From 08ad0b985583370ed2950766626ca7a8c1626298 Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Tue, 27 Oct 2026 19:48:37 -0300 Subject: [PATCH] Flag response tests that never reach albedo's reflected body albedo's /reflect parses the request as a JSON reflection spec and returns only its body field, so a plain string or JSON without body leaves RESPONSE_BODY without the payload and a negative test passes vacuously. Seen on coreruleset/coreruleset#4833. --- .coderabbit.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index c27c94e..08b823e 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -550,6 +550,15 @@ reviews: different string than intended; percent-encode it and keep the readable form in `desc`. + Response test that never reaches the response — response-phase tests + (RESPONSE-95x) POST to the albedo backend's `/reflect`, which parses + the request body as a JSON reflection spec and returns only its `body` + (or base64 `encodedBody`) field. A plain string gets `400 Invalid JSON + in request body`; JSON without `body` returns an empty response. Either + way RESPONSE_BODY never holds the payload, so a negative test passes + without testing anything. Require `data: '{"body": ""}'`. + albedo ignores the request `Content-Type`, so don't flag that. + Only positive tests — a new or widened pattern should come with at least one benign payload asserting it does NOT match, especially for short patterns or ones that could hit hashes, IDs, or file paths.