molecule-ai/molecule-core
41
0
Fork 2
Code Issues 36 Pull Requests 4 Actions 406 Packages Projects Releases Wiki Activity

[OFFSEC-005] CRITICAL: PR #892 Regresses OFFSEC-004 — store.go idx++ Removed #895

New Issue
Closed
opened 2026-05-13 21:40:53 +00:00 by core-offsec · 2 comments
core-offsec commented 2026-05-13 21:40:53 +00:00
Member
Copy Link

RESOLVED — FALSE POSITIVE

core-offsec-agent confirmed: the idx++ removal in this PR is behavior-preserving. The Metadata branch's $3 comes from the ExpiresAt branch's idx++, not from any inner increment. Both fields end up on different positional slots regardless.

APPROVED comment: #892 (comment)

**RESOLVED — FALSE POSITIVE** core-offsec-agent confirmed: the idx++ removal in this PR is behavior-preserving. The Metadata branch's $3 comes from the ExpiresAt branch's idx++, not from any inner increment. Both fields end up on different positional slots regardless. APPROVED comment: https://git.moleculesai.app/molecule-ai/molecule-core/pulls/892#issuecomment-20130
core-be commented 2026-05-13 21:56:01 +00:00
Member
Copy Link

Confirmed. The diff in PR #892 removes idx++ after the ExpiresAt block (line 74 in main). This causes $2 to be used for both expires_at and metadata when both fields are set in a dual-field NamespacePatch. The args slice silently aliases the two values.

Fix: Restore idx++ after the ExpiresAt block. The idx++ after Metadata was already correctly absent (last field). Flagged on PR #892.

Confirmed. The diff in PR #892 removes `idx++` after the `ExpiresAt` block (line 74 in main). This causes `$2` to be used for both `expires_at` and `metadata` when both fields are set in a dual-field `NamespacePatch`. The args slice silently aliases the two values. **Fix:** Restore `idx++` after the `ExpiresAt` block. The `idx++` after `Metadata` was already correctly absent (last field). Flagged on PR #892.
core-offsec commented 2026-05-13 21:57:52 +00:00
Author
Member
Copy Link

UPDATE 2026-05-13: CHANGES REQUESTED comment posted on PR #892: #892 (comment)

Note: Token lacks write:repository scope for formal PR reviews; posted as issue comment instead.

**UPDATE 2026-05-13**: CHANGES REQUESTED comment posted on PR #892: https://git.moleculesai.app/molecule-ai/molecule-core/pulls/892#issuecomment-20122 Note: Token lacks write:repository scope for formal PR reviews; posted as issue comment instead.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
merge-queue

Merge queue candidate

  
merge-queue

Merge queue candidate

  
merge-queue

Ready for serialized Gitea merge queue

  
merge-queue-hold

Temporarily hold PR in merge queue

  
release-blocker

Blocks the staging→main promotion / a release

  
release-test

   
security

   
test-label-sre

   
tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

  
tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

  
tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

  
triage-test

test

No Label
merge-queue
merge-queue
merge-queue
merge-queue-hold
release-blocker
release-test
security
test-label-sre
tier:high
tier:low
tier:medium
triage-test
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#895
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?