Add standalone OWASP cheat sheet refresh script - #952
Open
Bornunique911 wants to merge 3 commits into
Open
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Summary by CodeRabbit
WalkthroughThis PR adds ChangesCheatsheets Update Script
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Bornunique911
force-pushed
the
review/issue-471-cheatsheet-refresh-script
branch
from
July 7, 2026 11:55
d08d662 to
716f8b2
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (2)
scripts/update-cheatsheets.sh (2)
23-24: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winBackup filename collision within the same second.
date +%Y%m%d%H%M%Shas 1-second resolution; two runs within the same second silently overwrite each other's backup.🛡️ Add uniqueness
-BACKUP_FILE="${DB_PATH}.$(date +%Y%m%d%H%M%S).bak" +BACKUP_FILE="${DB_PATH}.$(date +%Y%m%d%H%M%S)_$$.bak"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/update-cheatsheets.sh` around lines 23 - 24, The backup creation in the update-cheatsheets script can collide when run multiple times within the same second because BACKUP_FILE is based only on date +%Y%m%d%H%M%S. Update the BACKUP_FILE naming logic in the script so each run produces a unique filename, for example by adding higher-resolution time, the process ID, or another unique suffix, and keep the cp backup step using that new unique name.
14-16: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winFragile dependency-check proxy.
Using
import flasksuccess as a stand-in for "all deps installed" means new/updated packages inrequirements.txtwon't get installed ifflaskis already present in the venv from a prior run.♻️ Simpler and more robust alternative
-if ! python -c "import flask" >/dev/null 2>&1; then - pip install -r "$ROOT_DIR/requirements.txt" -fi +pip install -q -r "$ROOT_DIR/requirements.txt"
pip installis idempotent and fast when nothing changed, so always running it avoids silently skipping updated dependencies.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/update-cheatsheets.sh` around lines 14 - 16, The dependency check in the update-cheatsheets.sh script is too narrow because it only tests flask via the python import gate, so updated or newly added packages in requirements.txt can be skipped. Remove the import-based conditional around the pip install step and always run the requirements installation in the script flow so dependency updates are applied reliably; the relevant logic is the shell block that wraps pip install -r "$ROOT_DIR/requirements.txt".
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@scripts/update-cheatsheets.sh`:
- Around line 23-24: The backup creation in the update-cheatsheets script can
collide when run multiple times within the same second because BACKUP_FILE is
based only on date +%Y%m%d%H%M%S. Update the BACKUP_FILE naming logic in the
script so each run produces a unique filename, for example by adding
higher-resolution time, the process ID, or another unique suffix, and keep the
cp backup step using that new unique name.
- Around line 14-16: The dependency check in the update-cheatsheets.sh script is
too narrow because it only tests flask via the python import gate, so updated or
newly added packages in requirements.txt can be skipped. Remove the import-based
conditional around the pip install step and always run the requirements
installation in the script flow so dependency updates are applied reliably; the
relevant logic is the shell block that wraps pip install -r
"$ROOT_DIR/requirements.txt".
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: 4a99f980-fd4a-4622-a8a0-b5532012fd97
📒 Files selected for processing (1)
scripts/update-cheatsheets.sh
Bornunique911
force-pushed
the
review/issue-471-cheatsheet-refresh-script
branch
from
July 31, 2026 18:54
76283a2 to
cdf6c55
Compare
Bornunique911
requested review from
Pa04rth,
northdpole,
paoga87 and
robvanderveer
as code owners
July 31, 2026 18:54
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/update-cheatsheets.sh`:
- Around line 8-15: Update the virtual-environment setup in
update-cheatsheets.sh to validate $VENV_DIR/bin/python rather than only the
directory, recreate the environment when that executable is missing, and use the
absolute $VENV_DIR/bin/python for Python and pip operations so system
executables cannot be selected.
- Around line 23-28: Replace the raw cp-based backup in the backup creation flow
with an existing virtualenv Python script using sqlite3.Connection.backup() to
copy DB_PATH to BACKUP_FILE, and wait for that process to complete before
reopening DB_PATH. Afterward, run PRAGMA integrity_check against BACKUP_FILE and
fail if the check is not successful, preserving the existing backup failure
handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro Plus
Run ID: 08927877-75c1-4288-b289-949e2a2a7b1d
📒 Files selected for processing (1)
scripts/update-cheatsheets.sh
…ith integrity check
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR is split out from the larger issue-471 review flow to make review smaller and more focused.
It adds a standalone script for refreshing OWASP Cheat Sheet data and normalizing cheat sheet links in the local cache.
Issue reference:
Problem Fixed
The earlier refresh-scripts review became too large because it was mixed with broader OWASP importer and follow-up work.
For this part of the work, the useful standalone contribution is:
Solution
This PR adds a single standalone script:
scripts/update-cheatsheets.shThe script:
--cheatsheets_inTests
Reviewer Notes
This PR is intentionally narrow because it was split to reduce review size:
This PR is meant to be reviewed as a standalone operational helper.