Description: The Bazel query expression interpolates the unquoted, unescaped ${file} into
"file(${file})", which can allow query/expression injection or unintended query behavior
if a changed filename contains Bazel-query special characters (e.g., ), ,, quotes),
potentially causing the CI job to query unintended targets or fail in attacker-controlled
ways.
check-bazel-targets.sh [17-20]

for file in $affected_files; do
  if query_output=$(bazel query --keep_going --noshow_progress "file(${file})" 2>/dev/null); then
    bazel_targets+=(${query_output})
  fi

Description: Writing bazel-targets='${bazel_targets[*]}' directly to $GITHUB_OUTPUT can enable GitHub
Actions output injection if any computed target string contains newlines or output command
delimiters, allowing a crafted label/value to add or alter subsequent outputs consumed by
later steps.
check-bazel-targets.sh [44-44]

echo "bazel-targets='${bazel_targets[*]}'" | tee -a "$GITHUB_OUTPUT"

• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Shell syntax error: The new for loop introduces an if ...; then without a matching fi, which will cause the
script to fail rather than handling query failures gracefully.

for file in $affected_files; do
  if query_output=$(bazel query --keep_going --noshow_progress "file(${file})" 2>/dev/null); then
    bazel_targets+=(${query_output})
  fi
done

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
Unescaped query input: File paths from git diff --name-only are interpolated directly into the Bazel query
expression (file(${file})) without escaping, which may allow malformed paths to break or
manipulate the query.

affected_files=$(git diff --name-only "${COMMIT_RANGE}")

# Map changed files to target labels
bazel_targets=()
for file in $affected_files; do
  if query_output=$(bazel query --keep_going --noshow_progress "file(${file})" 2>/dev/null); then
    bazel_targets+=(${query_output})
  fi

Learn more about managing compliance generic rules or creating your own custom rules

Improve performance by replacing the loop that calls bazel query for each file
with a single bazel query call for all affected files at once.

scripts/github-actions/check-bazel-targets.sh [17-21]

-for file in $affected_files; do
-  if query_output=$(bazel query --keep_going --noshow_progress "file(${file})" 2>/dev/null); then
-    bazel_targets+=(${query_output})
-  fi
-done
+# Create a space-separated list of file(...) expressions for the query
+file_queries=$(printf "file(%s) " $affected_files)
 
+if query_output=$(bazel query --keep_going --noshow_progress "${file_queries}" 2>/dev/null); then
+  mapfile -t bazel_targets < <(echo "${query_output}")
+fi
+

• Apply / Chat

Modify the script to correctly handle filenames containing spaces by reading
affected_files into an array and iterating over it safely.

scripts/github-actions/check-bazel-targets.sh [13-17]

-affected_files=$(git diff --name-only "${COMMIT_RANGE}")
-for file in $affected_files; do
+readarray -t affected_files <<< "$(git diff --name-only "${COMMIT_RANGE}")"
+for file in "${affected_files[@]}"; do

• Apply / Chat

Remove the 2>/dev/null redirection from the bazel query command to allow error
messages to be printed, which aids in debugging CI failures.

scripts/github-actions/check-bazel-targets.sh [33-39]

 if query_output=$(bazel query \
   --keep_going \
   --noshow_progress \
   "kind(test, rdeps(${BINDINGS_UNIVERSE}, set(${bazel_targets[@]}))) \
-   except attr('tags','manual', ${BINDINGS_UNIVERSE})" 2>/dev/null); then
+   except attr('tags','manual', ${BINDINGS_UNIVERSE})"); then
   bazel_targets+=(${query_output})
 fi

• Apply / Chat

Add a check to ensure the GITHUB_OUTPUT environment variable is set before it is
used to prevent potential script failures.

scripts/github-actions/check-bazel-targets.sh [44]

+: "${GITHUB_OUTPUT:?GITHUB_OUTPUT must be set}"
 echo "bazel-targets='${bazel_targets[*]}'" | tee -a "$GITHUB_OUTPUT"

• Apply / Chat