Skip to content

fix(codegen): guard against infinite recursion on cyclic helper bindings#45

Merged
luisleo526 merged 1 commit into
mainfrom
fix/security-binding-cyclic-recursion-guard
Jul 7, 2026
Merged

fix(codegen): guard against infinite recursion on cyclic helper bindings#45
luisleo526 merged 1 commit into
mainfrom
fix/security-binding-cyclic-recursion-guard

Conversation

@luisleo526

Copy link
Copy Markdown
Contributor

Bug

_collect_security_ta_binding_stacks recursed into an Identifier's helper binding without the resolving cycle guard that the sibling mutable/global/func paths already carry. A cyclic helper binding (an identifier bound to an expression that transitively references the same binding) recursed forever — hungpixi-macd-enhanced-mtf crashed the transpiler with RecursionError even at limit 300000.

Fix

Guard that path too, keyed by the bound node's id. Acyclic bindings never trip the guard → byte-identical emission.

Verification

  • pytest: full suite green (1446 passed).
  • Corpus emission-diff: transpiled request.security MTF corpus strategies at HEAD vs parent → byte-identical SHA-256 (guard never fires without a cycle). Provably additive.
  • Turns a transpiler crash into a terminating traversal; no strategy's output changes.

🤖 Generated with Claude Code

_collect_security_ta_binding_stacks recursed into an Identifier's helper
binding (the `isinstance(expr_node, Identifier)` + _security_lookup_helper_binding
path) WITHOUT the `resolving` cycle guard that the mutable/global/func paths in
the same function already carry. A cyclic helper binding — an identifier bound to
an expression that transitively references the same binding — recursed forever
(hungpixi-macd-enhanced-mtf: RecursionError, transpile crash, even at limit
300000).

Guard that path too, keyed by the bound node's id so acyclic bindings are
completely unaffected (the guard never fires → byte-identical emission; the
corpus + all other strategies are unchanged). Turns a transpiler crash into a
terminating traversal.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@luisleo526 luisleo526 merged commit ad74aeb into main Jul 7, 2026
9 checks passed
@luisleo526 luisleo526 deleted the fix/security-binding-cyclic-recursion-guard branch July 7, 2026 12:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant