Skip to content

Conversation

@rlymbur
Copy link
Contributor

@rlymbur rlymbur commented Oct 28, 2025

Potential fix for https://github.com/aws/aws-application-networking-k8s/security/code-scanning/14

The best way to fix this issue is to ensure that before casting the int64 result of strconv.ParseInt to int32, there's a check confirming that the value is within the valid int32 range. If not, return a safe default, ignore the annotation, or log a warning. Alternatively, modify strconv.ParseInt to use a bit size of 32, so the returned value is always in the int32 range if parsing succeeds.
To preserve existing functionality (differentiating between default and user-specified priority, and logging warnings for out-of-bound input), it's preferable to add a bounds check:

  • Before int32(priority), verify that priority is within [math.MinInt32, math.MaxInt32].
  • If out of range, log a warning and skip/ignore the annotation (preferably behave as if parsing failed and don't add to the queue here).
    This requires importing the math package for math.MinInt32 and math.MaxInt32 unless such an import already exists.

Changes required in pkg/gateway/model_build_rule.go:

  • Import the math package.
  • Add a bounds check after parsing and before pushing to priorityQueue.
  • Only push if the value is within the int32 range; otherwise, warn and treat as invalid (fall back as if no annotation).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…tween integer types Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@rlymbur rlymbur closed this Oct 28, 2025
@rlymbur rlymbur deleted the alert-autofix-14 branch October 30, 2025 20:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant