Codebase quality, security & performance improvements#52
Merged
danielealbano merged 9 commits intomainfrom Mar 11, 2026
Merged
Conversation
Comprehensive plan covering URL encoding, WIQL escaping, JSON Pointer escaping, CSV formula injection mitigation, error handling improvements, input validation, performance optimizations, Docker security, CI/CD enhancements, and expanded test coverage.
US1: URL-encode all user-controlled path segments in Azure API client and modules; escape WIQL project/date fields; add RFC 6901 JSON Pointer escaping for patch paths. US2: Add CSV formula injection mitigation via sanitize_csv_value helper that prefixes dangerous characters (=, +, -, @) with a single quote. US3: Remove duplicate board types from models.rs; replace all unwrap() on serialization in 11 MCP tool files with map_err; add non-empty string validation to team_id, board_id, work_item_type, title, link_type. US4: Parallelize comment fetching with bounded concurrency (10); add recursion depth limits (64) to JSON processing; add HTTP connection limits (256) and timeouts (60s) with semaphore; use HashSet for board work item type deduplication. US5: Add non-root user to Docker runtime; add clippy and cargo-audit to CI; add Linux aarch64 to CD release with cleanup steps.
US6: Add 9 new compact_llm unit tests covering empty structures, Unicode, control characters, deeply nested objects, max depth truncation, long strings, empty string values, and mixed arrays. US7: Add 24 new error-propagation tests and ~25 content-verification tests across all 8 integration test files, covering every MCP tool's error paths and output structure. US8: Add HTTP server integration tests (connection acceptance, invalid method rejection) and 4 CLI argument parsing unit tests.
Add new_with_api constructor to AzureMcpServer (behind test-support feature flag) to enable HTTP server integration tests with MockAzureDevOpsApi. Fix Accept header in HTTP test and work item Type assertion.
All T9.1 verification checkboxes confirmed and marked complete. make all passes with zero warnings, all 134 tests green.
Reformat build.rs and test_tools_work_items.rs to match the latest stable rustfmt (1.94.0) line-length rules for push_str and assert!.
- Remove unused `BoardDetail::get_work_item_types()` and `HashSet` import - Remove 60s connection timeout that would kill SSE streams; MCP Streamable HTTP uses GET for long-lived SSE connections - Fix invalid-method test to use PUT instead of GET (GET is valid for SSE) - Add `test_http_server_accepts_get_for_sse` verifying GET is accepted
danielealbano
deleted the
feat/codebase-quality-security-perf-improvements
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Comprehensive codebase improvements covering security hardening, code quality, performance optimizations, infrastructure enhancements, and expanded test coverage. Implements plan
docs/plans/2_codebase_quality_security_perf_20260311224036.md.Security (US1-US2)
pathfields in work item create/update=,+,-,@prefix sanitization) to both CSV output utilitiesCode Quality (US3)
models.rs(already defined inboards.rs).unwrap()on serialization calls in 11 MCP tool files with properMcpErrorpropagationdeserialize_non_empty_stringvalidation to 9 additional Args struct fieldsPerformance (US4)
get_work_itemswith bounded concurrency (10 concurrent requests)compact_llmserializer andsimplify_work_item_jsonto prevent stack overflowHashSetfor O(1) work item type deduplication inBoardDetail::get_work_item_typesInfrastructure (US5)
appuser)cargo clippywith-D warningsto CI pipelinecargo auditsecurity scanning job to CI pipelineTest Coverage (US6-US8)
compact_llmedge case tests (empty structures, unicode, control chars, deep nesting, max depth)Test Plan
make fmt— no formatting issuesmake lint(cargo clippy --features test-support -- -D warnings) — zero warningsmake test(cargo test --features test-support) — all 134 tests passmake build(cargo build) — zero warnings