Skip to content

fix(regen-defs): Fix globs and clean tempfiles on INT, TERM - #381

Open
aaronliu0130 wants to merge 5 commits into
developfrom
tempreglob
Open

fix(regen-defs): Fix globs and clean tempfiles on INT, TERM#381
aaronliu0130 wants to merge 5 commits into
developfrom
tempreglob

Conversation

@aaronliu0130

@aaronliu0130 aaronliu0130 commented Apr 24, 2025

Copy link
Copy Markdown
Member

Summary by CodeRabbit

  • Bug Fixes

    • Improved interruption handling so temporary output files are reliably cleaned up when the generation/linting process is stopped.
  • Refactor

    • Centralized temporary-file cleanup into a single routine and aligned command execution with the updated cleanup flow.
    • Updated the configured lint tool path to use the correct project directory.

@aaronliu0130
aaronliu0130 requested a review from cclauss April 24, 2025 00:17
Comment thread regen-defs.zsh

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds signal handling to the regen-defs.zsh script to clean up temporary files when interrupted, and uses eval to fix glob expansion in cpplint commands. The script processes .def test fixture files that contain cpplint commands with glob patterns (like src/*) and their expected outputs.

  • Added trap handler for INT and TERM signals to clean up temporary files on interruption
  • Changed command execution to use eval to properly expand glob patterns in the commands
  • Refactored cleanup logic into a dedicated function

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread regen-defs.zsh
Comment thread regen-defs.zsh
Comment thread regen-defs.zsh

# Clean up temporary files
rm "$stdout_file" "$stderr_file"
cleanup

Copilot AI Nov 28, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cleanup function is only called on successful completion of a loop iteration (line 51), but not when errors occur earlier. If uv run fails or if any operation between lines 23-48 causes the script to exit, the temporary files will not be cleaned up.

Additionally, the trap handler won't catch normal exit conditions (like the exit calls on lines 6 and 11). Consider:

  1. Adding EXIT to the trap signals: trap cleanup INT TERM EXIT
  2. Moving the trap setup earlier in the script to catch early exits

Note: If you add EXIT to the trap, you may need to prevent double-cleanup on line 51.

Copilot uses AI. Check for mistakes.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think a command in between can cause termination of the entire script, and as mentioned trapping EXIT can get a bit messy.

Copilot AI commented Nov 28, 2025

Copy link
Copy Markdown

@aaronliu0130 I've opened a new pull request, #415, to work on those changes. Once the pull request is ready, I'll request review from you.

I do not think "attackers controlling .def content" is a plausible scenario, but this does seem to be the better tool for the job.
@coderabbitai

coderabbitai Bot commented Nov 28, 2025

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b613684a-759d-4cf6-a03a-d55292aee4c7

📥 Commits

Reviewing files that changed from the base of the PR and between e12e484 and e89746c.

📒 Files selected for processing (1)
  • regen-defs.zsh
🚧 Files skipped from review as they are similar to previous changes (1)
  • regen-defs.zsh

📝 Walkthrough

Walkthrough

Updates regen-defs.zsh to use the Projects cpplint path, clean temporary output files on signals and normal processing, and execute the extracted command through eval.

Changes

regen-defs script updates

Layer / File(s) Summary
Cleanup and cpplint execution
regen-defs.zsh
Repoints cpplint, adds cleanup handling for temporary stdout/stderr files with an INT/TERM trap, evaluates the extracted command, and replaces direct removal with cleanup.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the script fix for glob handling and temporary-file cleanup on INT/TERM.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch tempreglob

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between b32e1f3 and 7abe1d2.

📒 Files selected for processing (1)
  • regen-defs.zsh (2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
  • GitHub Check: build-test (3.x, windows-latest)
  • GitHub Check: build-test (3.10, windows-latest)
🔇 Additional comments (2)
regen-defs.zsh (2)

51-51: Cleanup function call is well-placed.

Calling cleanup after successful iteration completion ensures temp files are removed on the normal (non-signal) path. Combined with the trap handler, this provides cleanup in both success and interruption scenarios.


33-33: Zsh syntax ${(~)cmd} is correct for enabling glob and tilde expansion.

