-
Notifications
You must be signed in to change notification settings - Fork 167
Description
Summary
Comprehensive testing of the func repository command identified 15+ issues across validation, data integrity, and error handling, with the primary concerns being critical validation gaps where empty repository names are silently accepted and auto-derived from URLs, special characters (spaces, slashes, colons, @ symbols) are allowed without DNS-1035 validation, and the reserved "default" name can be used creating duplicate entries that corrupt the repository list; silent failures where removing non-existent repositories or attempting to remove the embedded "default" repository succeed silently without any indication of failure, leading users to believe operations succeeded when they did not; and misleading error messages where filesystem errors expose internal paths and use technical terminology instead of user-friendly guidance, and rename/remove operations on "default" show confusing "file exists" errors instead of explaining that "default" is reserved. Key findings include the critical bug where empty names are auto-derived from URL paths without user notification, creating unpredictable naming and potential conflicts; the filesystem security risk where special characters like slashes create nested directory structures that break template references; and the data integrity issues where multiple "default" entries are created and users cannot distinguish between builtin and custom repositories. Additionally, URL whitespace is not trimmed leading to cryptic parse errors, and error messages expose internal filesystem paths instead of providing actionable guidance.
Full Detailed Report: Link to Google Docs -https://docs.google.com/document/d/18-JD-nfP6-o6o462P4zXF3P9Ltr47us9fb0fFPeoyOE/edit?usp=sharing
Resolved Issues
The following issues have been marked as resolved in the detailed report:
(No issues marked as resolved yet)