Skip to content

Add test coverage for semicolon handling in description text evaluation#67

Draft
Copilot wants to merge 3 commits intomainfrom
copilot/sanitize-inputs-for-semicolon
Draft

Add test coverage for semicolon handling in description text evaluation#67
Copilot wants to merge 3 commits intomainfrom
copilot/sanitize-inputs-for-semicolon

Conversation

Copy link

Copilot AI commented Mar 13, 2026

Adds test coverage ensuring semicolons in the description free-form text area are properly handled during text file evaluation in text.rb.

Problem

The description field is a free-form text area where users write narrative text that may contain semicolons. The parsed_data method in text.rb guards against this by bypassing parsed_predicate for description values (line 297: if key == "description"), but this behavior lacked direct test coverage through the #description method.

Changes Made

  • Test: preserves narrative semicolons: Added test verifying the description method returns the full string including semicolons for narrative descriptions (e.g., "This group manages auth; it also handles access control for the team")
  • Test: semicolons not parsed as predicates: Added test verifying semicolons in descriptions are not split and parsed as semicolon predicates
  • Test: predicate-like text preserved: Added test for the edge case where a description contains text that looks like a valid predicate after a semicolon (e.g., description = This group provides access to resources; expiration = 2099-12-31 is not a predicate here), verifying it's stored as-is and not extracted as a predicate
  • Test fixtures: Added description-with-semicolon-narrative.txt and description-with-predicate-like-semicolon.txt

Testing

  • All 528 unit tests pass with 100% code coverage
  • No CodeQL security alerts
Original prompt

I need to make sure that we're appropriately sanitizing inputs that we're consuming. Notably when we're evaluating text from files an encounter a semicolon.


📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.

@northrup
Copy link
Member

@copilot let's try working on this again

- Validate primary key value is not empty/nil after semicolon splitting
- Strip whitespace from primary key value after splitting
- Skip empty parts from trailing/consecutive semicolons
- Add test fixtures and test cases for edge cases

Co-authored-by: northrup <11050+northrup@users.noreply.github.com>
Copy link
Author

Copilot AI commented Mar 13, 2026

@copilot let's try working on this again

I've implemented the input sanitization for semicolons in the text evaluation in commit f463b20. The changes add validation in the parsed_predicate method to:

  1. Reject empty/nil key values — Previously, a leading semicolon (e.g., username = ;expiration=2025-01-01) would produce an empty key value that silently propagated through rule evaluation. Now raises ArgumentError.
  2. Strip whitespace from the primary key value after splitting on semicolons.
  3. Skip empty parts from trailing/consecutive semicolons instead of raising confusing errors.

Added 3 test fixtures and corresponding test cases. All 528 unit tests pass with 100% code coverage.

Copilot AI changed the title [WIP] Add input sanitization for semicolon in text evaluation Add input sanitization for semicolon in text evaluation Mar 13, 2026
@northrup
Copy link
Member

@copilot The condition we're looking to guard against is a semicolon in the description free-form text area where someone is writing a narrative.

Revert parsed_predicate changes and instead add tests ensuring
semicolons in the description free-form text area are preserved
correctly and not treated as predicate separators.

Co-authored-by: northrup <11050+northrup@users.noreply.github.com>
Copy link
Author

Copilot AI commented Mar 13, 2026

@copilot The condition we're looking to guard against is a semicolon in the description free-form text area where someone is writing a narrative.

Refocused the changes in 0d11eab. Reverted the parsed_predicate changes and instead added three #description tests that verify the guard on line 297 (if key == "description") properly protects the description free-form text area:

  1. Narrative semicolons preserved"This group manages auth; it also handles access control"
  2. Semicolons not parsed as predicates"the; description; can; have; semicolons"
  3. Predicate-like text after semicolons preserved"This group provides access to resources; expiration = 2099-12-31 is not a predicate here" (verifies that text resembling a valid semicolon predicate is not extracted from the description)

All 528 tests pass with 100% coverage.

Copilot AI changed the title Add input sanitization for semicolon in text evaluation Add test coverage for semicolon handling in description text evaluation Mar 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants