From b738210f963f56de2e11e5b3e08ca2d14c72e5e5 Mon Sep 17 00:00:00 2001 From: Thomas Schmelzer Date: Thu, 25 Jun 2026 20:23:13 +0400 Subject: [PATCH 1/2] Potential fix for code scanning alert no. 2: Binding a socket to all network interfaces Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- src/pycharting/core/server.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pycharting/core/server.py b/src/pycharting/core/server.py index 740cf1d..a5cd1af 100644 --- a/src/pycharting/core/server.py +++ b/src/pycharting/core/server.py @@ -78,7 +78,7 @@ def find_free_port(start_port: int | None = None, end_port: int | None = None) - if start_port is None: with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) - s.bind(("", 0)) + s.bind(("127.0.0.1", 0)) return s.getsockname()[1] if end_port is None: @@ -87,7 +87,7 @@ def find_free_port(start_port: int | None = None, end_port: int | None = None) - for port in range(start_port, end_port): try: with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: - s.bind(("", port)) + s.bind(("127.0.0.1", port)) s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) return port except OSError: From 6af3b2d0baa52259921dd8bc7f70bb37dc590c04 Mon Sep 17 00:00:00 2001 From: Thomas Schmelzer Date: Thu, 25 Jun 2026 20:28:37 +0400 Subject: [PATCH 2/2] Fix Windows test: occupy port on 127.0.0.1 to match find_free_port find_free_port now binds to 127.0.0.1 (security alert fix), but test_raises_on_no_free_port still occupied its port on all interfaces (""). On Windows 0.0.0.0:port and 127.0.0.1:port don't conflict, so find_free_port bound successfully and the expected RuntimeError was never raised. Occupy the port on 127.0.0.1 so the conflict is seen. Co-Authored-By: Claude Opus 4.8 (1M context) --- tests/test_server.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_server.py b/tests/test_server.py index ccdb887..56c09a2 100644 --- a/tests/test_server.py +++ b/tests/test_server.py @@ -41,11 +41,11 @@ def test_raises_on_no_free_port(self): """Test that RuntimeError is raised when no port is free.""" import socket - # Bind on the same interface find_free_port scans ("" / all interfaces). + # Bind on the same interface find_free_port scans ("127.0.0.1"). # On Windows, 127.0.0.1:port does not conflict with 0.0.0.0:port, so the # occupied port must be claimed on the same address to be seen as taken. with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: - s.bind(("", 0)) + s.bind(("127.0.0.1", 0)) occupied_port = s.getsockname()[1] with pytest.raises(RuntimeError, match="No free port found"): find_free_port(occupied_port, occupied_port + 1)