Skip to content

fix(github-http): return None on malformed GHES port instead of raising#3379

Open
jawwad-ali wants to merge 1 commit into
github:mainfrom
jawwad-ali:fix/github-http-malformed-port
Open

fix(github-http): return None on malformed GHES port instead of raising#3379
jawwad-ali wants to merge 1 commit into
github:mainfrom
jawwad-ali:fix/github-http-malformed-port

Conversation

@jawwad-ali

Copy link
Copy Markdown
Contributor

Description

resolve_github_release_asset_api_url is contracted to either resolve a browser release-download URL to its REST API asset URL or return None — every unresolvable case (unknown host, not-an-asset path, network error, missing asset) returns None. But the GHES branch builds the authority via parsed.port:

elif is_ghes:
    authority = hostname if parsed.port is None else f"{hostname}:{parsed.port}"

urllib's .port raises ValueError on a malformed port. So an allowlisted GHES host with a bad port (e.g. https://ghes.example:notaport/...) crashes the caller instead of returning None. Reproduced on main @ 92b7cf7: ValueError: Port could not be cast to integer value as 'notaport'.

Fix

Read parsed.port inside a try/except ValueError: return None, matching the function's existing graceful return None behavior.

Testing

New test_returns_none_on_malformed_ghes_port: an allowlisted GHES host with :notaport returns None and induces no network call. Fails before (ValueError — verified by source-stash), passes after. The existing valid-port GHES test still passes (happy path unchanged). Full test_github_http.py: 27 passed. uvx ruff check clean.

AI Disclosure

  • I did use AI assistance (describe below)

Found and fixed with Claude Code (Claude Fable 5) under my direction. AI spotted the unguarded parsed.port against the function's return-None contract; I reproduced the ValueError, verified fail-before/pass-after, and reviewed the diff.

resolve_github_release_asset_api_url's is_ghes branch built the authority
with 'parsed.port', which raises ValueError on a malformed port (e.g.
host:notaport). The function's contract is to resolve or return None,
never raise — every other unresolvable case returns None. An allowlisted
GHES host with a bad port therefore crashed the caller. Read parsed.port
defensively and return None on ValueError.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@jawwad-ali jawwad-ali requested a review from mnriem as a code owner July 6, 2026 20:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant