diff --git a/.markdown-link-check.json b/.markdown-link-check.json new file mode 100644 index 00000000..b9049f94 --- /dev/null +++ b/.markdown-link-check.json @@ -0,0 +1,39 @@ +{ + "ignorePatterns": [ + { + "pattern": "^http://localhost" + }, + { + "pattern": "^https://localhost" + }, + { + "pattern": "^http://127.0.0.1" + }, + { + "pattern": "^user-guide" + }, + { + "pattern": "^developer-guide" + }, + { + "pattern": "^attributes" + }, + { + "pattern": "^api-reference" + }, + { + "pattern": "^examples" + }, + { + "pattern": "^roadmaps" + }, + { + "pattern": "^index" + } + ], + "timeout": "20s", + "retryOn429": true, + "retryCount": 3, + "fallbackRetryDelay": "30s", + "aliveStatusCodes": [200, 206] +} diff --git a/coldstart-prompts/02-fix-critical-security-logic-bugs-from-code-review.md b/coldstart-prompts/02-fix-critical-security-logic-bugs-from-code-review.md deleted file mode 100644 index d320b1aa..00000000 --- a/coldstart-prompts/02-fix-critical-security-logic-bugs-from-code-review.md +++ /dev/null @@ -1,253 +0,0 @@ -# Coldstart Implementation Prompt: Fix Critical Security & Logic Bugs from Code Review - -**Priority**: P0 -**Repository**: agentready (https://github.com/redhat/agentready) -**Branch Strategy**: Create feature branch from main - ---- - -## Context - -You are implementing a feature for AgentReady, a repository quality assessment tool for AI-assisted development. - -### Repository Structure -``` -agentready/ -├── src/agentready/ # Source code -│ ├── models/ # Data models -│ ├── services/ # Scanner orchestration -│ ├── assessors/ # Attribute assessments -│ ├── reporters/ # Report generation (HTML, Markdown, JSON) -│ ├── templates/ # Jinja2 templates -│ └── cli/ # Click-based CLI -├── tests/ # Test suite (unit + integration) -├── examples/ # Example reports -└── specs/ # Feature specifications -``` - -### Key Technologies -- Python 3.11+ -- Click (CLI framework) -- Jinja2 (templating) -- Pytest (testing) -- Black, isort, ruff (code quality) - -### Development Workflow -1. Create feature branch: `git checkout -b NNN-feature-name` -2. Implement changes with tests -3. Run linters: `black . && isort . && ruff check .` -4. Run tests: `pytest` -5. Commit with conventional commits -6. Create PR to main - ---- - -## Feature Requirements - -Fix Critical Security & Logic Bugs from Code Review - -**Priority**: P0 (Critical - Security & Correctness) - -**Description**: Address critical bugs discovered in code review that affect security and assessment accuracy. - -**Issues to Fix**: - -1. **XSS Vulnerability in HTML Reports** (CRITICAL - Security) - - **Location**: `src/agentready/templates/report.html.j2:579` - - **Problem**: `assessment_json|safe` disables autoescaping for JSON embedded in JavaScript - - **Risk**: Repository names, commit messages, file paths from git could contain malicious content - - **Fix**: Replace with `JSON.parse({{ assessment_json|tojson }})` - - **Add**: Content Security Policy headers to HTML reports - -2. **StandardLayoutAssessor Logic Bug** (CRITICAL - Incorrect Scoring) - - **Location**: `src/agentready/assessors/structure.py:48` - - **Problem**: `(repository.path / "tests") or (repository.path / "test")` always evaluates to first path - - **Impact**: Projects with `test/` instead of `tests/` scored incorrectly - - **Fix**: Check both paths properly: - ```python - tests_path = repository.path / "tests" - if not tests_path.exists(): - tests_path = repository.path / "test" - has_tests = tests_path.exists() - ``` - -**Implementation**: - -**File 1**: `src/agentready/templates/report.html.j2` -```jinja2 - -const ASSESSMENT = {{ assessment_json|safe }}; - - -const ASSESSMENT = JSON.parse({{ assessment_json|tojson }}); -``` - -**File 2**: `src/agentready/assessors/structure.py` -```python -# BEFORE (BUGGY): -standard_dirs = { - "src": repository.path / "src", - "tests": (repository.path / "tests") or (repository.path / "test"), # BUG! -} - -# AFTER (CORRECT): -standard_dirs = { - "src": repository.path / "src", -} - -# Check for tests directory (either tests/ or test/) -tests_path = repository.path / "tests" -if not tests_path.exists(): - tests_path = repository.path / "test" -standard_dirs["tests"] = tests_path -``` - -**Test Cases to Add**: -```python -def test_xss_in_repository_name(): - """Test that malicious repo names are escaped in HTML.""" - repo = Repository( - name="", - # ... - ) - html = HTMLReporter().generate(assessment, output) - assert "