3 ms·

The first linked PR (#1218) has only one commit co-authored by Copilot and it's not related to the vulnerability, and neither are the other suggestions in the P

by vultour 2mo ago

The first linked PR (#1218) has only one commit co-authored by Copilot and it's not related to the vulnerability, and neither are the other suggestions in the PR. Am I missing something?

galnagli 2mo ago
Github is having some problems -- will check! thanks a lot!
- vultour 2mo ago
  I must be too tired because I cannot figure out what happened in that pull request. The PR/source branch was over a year old with none of the commits adding up to the full diff. There is [1], which introduced the vulnerability but didn't remove the environment variables above, then master is merged into it via [2] (but still doesn't show the variables being removed), yet in the full PR diff they're gone. In any case, I'm pretty sure you misattributed the vulnerability to Copilot because the PR got squash-merged and _all_ of the changes were then attributed to every contributor in that PR, despite Copilot only appearing on one of the commits. [1] https://github.com/snowflakedb/snowflake-connector-net/commit/094038e59d112906f1790acf39999045fc0df243 https://github.com/snowflakedb/snowflake-connector-net/commi... [2] https://github.com/snowflakedb/snowflake-connector-net/commit/51dc7381e64c60033ec10c52939ff4ae1d3d83ab https://github.com/snowflakedb/snowflake-connector-net/commi...
  - croemer 2mo ago
    Yes, it's misattributed, a human introduced it: https://github.com/snowflakedb/snowflake-connector-net/pull/1218/changes/094038e59d112906f1790acf39999045fc0df243 https://github.com/snowflakedb/snowflake-connector-net/pull/...
    - galnagli 2mo ago
      Thanks @vultour and croemer for your proactiveness -- you are correct,I updated the blog to clarify that Copilot was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities, it's unclear whether the code-change was AI-Assisted
croemer 2mo ago
You're correct. The issue was introduced in this commit by a human not by copilot: https://github.com/snowflakedb/snowflake-connector-net/pull/1218/changes/094038e59d112906f1790acf39999045fc0df243 https://github.com/snowflakedb/snowflake-connector-net/pull/... However, GitHub Advanced Security, a bot, flagged something but not the real issue. So maybe that bot contributed a false sense of security. Commit: https://github.com/snowflakedb/snowflake-connector-net/pull/1218/changes/094038e59d112906f1790acf39999045fc0df243 https://github.com/snowflakedb/snowflake-connector-net/pull/...

by vultour 2mo ago

The first linked PR (#1218) has only one commit co-authored by Copilot and it's not related to the vulnerability, and neither are the other suggestions in the PR. Am I missing something?

galnagli 2mo ago

Github is having some problems -- will check! thanks a lot!

vultour 2mo ago
I must be too tired because I cannot figure out what happened in that pull request. The PR/source branch was over a year old with none of the commits adding up to the full diff. There is [1], which introduced the vulnerability but didn't remove the environment variables above, then master is merged into it via [2] (but still doesn't show the variables being removed), yet in the full PR diff they're gone. In any case, I'm pretty sure you misattributed the vulnerability to Copilot because the PR got squash-merged and _all_ of the changes were then attributed to every contributor in that PR, despite Copilot only appearing on one of the commits. [1] https://github.com/snowflakedb/snowflake-connector-net/commit/094038e59d112906f1790acf39999045fc0df243 https://github.com/snowflakedb/snowflake-connector-net/commi... [2] https://github.com/snowflakedb/snowflake-connector-net/commit/51dc7381e64c60033ec10c52939ff4ae1d3d83ab https://github.com/snowflakedb/snowflake-connector-net/commi...
- croemer 2mo ago
  Yes, it's misattributed, a human introduced it: https://github.com/snowflakedb/snowflake-connector-net/pull/1218/changes/094038e59d112906f1790acf39999045fc0df243 https://github.com/snowflakedb/snowflake-connector-net/pull/...
  - galnagli 2mo ago
    Thanks @vultour and croemer for your proactiveness -- you are correct,I updated the blog to clarify that Copilot was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities, it's unclear whether the code-change was AI-Assisted

croemer 2mo ago

You're correct. The issue was introduced in this commit by a human not by copilot: https://github.com/snowflakedb/snowflake-connector-net/pull/1218/changes/094038e59d112906f1790acf39999045fc0df243 https://github.com/snowflakedb/snowflake-connector-net/pull/... However, GitHub Advanced Security, a bot, flagged something but not the real issue. So maybe that bot contributed a false sense of security. Commit: https://github.com/snowflakedb/snowflake-connector-net/pull/1218/changes/094038e59d112906f1790acf39999045fc0df243 https://github.com/snowflakedb/snowflake-connector-net/pull/...