From 461de4ce906619d557fa4b18d2f480c7799a12be Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 13 Aug 2026 14:18:52 +0000 Subject: [PATCH] test(sync): probe for a free port on loopback, not every interface MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeQL flagged the ephemeral-port probe in the handshake test for binding to all interfaces. The probe only needs a free port number, so loopback is both sufficient and correct — a test should not open a port to the network to discover one. The manager under test still binds to all interfaces, which is deliberate and already marked nosec: a follower has to receive the leader's UDP broadcast. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01NohXi78cwsAKtN1sCfxjUh --- test/test_sync_manager.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/test_sync_manager.py b/test/test_sync_manager.py index 7340c701..daefaff6 100644 --- a/test/test_sync_manager.py +++ b/test/test_sync_manager.py @@ -804,8 +804,10 @@ class TestLoopbackHandshake: monkeypatch.setattr(sync_manager, "HELLO_INTERVAL", 0.02) monkeypatch.setattr(sync_manager, "HEARTBEAT_INTERVAL", 0.02) + # Pick a free port by binding one on loopback and releasing it. + # Loopback, not "", so this test never opens a port to the network. probe = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) - probe.bind(("", 0)) + probe.bind(("127.0.0.1", 0)) port = probe.getsockname()[1] probe.close()