The syntax ${(~)cmd} is indeed the correct zsh parameter expansion flag for enabling GLOB_SUBST. This causes the expanded variable value to undergo glob pattern matching and tilde expansion—wildcards and ~ characters in the .def file's first line will be expanded as patterns before being passed to uv run "$cpplint".

This aligns with the PR objective to fix globbing. However, the security concern you raised is legitimate: since .def file content is read directly without validation (line 20) and then expanded with glob patterns enabled (line 33), any glob patterns in .def files will be evaluated by the shell. This is safe only if .def files are from trusted sources. If .def files can be supplied by untrusted users, consider adding validation or escaping mechanisms to prevent unintended pattern expansion.

Comment thread regen-defs.zsh

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (2)
regen-defs.zsh (2)

26-30: Add -f flag to rm for idempotent cleanup.

The cleanup function should use rm -f instead of plain rm to prevent errors if the temporary files don't exist and to make cleanup idempotent. This is especially important for signal handlers, which may be invoked at unexpected times.

Apply this diff:

-    cleanup() {
-      rm "$stdout_file" "$stderr_file"
-    }
+    cleanup() {
+      rm -f "$stdout_file" "$stderr_file"
+    }

This aligns with the best practice discussed in prior review feedback for robust cleanup handlers.


33-33: Add a security note documenting that .def files must be trusted.

Using eval to execute the command line extracted from .def files requires that those files remain under your control. If a .def file is compromised or maliciously modified, arbitrary code could execute. While this is a developer-internal tool and .def files are repo-controlled, it's good practice to document this assumption.

Apply this diff to add a clarifying comment:

+    # Note: eval is used to enable glob expansion. .def files must be trusted;
+    # do not run this script on untrusted .def file input.
     eval uv run "$cpplint" $cmd > "$stdout_file" 2> "$stderr_file"
📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7abe1d2 and e12e484.

📒 Files selected for processing (1)
  • regen-defs.zsh (2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
  • GitHub Check: build-test (3.10, windows-latest)
  • GitHub Check: build-test (3.x, windows-latest)

@lovewave02 lovewave02 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The signal handler cleans the temp files but does not terminate the script. In zsh, a handled INT or TERM resumes after the trap; a minimal reproduction prints CLEANED and then CONTINUED_AFTER_INT.

Here that means regen-defs.zsh can continue after Ctrl-C and rewrite the current .def file from partial output. Please have the handler clean up and exit with the matching signal status, and add a small regression check for the interrupted path.

@androvonx95 androvonx95 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice to see the trap actually terminating now, but I think 53a1696 has a side effect: exit went into cleanup, and cleanup is also what replaced the rm at the end of each loop iteration.

# Clean up temporary files
cleanup      # <- ends in `exit`, so the success path exits too

So the run stops after the first .def file instead of continuing through the rest.

Also, trap cleanup INT TERM invokes the function with no arguments — $1 is only set in the TRAPINT()-style form — so exit $((128 + $1)) isn't valid arithmetic on either path.

Splitting the two responsibilities keeps the loop intact and still satisfies the signal-status request:

cleanup() { rm -f "$stdout_file" "$stderr_file"; }
trap 'cleanup; exit 130' INT
trap 'cleanup; exit 143' TERM

With the end-of-iteration call left as plain cleanup. I verified this control flow in bash (loop completes; INT exits 130) — I don't have the environment here, so you'll want to confirm on your side.

Unrelated to the title: e89746c swaps $HOME/Documents/cpplint for $HOME/Projects/cpplint, which just trades one local layout for another. Deriving it would work for everyone:

cpplint="${0:A:h}/cpplint.py"

(set before the cd samples/).

@yangfan-yf-yf yangfan-yf-yf left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

eval also drops the argument boundary provided by the quotes around $cpplint. For example, with:

cpplint='/tmp/cpplint checkout/cpplint.py'
cmd='--flag'
eval uv run "$cpplint" $cmd

the second parse passes /tmp/cpplint and checkout/cpplint.py as separate arguments. The previous non-eval form passed the configured path as one argument. This affects any checkout path containing whitespace, and deriving the path from the script location would still have the same problem if a parent directory contains a space.

Could the command expansion preserve $cpplint as one shell word through the second parse (for example, using zsh-safe quoting), with a regression case for a path containing whitespace? The Python suite is green on both the exact head (222 passed) and the current merge ref (231 passed), but it does not exercise regen-defs.zsh.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants