Skip to content

Preserve issue spam decisions without regex backtracking - #7385

Open
scott-shumway wants to merge 3 commits into
mainfrom
shumwow/rest-description-security-fix
Open

scott-shumway wants to merge 3 commits into
mainfrom
shumwow/rest-description-security-fix

Conversation

@scott-shumway

Copy link
Copy Markdown
Contributor

Thank you for contributing to github/rest-api-description!

Please note that we cannot accept pull requests that directly modify the descriptions in this repo. If you have identified a problem with the descriptions, consider opening an issue instead 🙇

Summary

Replace the issue-body heading regex with a linear scan that preserves its existing matching behavior. This prevents long whitespace inputs from tying up the spam-check runner without changing which issues the workflow keeps or closes.

The scan preserves trailing-newline requirements, whitespace spanning lines, CRLF and Unicode line boundaries, and whitespace-only headings. Title/body word-count thresholds, employee exemptions, template handling, and GitHub API calls are unchanged. Null or missing bodies retain their existing error behavior; changing that behavior is outside this compatibility-only fix. There are no dependency updates or OpenAPI description changes.

Add tests that execute the actual inline workflow script with mocked GitHub calls, and run them in the existing workflow-script CI job. Tests cover the repository's issue template, exact thresholds, legacy matching fixtures, and maximum-length inputs with two-second child-process timeouts.

Code scanning alert: https://github.com/github/rest-api-description/security/code-scanning/9

Related: https://github.com/github/vuln-mgmt/issues/281924

Summary: https://github.com/github/vuln-mgmt/issues/287062

Validation

  • node --test .github/scripts/test_*.js — passed, 17 tests.
  • python3 -m unittest discover --start-directory .github/scripts --verbose — passed, 22 tests.
  • git diff --check — passed.
  • Compared preprocessing outputs against the original workflow for 299,593 exhaustive inputs and 100,000 deterministic generated inputs: all 399,593 matched exactly.
  • The original maximum-length heading input exceeded a two-second timeout. The revised workflow handles the same input in about 57 ms, including child-process startup.

Copilot AI added 2 commits October 29, 2026 16:20
Copilot-Session: 38cc48ab-6686-41b4-b35e-459fb890f924
Copilot-Session: 38cc48ab-6686-41b4-b35e-459fb890f924
Copilot AI auto review requested due to automatic review settings October 29, 2026 23:52

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Template-only changes can skip CI because the template is missing from both path filters, and the title-driven assertions do not verify the template body against the spam threshold.

2 open issues
What changed in this PR

Replaces the issue spam checker’s backtracking heading regex with a linear scan, aiming to prevent runner slowdowns without changing which issues are kept or closed.

Changes:

  • Preserves legacy heading, whitespace, and line-ending behavior.
  • Adds tests for workflow decisions, exact thresholds, and maximum-length inputs.
  • Integrates JavaScript tests into CI and documents local test commands.
File Description
CONTRIBUTING.md Documents Python and JavaScript test commands.
.github/​workflows/​scripts-tests.yml Adds Node.js test execution and spam-workflow path filters.
.github/​workflows/​check-for-spammy-issues.yml Replaces heading regex matching with a linear scan.
.github/​scripts/​test_check_for_spammy_issues.js Tests the inline workflow with mocked GitHub calls and timeout guards.

Review effort: Max (auto)

).split('\n---\n')[1];
assert.ok(template);
assertClosed(template, { title: '[Schema Inaccuracy] <Describe Problem>' });
assert.deepEqual(runWorkflow(template, { title: 'A descriptive issue title' }), []);
Comment thread .github/workflows/scripts-tests.yml Resolved
Copilot-Session: 38cc48ab-6686-41b4-b35e-459fb890f924
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants