📌 Description
internal/github/list.go handles paginated GitHub API listing (issues, PRs, etc.), but if the cursor/page-link parsing doesn't validate the returned Link header format defensively, a malformed or unexpected response from GitHub could cause an infinite pagination loop or a panic.
🧩 Requirements and context
- Add defensive parsing/validation of the
Link header used to find the 'next' page.
- Cap the maximum number of pages followed per call as a safety net against infinite loops.
- Return a typed error on malformed pagination data instead of panicking.
🛠️ Suggested execution
- Review the pagination-following logic in
internal/github/list.go.
- Add a max-page-count guard and a parse-failure typed error.
- Add a test with a malformed
Link header asserting graceful failure, not a loop/panic.
✅ Acceptance criteria
🔒 Security notes
Defends against a misbehaving or compromised upstream (GitHub API proxy/cache) causing resource exhaustion via unbounded pagination.
📋 Guidelines
- Minimum 95% test coverage
- Clear documentation
- Timeframe: 96 hours
📌 Description
internal/github/list.go handles paginated GitHub API listing (issues, PRs, etc.), but if the cursor/page-link parsing doesn't validate the returned
Linkheader format defensively, a malformed or unexpected response from GitHub could cause an infinite pagination loop or a panic.🧩 Requirements and context
Linkheader used to find the 'next' page.🛠️ Suggested execution
internal/github/list.go.Linkheader asserting graceful failure, not a loop/panic.✅ Acceptance criteria
Linkheaders produce a typed error, not a panic or infinite loop.🔒 Security notes
Defends against a misbehaving or compromised upstream (GitHub API proxy/cache) causing resource exhaustion via unbounded pagination.
📋 Guidelines