fix(cli): guard init database_string from Typer OptionInfo leakage#5064
fix(cli): guard init database_string from Typer OptionInfo leakage#5064SergioChan wants to merge 3 commits intoSkyvern-AI:mainfrom
Conversation
There was a problem hiding this comment.
Auto-Review: PR #5064
Build Status
- No CI checks reported on this branch.
Findings Summary
- 1 suggestion (see inline comment on
_normalize_database_string) - The fix is correct —
_normalize_database_string()properly guards against Typer'sOptionInfoleaking through. Bothinit_command.pyandquickstart.pyare patched. Test coverage is good.
Agreement with Claude's Review
- No Claude review found.
Reviewed by AronPerez's auto-reviewer
Address review feedback on Skyvern-AI#5064 by normalizing non-string database_string values at the top of quickstart so OptionInfo leakage cannot bypass docker gating. Add focused unit coverage for non-string and string paths.
|
Thanks for the review — great catch on I pushed a follow-up commit to this branch: What changed
Validation
I also tried running pytest for the touched tests, but this environment is missing optional test dependency |
|
Thanks for the suggestion — agreed this was worth making explicit. I pushed commit Validation run:
|
AronPerez
left a comment
There was a problem hiding this comment.
Looks good, just 2 q's
| from .mcp import setup_local_organization, setup_mcp | ||
|
|
||
|
|
||
| def _normalize_database_string(database_string: object) -> str: |
There was a problem hiding this comment.
Nit: _normalize_database_string is prefixed with _* as if it's private but it's exported. Make it public (normalize_database_string) or keep it private
| ) -> None: | ||
| """Quickstart command to set up and run Skyvern with one command.""" | ||
| # Typer OptionInfo can leak through when quickstart is called programmatically. | ||
| database_string = _normalize_database_string(database_string) |
There was a problem hiding this comment.
quickstart() normalizes database_string, then passes it to init_env() which normalizes it again. Why not normalize once here or init_env()?
Summary
init_env()against non-stringdatabase_stringvaluesOptionInfodefaults as empty strings and fall back to standard PostgreSQL setupWhy
Issue #4666 reports a Windows blocker where
skyvern initcan pass anOptionInfoobject through to env writing (set_key), causing:AttributeError: 'OptionInfo' object has no attribute 'replace'.This patch hardens the init flow so non-string inputs do not get written as
DATABASE_STRING.Scope
This PR addresses the
OptionInfoblocker portion of #4666.It does not change the separate Windows migration/event-loop behavior discussed in that issue.
Validation
python -m compileall skyvern/cli/init_command.py tests/unit/test_init_command.py_normalize_database_stringvia Python AST extraction (string input preserved; TyperOptionInfocoerced to empty string)