The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

middleware/cors/utils.go (1)

64-77: Dot-boundary enforcement is correct; length-first check prevents off-by-one.

This fixes the previously exploitable suffix match by requiring a '.' immediately before the suffix and short-circuiting on insufficient length. Good separation of prefix/suffix checks and clear early returns.

middleware/cors/cors.go (1)

49-58: Whitespace-trim + scheme-based split fixes prior index misuse.

Computing the wildcard removal on trimmedOrigin, then deriving the scheme boundary from normalizedOrigin addresses the earlier bug where indices from a raw origin (with spaces) were used against normalized strings.

middleware/cors/utils.go (1)

15-28: Docstring is misleading vs behavior (IPv6 ports, path/query/fragment preservation).

The comment says “removes the scheme and port,” but the implementation:

• Preserves IPv6 ports (by design with the leading '[' check).
• Preserves path/query/fragment (as tests also assert).

Suggest updating the comment to reflect actual behavior for accuracy.

-// normalizeDomain removes the scheme and port from the input domain
+// normalizeDomain removes the scheme and (for hostnames/IPv4) the port from the input.
+// For IPv6 literals (e.g. [::1]:8080), the port is preserved to avoid ambiguity with
+// the address colons. Path, query, and fragment (if present) are preserved.

middleware/cors/utils_test.go (1)

138-161: Duplicate test names; make them unique for clearer failures.

Two cases are both named “match with different scheme”. Rename to distinguish which side has the https/http mismatch.

-        {
-            name:     "match with different scheme",
+        {
+            name:     "scheme mismatch (pattern http://api. vs origin https://...)",
             sub:      subdomain{prefix: "http://api.", suffix: "example.com"},
             origin:   "https://api.service.example.com",
             expected: false,
         },
         {
-            name:     "match with different scheme",
+            name:     "scheme mismatch (pattern https:// vs origin http://...)",
             sub:      subdomain{prefix: "https://", suffix: "example.com"},
             origin:   "http://api.service.example.com",
             expected: false,
         },

middleware/cors/cors.go (1)

49-58: Minor readability improvement: use Replace and name the separators.

This reduces mental parsing of slice indices and avoids repeating magic strings.

-        trimmedOrigin := utils.Trim(origin, ' ')
-        if i := strings.Index(trimmedOrigin, "://*."); i != -1 {
-            withoutWildcard := trimmedOrigin[:i+len("://")] + trimmedOrigin[i+len("://*."):]
+        trimmedOrigin := utils.Trim(origin, ' ')
+        const schemeSep = "://"
+        const wildcardToken = "://*."
+        if strings.Contains(trimmedOrigin, wildcardToken) {
+            withoutWildcard := strings.Replace(trimmedOrigin, wildcardToken, schemeSep, 1)
             isValid, normalizedOrigin := normalizeOrigin(withoutWildcard)
             if !isValid {
                 panic("[CORS] Invalid origin format in configuration: " + trimmedOrigin)
             }
-            schemeSep := strings.Index(normalizedOrigin, "://") + len("://")
-            sd := subdomain{prefix: normalizedOrigin[:schemeSep], suffix: normalizedOrigin[schemeSep:]}
+            schemeIdx := strings.Index(normalizedOrigin, schemeSep) + len(schemeSep)
+            sd := subdomain{prefix: normalizedOrigin[:schemeIdx], suffix: normalizedOrigin[schemeIdx:]}
             allowSOrigins = append(allowSOrigins, sd)
         } else {

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

middleware/cors/utils.go (2)

65-68: Tighten the length guard to reject empty-label cases like http://.example.com

As written, http://.example.com will pass: it satisfies prefix/suffix and the character before suffix is '.', but there is no label before that dot. Require at least one label character and a dot before the suffix by bumping the threshold by +1.

Apply this diff:

-	// Not a subdomain if not long enough for a dot separator.
-	if len(o) <= len(s.prefix)+len(s.suffix) {
+	// Not a subdomain if not long enough for "label + dot" before the suffix.
+	// Need at least one character label and a '.' before the suffix.
+	if len(o) <= len(s.prefix)+len(s.suffix)+1 {
 		return false
 	}

---

74-76: Optional: Assert a non-empty label before the dot for extra hardening

If you want an explicit check in addition to the stricter length guard, verify that there’s at least one valid label character before the '.':

• This blocks inputs like http://..example.com or http://.example.com even if they slip past other guards.
• Keep it lightweight to avoid over-validating DNS rules.

Apply this diff:

  // Check for the dot separator.
  suffixStartIndex := len(o) - len(s.suffix)
- return suffixStartIndex > 0 && o[suffixStartIndex-1] == '.'
+ if suffixStartIndex <= 0 || o[suffixStartIndex-1] != '.' {
+ 	return false
+ }
+ // Ensure at least one non-separator character before the dot.
+ if suffixStartIndex-2 < 0 {
+ 	return false
+ }
+ c := o[suffixStartIndex-2]
+ // Accept a-z, 0-9, or '-' as a minimal label-char set.
+ if !((c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '-') {
+ 	return false
+ }
+ return true

Alternatively, keep the code as-is and cover this via tests (see next comment).

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

middleware/cors/utils.go (1)

74-76: Disallow empty labels like .example.com or a..example.com (optional hardening)

As written, an origin such as http://.example.com will pass: it has the required dot before the suffix but with an empty label. Browsers won’t typically emit such Origins, but hardening here avoids edge-case mis-matches and aligns with the intent to only allow well-formed subdomains.

Apply this diff to ensure there’s at least one non-dot character before the separator dot:

-	// Check for the dot separator.
-	suffixStartIndex := len(o) - len(s.suffix)
-	return suffixStartIndex > 0 && o[suffixStartIndex-1] == '.'
+	// Check for the dot separator and ensure there's a non-empty label before it.
+	suffixStartIndex := len(o) - len(s.suffix)
+	dotIndex := suffixStartIndex - 1
+	if dotIndex <= len(s.prefix) || o[dotIndex] != '.' {
+		return false
+	}
+	// Disallow empty label directly before the suffix, e.g., http://.example.com or http://a..example.com
+	if o[dotIndex-1] == '.' {
+		return false
+	}
+	return true

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.