Skip to content

fix: Validate and sanitize Codecov token before use in Authorization header - #780

Open
sentry[bot] wants to merge 1 commit into
mainfrom
seer/fix/validate-codecov-token
Open

fix: Validate and sanitize Codecov token before use in Authorization header#780
sentry[bot] wants to merge 1 commit into
mainfrom
seer/fix/validate-codecov-token

Conversation

@sentry

@sentry sentry Bot commented Aug 28, 2026

Copy link
Copy Markdown

This PR addresses an InvalidHeader error that occurred when the CODECOV_TOKEN environment variable (or -t flag) contained a YAML-structured multi-line string (e.g., codecov:\n token: <UUID>) instead of the plain UUID token.

The requests library, used for HTTP communication, rejects header values containing newline or carriage-return characters. Previously, the CLI would pass the malformed token directly, leading to a crash.

To fix this, a new helper function _validate_token has been introduced in codecov_cli/helpers/request.py. This function:

  1. Converts the token to a string and strips leading/trailing whitespace.
  2. Checks for the presence of newline (\n) or carriage-return (\r) characters within the token.
  3. If such characters are found, it raises a click.ClickException with a clear, actionable error message, guiding the user to provide only the plain UUID token.

This validation is applied in both get_token_header_or_fail and get_token_header to ensure all Authorization headers are properly formed, preventing crashes and improving user experience for misconfigured tokens.

Fixes CLI-GT

This PR was automatically generated by Sentry. You can adjust this setting at any time.

@codecov

codecov Bot commented Aug 28, 2026

Copy link
Copy Markdown

❌ 1 Tests Failed:

Tests completed Failed Passed Skipped
723 1 722 1
View the full list of 1 ❄️ flaky test(s)
api.temp.calculator.test_calculator::test_divide

Flake rate in main: 100.00% (Passed 0 times, Failed 1726 times)

Stack Traces | 0.001s run time
def
                test_divide():
                > assert Calculator.divide(1, 2) == 0.5
                E assert 1.0 == 0.5
                E + where 1.0 = <function Calculator.divide at 0x104c9eb90>(1, 2)
                E + where <function Calculator.divide at 0x104c9eb90> = Calculator.divide
                .../temp/calculator/test_calculator.py:30: AssertionError

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants