Down Expand Up @@ -1501,7 +1507,7 @@ func DeletePendingPullRequestReview(getGQLClient GetGQLClientFn, t translations.

if err := client.Query(ctx, &getViewerQuery, nil); err != nil {
return ghErrors.NewGitHubGraphQLErrorResponse(ctx,
"failed to get current user",
errFailedToGetCurrentUser,
err,
), nil
}
Expand Down Expand Up @@ -1529,7 +1535,7 @@ func DeletePendingPullRequestReview(getGQLClient GetGQLClientFn, t translations.

if err := client.Query(context.Background(), &getLatestReviewForViewerQuery, vars); err != nil {
return ghErrors.NewGitHubGraphQLErrorResponse(ctx,
"failed to get latest review for current user",
errFailedToGetLatestReviewForCurrentUser,
err,
), nil
}
Expand Down
Loading