[seonghobae]

상태

• Proposed / Draft
• 보호 브랜치 기준: develop@2949d30718752ea5915c7713ba227e8c19d9e5bf
• 현재 head: 9475ffe2ef126da355a960c07df10dbce35a44f5
• 현재 tree: d360355bf9631a9deb186c5f9394a5d89d61cfcc
• 병합: exact-head 필수 Checks가 실제로 실행·성공할 때까지 HOLD

결함과 근본 원인

외부 Semgrep·Bandit·Ruff finding이 명시적 category 없이 _build_finding에 들어오면 _finding_category(rule_id) 폴백을 사용합니다. 해당 폴백에 SSRF 매핑이 없어 ssrf rule ID도 misconfig로 보고되었습니다. 패키지 내장 SSRF 규칙은 category를 직접 전달하므로 기존 테스트가 이 adapter 경계를 검증하지 못했습니다.

재현 조건과 경계

• 사전 조건: 외부 finding에 category가 없고 rule ID에 대소문자 무관 ssrf 토큰이 포함됨
• 관측 신호: 직렬화된 category가 ssrf가 아니라 misconfig
• explicit category는 계속 우선하고 unrelated ID는 기존 휴리스틱을 유지
• SSRF 예방, URL 안전성, detector recall 또는 토큰이 없는 규칙의 추론을 주장하지 않음

현재 수리와 검증

• 최소 _finding_category SSRF 폴백
• helper 단위 assertion과 실제 Semgrep JSON adapter 출력 assertion을 유지
• 동시 Jules child가 direct adapter 회귀를 기존 test_semgrep_findings_maps_json_results에 통합해 중복 테스트를 제거한 간결한 형태를 canonical로 수용
• mutation RED: 해당 생산 분기만 제거하면 adapter 테스트가 expected ssrf, got misconfig로 실패
• GREEN: helper+adapter 2/2, 전체 1092 passed, compileall·diff check 성공
• 보호 브랜치 대비 5 ahead / 0 behind, 변경은 CHANGELOG·구현·두 테스트 파일 정확히 4개
• exact blobs: 구현 cb8194c66f28b70835ce6017030589b3a0616cee, adapter 48c559a436058bd8dd3e20a306a0d21dbbc8dc51, helper 1e27d757873ed448e8c46bfdb71cc866f8bcde36, CHANGELOG 6515072d5668c4cfc0080e597d541eb0db376861

hosted gate

여섯 exact-head workflow(37585450067, 37585450094, 37585450122, 37585450134, 37585450149, 37585450148)의 여덟 job이 모두 step 생성 전에 실패했습니다. steps: null, logs_url: null, 모든 로그 조회 BlobNotFound이므로 실행된 소스 판정이 아닙니다. 승인 0건·unresolved thread 0건이며 중앙 .github#2356에서 runner/admission 원인을 추적합니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review finding at 5172628e9a329ac113da1e01e284a258d36c21a8:

• the one-line SSRF fallback is behaviorally useful for external findings that omit category metadata;
• the PR contains no executable regression despite claiming test_finding_category_* verification;
• the existing packaged SSRF tests pass an explicit category and therefore do not exercise this fallback;
• the .jules “untrusted reference override/category spoofing” narrative is not reproduced and overstates the observed defect.

Reproduced consumer-visible RED by removing the proposed branch while running a new Semgrep normalization contract: expected ssrf, observed misconfig (1 failed). Restored the minimal branch: focused 135/135 and full 1,092/1,092 pass, plus compileall and diff checks.

I am keeping the production line, adding the direct external-finding regression and a CHANGELOG fragment, and restoring .jules/sentinel.md to the protected blob. The PR remains Proposed/Draft until exact-head Checks and current-head review settle.

[seonghobae]

Exact-head repair evidence

• Head: f71f30d92b36e24e508403f44cd5a9ceb603df40
• Tree: 2431c77e5aa3c864cc9bd8c89344fb2d9b679b08
• Protected comparison: 2 ahead / 0 behind; exactly implementation, direct consumer regression, and changelog
• RED mutation: 1 failed, expected ssrf, observed misconfig
• GREEN: related 135 passed; full suite 1,092 passed; compileall and diff check passed
• Reviews / unresolved threads: 0 / 0

All six exact-head workflow runs failed before steps materialized. Their eight jobs expose no steps or logs, and log retrieval returns BlobNotFound. This is runner/admission evidence, not an executed source verdict. No rerun was issued because the cause is unchanged and tracked at ContextualWisdomLab/.github#2356. The PR remains Draft / Proposed / merge-HOLD.

[seonghobae]

Concurrent-head review at 88b4130d2811337fb8d5680431ae4bbd2410c538:

• the Jules child correctly preserves the production SSRF branch, consolidates the changelog fragment, and adds a helper-level assertion;
• it also deletes the 22-line Semgrep JSON → _semgrep_findings regression, so the external adapter boundary that originally lacked coverage is unprotected again;
• helper-only _finding_category coverage would remain green if the adapter stopped delegating category-less results to that fallback.

Mutation on this current head confirms the consumer test is causal: removing only the production SSRF branch makes the direct adapter test fail with expected ssrf / observed misconfig. With the branch restored, helper plus consumer tests pass 2/2 and the full suite passes 1,093/1,093.

I will preserve the concurrent changelog consolidation and helper test, adding back only the direct consumer regression as a non-force child.

[google-labs-jules]

Current-head review finding at 5172628e9a329ac113da1e01e284a258d36c21a8:

• the one-line SSRF fallback is behaviorally useful for external findings that omit category metadata;
• the PR contains no executable regression despite claiming test_finding_category_* verification;
• the existing packaged SSRF tests pass an explicit category and therefore do not exercise this fallback;
• the .jules “untrusted reference override/category spoofing” narrative is not reproduced and overstates the observed defect.

Reproduced consumer-visible RED by removing the proposed branch while running a new Semgrep normalization contract: expected ssrf, observed misconfig (1 failed). Restored the minimal branch: focused 135/135 and full 1,092/1,092 pass, plus compileall and diff checks.

I am keeping the production line, adding the direct external-finding regression and a CHANGELOG fragment, and restoring .jules/sentinel.md to the protected blob. The PR remains Proposed/Draft until exact-head Checks and current-head review settle.

요청하신 대로 Semgrep integration (test_semgrep_findings_maps_json_results)에 SSRF가 명시적으로 매핑되는지를 검증하는 regression test를 추가했고, 오해의 소지가 있던 .jules/sentinel.md 수정을 롤백하여 original blob으로 복원했습니다. 또한 PR description 및 CHANGELOG를 한국어로 반영했습니다.