stacklok / toolhive / 21828748607

62%

Build Type

push

github

Committed by web-flow

Commit Message

Use CEL variable binding instead of string interpolation for claim matching (#3709)

Replace the interpolation-based approach (fmt.Sprintf into CEL expressions)
with cel-go's variable binding, which passes user-supplied claim values as
bound variables at evaluation time. This eliminates CEL injection by design,
removing the need for the safeClaimValueRegex allowlist entirely.

Related: #3567

Run Details

37 of 39 new or added lines in 1 file covered. (94.87%)

8 existing lines in 2 files now uncovered.

42276 of 68927 relevant lines covered (61.33%)

78.45 hits per line