From d06a88ff461e7ff23f8580a940ffa3c941995ccb Mon Sep 17 00:00:00 2001 From: LonwoLonwo Date: Fri, 4 Sep 2026 14:32:14 +0200 Subject: [PATCH] dbeaver/pro#10508 add Copilot review instruction for CB CE --- .github/copilot-code-review-instructions.md | 105 ++++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 .github/copilot-code-review-instructions.md diff --git a/.github/copilot-code-review-instructions.md b/.github/copilot-code-review-instructions.md new file mode 100644 index 0000000000..36cb98c2df --- /dev/null +++ b/.github/copilot-code-review-instructions.md @@ -0,0 +1,105 @@ +# Code Review + +## Security Review + +Review every pull request for security issues in the changed code and its direct +call paths. Report only actionable findings introduced by the pull request, +including the affected file and line, attack scenario, and remediation. + +Apply the project base security rules for Java and TypeScript code. Treat input +from users, database contents, configuration, imported projects, model output, +archives, files, URLs, and remote services as untrusted. + +Pay particular attention to: + +- SQL, LDAP, shell, file-path, URL, XML, GraphQL, regex, and deserialization + inputs that may be controlled by users, database contents, configuration, or + remote services. +- Authentication, authorization, permission checks, unsafe default access, and + broken function-level authorization. Backend APIs and GraphQL mutations must + enforce permissions and global security settings; UI checks are not enough. +- State-changing operations exposed through `GET`, missing CSRF protection for + cookie-authenticated requests, and GraphQL queries or mutations accepted over + unsafe methods. +- Internal, administrative, local, or service-to-service endpoints that are + unauthenticated, exposed to the network, or missing authorization checks. +- Secret, token, password, private key, connection string, IPC secret, session + cookie, license data, or personal-data exposure in code, tests, + configuration, logs, exceptions, or documentation. +- Unsafe handling of credentials and database connection settings. +- Missing validation, encoding, escaping, canonicalization, containment checks, + or resource limits. +- Insecure temporary files, archive extraction, redirects, TLS configuration, + and external-process execution. +- Path traversal and unsafe file handling. Normalize paths, reject absolute + paths, `..`, UNC or network paths, unsafe `file://` links, and archive entries + that escape the target directory. Enforce containment in the expected base + directory before reading, writing, opening, or deleting files. +- Injection risks caused by string-built SQL, LDAP filters, shell commands, + cron entries, JEXL expressions, templates, scripts, or connection events. Use + parameterized queries, proper escaping, strict validation, or sandboxing. +- XSS in HTML, Markdown, copied output, popups, table data, WebViews, and data + rendered from AI or model output. Encode or sanitize untrusted content and + block raw HTML, script execution, `javascript:` links, and unsafe local-file + access. +- Unsafe JavaScript bridges or WebViews that expose local files, credentials, + IPC secrets, shell execution, or privileged application actions to untrusted + content. +- XML processing without secure parser settings. Disable DTDs, external + entities, external schemas, and unsafe default XML parser behavior; enable + secure processing for DOM, SAX, StAX, transformers, minifiers, formatters, + compactors, database drivers, imports, and data viewers. +- SSRF through server-side URL validation, JDBC connection creation, + deployment validation, callbacks, redirects, or remote resource loading. Use + strict allowlists and block localhost, private networks, link-local ranges, + metadata services, and internal hosts unless explicitly required and + authorized. +- Regex patterns that may cause catastrophic backtracking or denial of service. + Prefer safe patterns, bounded input sizes, timeouts, or non-regex parsers. +- Unsafe imports, shared projects, scheduled tasks, and exports. Treat imported + project data as untrusted, do not auto-run scripts or connection events, and + sanitize CSV or spreadsheet exports to prevent formula injection. + +Do not report speculative concerns without a realistic attack path. Do not +request broad refactoring when a focused fix is sufficient. + +## Interface Text + +Review changed user-visible interface text for punctuation and tone. Apply +these rules to titles, headings, labels, controls, commands, messages, +descriptions, and helper text. Do not apply them to technical documentation or +release notes unless the text is presented in the interface. + +### Periods + +Do not use periods in titles, headings, labels, controls, commands, or other +text that names an interface element or action. In messages, descriptions, and +other explanatory prose, use normal sentence punctuation: end complete +sentences with a period, including standalone messages, and do not add a +period to a fragment. + +### Colons + +Use a colon after a label that introduces an input field or a group of radio +buttons or checkboxes. Do not use a colon when the label and the text inside +the field form a single phrase. + +### Contractions + +Do not use contractions in interface text. Write words in full, such as `The +connection cannot be established` rather than `The connection can't be +established`. Contractions are acceptable in longer reading-oriented content, +such as release notes. + +### Question Marks + +Use a question mark only in a confirmation alert that asks a direct question. +Do not use questions in commands, links, labels, helper text, or informational +messages; rewrite them as commands or statements. + +### Exclamation Points + +Do not use exclamation points in interface text. + +Report only clear violations introduced by the pull request and suggest the +correct user-visible wording. \ No newline at end of file