Skip to content

fix(conv): correct bounds check in ToInt to resolve CodeQL integer-conversion alert #166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adityathebe merged 1 commit into from
Jul 17, 2026
Merged

fix(conv): correct bounds check in ToInt to resolve CodeQL integer-conversion alert #166

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion conv/conv.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,7 +222,7 @@ func ToInt(in interface{}) int {
// Protect against CWE-190 and CWE-681
// https://cwe.mitre.org/data/definitions/190.html
// https://cwe.mitre.org/data/definitions/681.html
if i := ToInt64(in); i <= math.MaxInt || i >= math.MinInt {
if i := ToInt64(in); i >= math.MinInt && i <= math.MaxInt {
return int(i)
Comment on lines +225 to 226

@coderabbitai coderabbitai Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== conv/conv.go excerpt ==\n'
sed -n '1,320p' conv/conv.go | nl -ba | sed -n '200,250p'

printf '\n== conv/conv_test.go excerpt ==\n'
sed -n '1,260p' conv/conv_test.go | nl -ba | sed -n '1,260p'

printf '\n== search for ToInt64 and ToInt usage ==\n'
rg -n "func ToInt64|func ToInt|ToInt64\\(|ToInt\\(" conv

Repository: flanksource/gomplate

Length of output: 226

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== conv/conv.go around ToInt/ToInt64 ==\n'
sed -n '200,260p' conv/conv.go | cat -n

printf '\n== conv/conv_test.go relevant excerpts ==\n'
sed -n '1,260p' conv/conv_test.go | cat -n

printf '\n== direct definitions/search ==\n'
rg -n "func ToInt64|func ToInt|ToInt64\\(|ToInt\\(" conv

Repository: flanksource/gomplate

Length of output: 13698

Preserve uint64 values until after the int range check
Large uint64s can wrap to small negative int64s here (for example math.MaxUint64-1 becomes -2), so ToInt returns a bogus int instead of -1. Check the unsigned range before narrowing or keep the value as uint64 through validation.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@conv/conv.go` around lines 225 - 226, Update ToInt to handle uint64 inputs
without first converting them to int64; validate the original unsigned value
against the int range before narrowing, and return -1 for values outside that
range. Preserve the existing conversion behavior for values that safely fit in
int.

}

Expand Down
Loading