[hermes] pegasus: go:S3776 #36

New Issue

hermes-automation · 2026-10-01T11:28:20Z

hermes-automation commented

2026-10-01 11:28:20 +00:00

SonarQube reports go:S3776 in backend/uploads.go. The build is green; this is a standing finding, not a failure.

What is wrong

sanitizeDescriptor exceeds the cognitive-complexity threshold largely because it combines character classification with normalization and truncation control flow. Extracting the character-validity predicate preserves the exact sanitization behavior while reducing the method's complexity.

Ariadne opened no pull request for it: no automated patch was possible for this finding.

Facts

gitea — Refactor this method to reduce its Cognitive Complexity from 16 to the 15 allowed. (CRITICAL, 6min estimated) (backend/uploads.go:21)

Suggested fix (not applied)

Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch.

backend/uploads.go — Move the allowed-character check into a small helper. sanitizeDescriptor retains the same substitutions, underscore collapsing, and 64-rune limit, but no longer contains the compound classification expression that contributes to its cognitive complexity.

func isDescriptorRune(r rune) bool {
	return (r >= 'a' && r <= 'z') ||
		(r >= 'A' && r <= 'Z') ||
		(r >= '0' && r <= '9') ||
		r == '_' || r == '-'
}

func sanitizeDescriptor(s string) string {
	s = strings.TrimSpace(s)
	s = strings.ReplaceAll(s, " ", "_")
	if s == "" {
		return "upload"
	}

	var b []rune
	lastUnderscore := false
	for _, r := range s {
		if !isDescriptorRune(r) {
			r = '_'
		}
		if r == '_' {
			if lastUnderscore {
				continue
			}
			lastUnderscore = true
		} else {
			lastUnderscore = false
		}
		b = append(b, r)
		if len(b) >= 64 {
			break
		}
	}
	return string(b)
}

Links

SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=pegasus&open=AZ4V2tkdqCRMjDT4bXBr
Full evidence bundle and audit trail live in Ariadne at /api/admin/audit/events, event types hermes_autotriage_incident and hermes_autotriage_diagnosis.

Filed automatically by Ariadne from a Hermes Agent diagnosis (run run_e6eb8a43eb654737ba586cb2a82bb8e4). Hermes has no write access to this repository; no files or infrastructure were changed.

SonarQube reports **go:S3776** in `backend/uploads.go`. The build is green; this is a standing finding, not a failure. ## What is wrong sanitizeDescriptor exceeds the cognitive-complexity threshold largely because it combines character classification with normalization and truncation control flow. Extracting the character-validity predicate preserves the exact sanitization behavior while reducing the method's complexity. Ariadne opened no pull request for it: no automated patch was possible for this finding. ## Facts - **gitea** — Refactor this method to reduce its Cognitive Complexity from 16 to the 15 allowed. (CRITICAL, 6min estimated) (`backend/uploads.go:21`) ## Suggested fix (not applied) Hermes could not open a pull request for this, so the change below was not written, validated, or pushed anywhere. It is a starting point for whoever picks this up, not a reviewed patch. **`backend/uploads.go`** — Move the allowed-character check into a small helper. sanitizeDescriptor retains the same substitutions, underscore collapsing, and 64-rune limit, but no longer contains the compound classification expression that contributes to its cognitive complexity. ``` func isDescriptorRune(r rune) bool { return (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || r == '_' || r == '-' } func sanitizeDescriptor(s string) string { s = strings.TrimSpace(s) s = strings.ReplaceAll(s, " ", "_") if s == "" { return "upload" } var b []rune lastUnderscore := false for _, r := range s { if !isDescriptorRune(r) { r = '_' } if r == '_' { if lastUnderscore { continue } lastUnderscore = true } else { lastUnderscore = false } b = append(b, r) if len(b) >= 64 { break } } return string(b) } ``` ## Links - SonarQube finding: https://quality.bstein.dev/project/issues?resolved=false&id=pegasus&open=AZ4V2tkdqCRMjDT4bXBr - Full evidence bundle and audit trail live in Ariadne at `/api/admin/audit/events`, event types `hermes_autotriage_incident` and `hermes_autotriage_diagnosis`. Filed automatically by Ariadne from a Hermes Agent diagnosis (run [run_e6eb8a43eb654737ba586cb2a82bb8e4](https://triage.bstein.dev/chat?resume=run_e6eb8a43eb654737ba586cb2a82bb8e4)). Hermes has no write access to this repository; no files or infrastructure were changed.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: titan/pegasus#36