SPOC-470: [Security] [Codacy] Triage security issues in lolor

[danolivo]

Address Codacy security warnings in lolor (spoc-470)

Two categories of findings reported by Codacy's Flawfinder analyser are resolved across .github/workflows/workflow.yml, src/lolor_fsstubs.c, and src/lolor_inv_api.c.

GitHub Actions: unpinned third-party actions (commit 0647af4)

All four actions in the CI workflow were referenced by mutable version tags (@v2, @v4, etc.). A compromised upstream repository could silently redirect a tag to malicious code. Each action is now pinned to the full 40-character commit SHA that the tag currently resolves to, with the original tag retained as an inline comment for readability:

Action	Tag	SHA
actions/checkout	v4	34e114876b0b11c390a56381ad16ebd13914f8d5
docker/setup-buildx-action	v2	885d1462b80bc1c1c7f0b00334ad271f09369c55
docker/setup-compose-action	v1	2fe291b7677a45ee1269ec56a42604c143505e7e
actions/upload-artifact	v4	ea165f8d65b6e75b540449e92b4886f43607fa02

Flawfinder warnings in C sources (commit 3872cb9)

Codacy runs Flawfinder as one of its four C/C++ analysers. The findings fall into two groups:

False positives — suppressed with Flawfinder: ignore:

• read(fd, buf, BUFSIZE) in lo_import_internal: the count argument is exactly sizeof(buf); nbytes is always ≤ BUFSIZE. No overrun is possible (CWE-120, CWE-20).
• umask(S_IWGRP | S_IWOTH) in lo_export: value 0022 is kept intentionally in sync with PostgreSQL core be-fsstubs.c. Changing it unilaterally without a policy decision would create an unexplained behavioural divergence from native large objects (CWE-732).
• umask(oumask) restore call in PG_FINALLY: the tool flags every umask() call regardless of argument; this one simply restores the prior mask (CWE-732).

Bounds not visible to the analyser — resolved with Assert():

Assert() is preferred over suppression here: it documents the invariant at the call site, catches future regressions in debug builds, and costs nothing in release builds.

• lolor_inv_read: n is clamped to min(len - off, nbytes - nread) before the memcpy; assertion makes both source and destination bounds explicit.
• lolor_inv_write (two sites, existing-page and new-page paths): len is validated by getdatafield() to be in [0, LOBLKSIZE]; n is clamped to min(LOBLKSIZE - off, nbytes - nwritten). Assertions cover destination-page capacity and source-buffer capacity at each site.
• lolor_inv_truncate: same getdatafield() guarantee applies to pagelen.

[coderabbitai]

📝 Walkthrough

Walkthrough

Workflow file pins four third-party action SHAs; src/lolor_fsstubs.c adds Flawfinder ignore comments to specific calls; src/lolor_inv_api.c adds assertion checks validating slice lengths and page bounds in read/write/truncate large-object paths.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow .github/workflows/workflow.yml	Replaced uses: version tags with pinned commit SHAs for four third-party actions. No logic changes.
FS stubs annotations src/lolor_fsstubs.c	Added trailing Flawfinder: ignore comments to a read(...) loop and two umask(...) calls. No functional change.
Large-object bounds assertions src/lolor_inv_api.c	Inserted assertions in lolor_inv_read, lolor_inv_write, and lolor_inv_truncate to validate computed copy lengths and existing page lengths lie within expected ranges (e.g., non-negative, <= LOBLKSIZE, within remaining bytes).

Poem

🐇 I hop through code with tiny feet,
I stitch the bounds so copies meet,
A comment wink, a SHA held tight,
Safe pages, pinned steps through the night.
Thump-thump—builds and bytes delight!

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically summarizes the main change: triaging and addressing Codacy-reported security issues in lolor, matching the substantial security-focused modifications across the codebase.
Description check	✅ Passed	The pull request description is detailed and directly related to the changeset, explaining security findings from Codacy/Flawfinder and how each is addressed.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch spoc-470

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}