test(web): regression guards for medicine search hardening - #4210
Merged
dipexplorer merged 1 commit intoAug 8, 2026
Merged
Conversation
…Loopz#4201) The brace-imbalance bug (unclosed local getClientIp declaration shadowing the hardened helpers) was removed upstream in 2dc6e6a, but the route had no runnable coverage: the existing route.test.ts lives under app/api and is excluded by jest.config.cjs (roots: tests/), so it never executed. Add a runnable test in tests/ that pins the security behavior the broken inline reimplementation would have silently undone: - rate limiting uses the hardened getClientIp: forged X-Forwarded-For / X-Real-IP are ignored (loopback default), so an attacker cannot mint a fresh rate-limit bucket per request. - LIKE wildcards (% / _) are escaped before reaching PostgREST, preventing wildcard shaping / cache poisoning of med_search:* entries. - comma/paren queries reach the DB without throwing. - short (<2 char) and oversized (>100 char) queries short-circuit before touching Redis or the DB.
github-actions
Bot
added
gssoc:approved
|
dipexplorer
added
level:intermediate
github-project-automation
Bot
moved this from 📥 Backlog
to 🎉 Merged
in SahiDawa Workflow
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🛑 STOP: Assignment & File Scope Check
Warning
PRs with unrelated files will not be reviewed and may be closed.
📋 PR Summary & Link
/api/medicines/search/route.ts— unclosed function → web build failure + shadowed imports reintroduce rate-limit bypass #4201What changed: Added apps/web/tests/medicine-search-route.test.ts (1 file, 131 insertions). This is the same fix from the earlier branch, re-based cleanly onto main.
Why (the "better way"): Issue [BUG]
/api/medicines/search/route.ts— unclosed function → web build failure + shadowed imports reintroduce rate-limit bypass #4201's literal bug — an unclosed { in the local getClientIp shadowing the hardened helpers, causing TS1005 and a rate-limit/cache-poisoning bypass — was already fixed upstream by commit 2dc6e6a. But the route had no runnable test coverage: the pre-existing app/api/medicines/search/route.test.ts sits outside jest's roots: ["/tests"], so it never executed. This PR adds real coverage that pins the security properties that broken inline reimplementation would have silently undone:Verification: all 5 tests pass; no type errors; no circular deps. The 5 unrelated pre-existing suite failures (api, upload-route, voice-page-a11y, i18n-locales, compare-interactions) were confirmed identical on main.
🏷️ PR Type
type: bugtype: featuretype: docstype: testingtype: securitytype: performancetype: designtype: refactortype: devopstype: accessibility✅ Checklist
Closes #4201)mainand resolved any conflicts