TheKevJames / coveralls-python / 29754766074

94%

master: 96%

Pull #753

github

fix(api): stop leaking client settings into the coveralls.io payload

create_data() dumped the entire self.config dict into the submitted JSON, so
client-only settings were uploaded to coveralls.io alongside every source file.
Restrict the payload to an explicit allowlist of the fields the API consumes.

The allowlist covers every job parameter the coveralls.io /jobs endpoint
accepts (including run_at), and fields are filtered on presence rather than
truthiness so an explicitly-set falsey value (parallel=False, a numeric 0 job
id) is still forwarded; only genuinely-absent fields are dropped.

changelog:
The JSON submitted to coveralls.io (and written via ``--output``) no longer
leaks client-only settings -- the base directory, source directory, coverage
config file, and request-timeout values. Only the fields the Coveralls API
actually consumes are now sent, and any of those a caller has set (including
falsey values such as ``parallel: false``) are forwarded as-is.

130 of 140 branches covered (92.86%)

Branch coverage included in aggregate %.

4 of 4 new or added lines in 2 files covered. (100.0%)

430 of 457 relevant lines covered (94.09%)

4.7 hits per line