UI polish and hardening - #2
Conversation
Added input validation and error handling for password and message parameters in encryption and decryption functions. Improved documentation for each function.
Add unit tests for encryption and decryption functions, including scenarios for password validation and error handling.
📝 WalkthroughWalkthroughThe crypto helpers now validate inputs, encode messages as UTF-8, normalize decryption errors, and reject malformed ciphertext. Tests cover these cases. A GitHub Actions workflow runs the suite on Python 3.10 and 3.11. ChangesCrypto validation
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yaml:
- Line 16: Update the CI workflow’s actions/checkout@v4 step to set
persist-credentials to false, and configure the job or workflow permissions to
grant only contents: read.
- Around line 18-20: Update the setup-python action reference in the CI workflow
from actions/setup-python@v4 to the current stable actions/setup-python@v7,
preserving the existing matrix.python-version configuration.
In `@crypto.py`:
- Around line 52-56: Update the Base64 decoding in the encrypted-message flow to
use base64.b64decode with altchars=b"-_" and validate=True, preserving the
existing ValueError conversion for malformed input. Add a regression test that
inserts a non-alphabet character such as "!" into otherwise valid ciphertext and
verifies it is rejected.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 00669c61-3025-44f6-89db-c3eec9c8aa45
📒 Files selected for processing (3)
.github/workflows/ci.yamlcrypto.pytests/test_crypto.py
| matrix: | ||
| python-version: [3.10, 3.11] | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 2 'permissions:|actions/checkout|persist-credentials' .github/workflows
repo="$(gh repo view --json nameWithOwner --jq '.nameWithOwner')"
gh api "repos/${repo}/actions/permissions/workflow"Repository: ToniBig/encryption-decryption-tool
Length of output: 736
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/ci.yaml
printf '%s\n' '--- workflow files and credential-related references ---'
git ls-files '.github/workflows'
rg -n -C 3 'GITHUB_TOKEN|github\.token|secrets\.|persist-credentials|git config|git remote|permissions:|checkout|pytest|unittest|python ' .github/workflows . 2>/dev/null | head -n 300Repository: ToniBig/encryption-decryption-tool
Length of output: 4119
Disable persisted checkout credentials and restrict token permissions.
actions/checkout@v4 persists the token in local Git configuration by default. The subsequent dependency installation and pytest execution can access it. Set persist-credentials: false and permissions: contents: read.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 16-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yaml at line 16, Update the CI workflow’s
actions/checkout@v4 step to set persist-credentials to false, and configure the
job or workflow permissions to grant only contents: read.
Source: Linters/SAST tools
| uses: actions/setup-python@v4 | ||
| with: | ||
| python-version: ${{ matrix.python-version }} |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '14,21p' .github/workflows/ci.yaml
gh api repos/actions/setup-python/releases/latest --jq '.tag_name'Repository: ToniBig/encryption-decryption-tool
Length of output: 460
🌐 Web query:
actions/setup-python v4 v6 v7 GitHub Actions compatibility requirements
💡 Result:
The actions/setup-python action versions v4, v6, and v7 all function to configure Python environments in GitHub Actions workflows, but they differ in their internal dependencies and runner requirements. Compatibility Requirements: - Runner Version: Starting with v6.0.0 and continuing into v7.x, the action requires the GitHub Actions runner to be on version v2.327.1 or later [1][2][3]. This is due to the upgrade from Node 20 to Node 24 [1][2][3]. - Implementation: Both v6 and v7 migrated action internals to ECMAScript Modules (ESM) to maintain compatibility with updated @actions/* packages [4][2][3]. Version Differences: - v7: The most recent major version (released July 2026), featuring dependency upgrades (including @actions/cache 6.2.0) and the removal of the pip-install input [5]. - v6: Introduced the upgrade to Node 24, which mandated the runner version requirement [2][3]. - v4: An older major version that lacks the recent ESM migration and Node 24-based runner requirements [6]. For all versions, it is recommended to explicitly set the python-version or python-version-file input rather than relying on the default system path, as the default version provided on GitHub-hosted runners can change [4][3]. Additionally, users can use the check-latest flag if they want to ensure they are using the latest available patch version of a specified Python version [7].
Citations:
- 1: https://github.com/actions/setup-python/releases
- 2: https://git.homeinfra.org/actions/setup-python/src/tag/v7/README.md
- 3: https://github.com/actions/setup-python?tab=readme-ov-file
- 4: https://github.com/actions/setup-python
- 5: https://github.com/actions/setup-python/releases/tag/v7.0.0
- 6: actions/setup-python@v4...v6
- 7: https://github.com/actions/setup-python/blob/a26af69b/docs/advanced-usage.md
🏁 Script executed:
#!/bin/bash
# Check the releases of setup-python to understand version history and recommendations
gh api repos/actions/setup-python/releases --jq '[.[] | {tag_name, published_at, prerelease}] | .[0:5]'Repository: ToniBig/encryption-decryption-tool
Length of output: 569
Update actions/setup-python to a compatible version before merge.
actions/setup-python@v4 is incompatible with current GitHub Actions runners. Starting with v6.0.0, this action requires GitHub Actions runner version 2.327.1 or later due to the Node 24 upgrade. Update to actions/setup-python@v7, the current stable release.
Proposed fix
- uses: actions/setup-python@v4
+ uses: actions/setup-python@v7📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| uses: actions/setup-python@v7 | |
| with: | |
| python-version: ${{ matrix.python-version }} |
🧰 Tools
🪛 actionlint (1.7.12)
[error] 18-18: the runner of "actions/setup-python@v4" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yaml around lines 18 - 20, Update the setup-python
action reference in the CI workflow from actions/setup-python@v4 to the current
stable actions/setup-python@v7, preserving the existing matrix.python-version
configuration.
Source: Linters/SAST tools
| data = encrypted_message.strip() | ||
| try: | ||
| decoded = base64.urlsafe_b64decode(data) | ||
| except (binascii.Error, ValueError) as exc: | ||
| raise ValueError("Invalid encrypted data: not valid base64") from exc |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python - <<'PY'
import base64
import binascii
payload = b"salt-and-token-bytes"
encoded = base64.urlsafe_b64encode(payload).decode()
tampered = encoded[:4] + "!" + encoded[4:]
assert base64.urlsafe_b64decode(tampered) == payload
try:
base64.b64decode(tampered, altchars=b"-_", validate=True)
except binascii.Error:
print("Strict decoding rejects the injected character.")
else:
raise SystemExit("Strict decoding unexpectedly accepted malformed Base64.")
PYRepository: ToniBig/encryption-decryption-tool
Length of output: 220
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- candidate files ---'
fd -i '^crypto\.py$|^test.*|.*test.*' -t f . | head -80
printf '%s\n' '--- crypto.py outline ---'
ast-grep outline crypto.py --view compact 2>/dev/null || true
printf '%s\n' '--- crypto.py relevant source ---'
cat -n crypto.py | sed -n '1,90p'
printf '%s\n' '--- decoder and decrypt usages ---'
rg -n -C 3 'urlsafe_b64decode|b64decode|decrypt_message|encrypt_message' . --glob '!node_modules' --glob '!dist' --glob '!build'
printf '%s\n' '--- standalone decoder behavior ---'
python3 - <<'PY'
import base64
import binascii
payload = b"salt-and-token-bytes"
encoded = base64.urlsafe_b64encode(payload).decode()
tampered = encoded[:4] + "!" + encoded[4:]
print("encoded:", encoded)
print("tampered:", tampered)
print("urlsafe result:", base64.urlsafe_b64decode(tampered))
try:
base64.b64decode(tampered, altchars=b"-_", validate=True)
except binascii.Error as exc:
print("strict result: rejected:", type(exc).__name__, str(exc))
else:
raise SystemExit("strict result: accepted malformed Base64")
PYRepository: ToniBig/encryption-decryption-tool
Length of output: 7823
Reject non-alphabet Base64 characters.
base64.urlsafe_b64decode discards an inserted !, so malformed ciphertext can decrypt successfully. Use base64.b64decode(data, altchars=b"-_", validate=True) and add a regression test for this case.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@crypto.py` around lines 52 - 56, Update the Base64 decoding in the
encrypted-message flow to use base64.b64decode with altchars=b"-_" and
validate=True, preserving the existing ValueError conversion for malformed
input. Add a regression test that inserts a non-alphabet character such as "!"
into otherwise valid ciphertext and verifies it is rejected.
1 participant
Summary by CodeRabbit
Bug Fixes
Tests
Chores