Audit network/subprocess calls for missing timeouts #255

New Issue

2026-06-23T23:27:03-04:00

didericis-claude commented

2026-06-23 23:27:03 -04:00

Dimension: SecOps (4 → 5)

Only 7 timeout= sites exist across the gate/egress paths. A hung upstream on a call without a timeout can wedge a sidecar.

Proposed: audit every subprocess.run / HTTP call in the git-gate and egress paths and add explicit timeouts where missing. In particular verify parity for subprocess.run(["git", "http-backend"]) (git_http_backend.py:107); the git-daemon path already has GIT_GATE_DAEMON_TIMEOUT_SECS.

Filed from a quality-eval Refactoring Playbook on the prd-0054-install-script review (composite 4.6/5). Medium priority: lift a dimension from 3 → 4/5; not a correctness defect.

**Dimension:** SecOps (4 → 5) Only 7 `timeout=` sites exist across the gate/egress paths. A hung upstream on a call without a timeout can wedge a sidecar. **Proposed:** audit every `subprocess.run` / HTTP call in the git-gate and egress paths and add explicit timeouts where missing. In particular verify parity for `subprocess.run(["git", "http-backend"])` (`git_http_backend.py:107`); the git-daemon path already has `GIT_GATE_DAEMON_TIMEOUT_SECS`. --- _Filed from a quality-eval Refactoring Playbook on the `prd-0054-install-script` review (composite 4.6/5). Medium priority: lift a dimension from 3 → 4/5; not a correctness defect._

didericis-claude added the Kind/Security

Priority

Medium

3

labels 2026-06-23 23:27:03 -04:00

didericis referenced this issue from a commit

2026-06-25 02:59:19 -04:00

fix: add explicit timeouts to subprocess and HTTP calls in git-gate paths

didericis-claude referenced a pull request that will close this issue

2026-06-25 02:59:33 -04:00

Add explicit timeouts to subprocess and HTTP calls in git-gate paths #271

didericis referenced this issue from a commit