fix: prevent race condition on issue/PR body edits#710
Merged
Conversation
Add trigger-time validation for issue/PR body content to prevent attackers from exploiting a race condition where they edit the body between when an authorized user triggers @claude and when Claude processes the request. The existing filterCommentsToTriggerTime() already protected comments - this extends the same pattern to the main issue/PR body via isBodySafeToUse(). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Contributor
Code Review SummaryI've completed a comprehensive review of PR #710 using specialized agents for code quality, performance, security, test coverage, and documentation. Overall, this is an excellent PR that implements critical TOCTOU protection with strong test coverage and clear documentation. Security Assessment ✅The TOCTOU (Time-of-Check-Time-of-Use) protection is well-designed and effectively prevents race condition attacks where malicious actors could edit issue/PR bodies after an authorized user triggers Claude. The implementation:
One medium-severity security issue identified: Invalid timestamp handling could bypass protection if malformed data is received. See inline comment for details. Performance Assessment ✅
The security protection actually improves performance by preventing unnecessary image downloads from malicious content. Test Coverage Assessment ✅Excellent test suite with 249 new lines covering:
Recommendations: Add tests for invalid timestamp handling and security warning verification (see inline comments). Code Quality Assessment ✅
Documentation Assessment ✅Documentation is comprehensive and accurate. The JSDoc and inline comments effectively explain the race condition protection logic. Minor improvement suggested: add complete JSDoc parameters to Action ItemsRequired before merge:
Recommended enhancements: See inline comments for specific implementation suggestions. |
hackyon-anthropic
approved these changes
Dec 1, 2025
Merged
1 task
cheapsteak
pushed a commit
to cheapsteak/claude-code-action
that referenced
this pull request
Dec 9, 2025
…#710) Add trigger-time validation for issue/PR body content to prevent attackers from exploiting a race condition where they edit the body between when an authorized user triggers @claude and when Claude processes the request. The existing filterCommentsToTriggerTime() already protected comments - this extends the same pattern to the main issue/PR body via isBodySafeToUse(). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
EffortlessSteven
added a commit
to EffortlessSteven/claude-code-action
that referenced
this pull request
Jun 5, 2026
Issue/PR comments (anthropics#512) and the issue/PR body (anthropics#710) are filtered to the trigger timestamp so content created or edited after an authorized trigger cannot be injected into Claude's prompt (TOCTOU protection). Reviews and inline review comments were not: fetchGitHubData returned reviewData filtered by actor only, and formatReviewComments renders it into the prompt, so a review submitted or edited after the trigger reached Claude verbatim. filterReviewsToTriggerTime already existed (added alongside the comment filter in anthropics#512) but was only wired to the image-download list, never to the returned reviewData. Apply filterReviewsToTriggerTime to reviewData.nodes and filterCommentsToTriggerTime to each review's inline comments, alongside the existing actor filter. Strengthen the two integration tests to assert that post-trigger and edited-after reviews/comments are dropped.
EffortlessSteven
added a commit
to EffortlessSteven/claude-code-action
that referenced
this pull request
Jun 5, 2026
Issue/PR comments (anthropics#512) and the issue/PR body (anthropics#710) are filtered to the trigger timestamp so content created or edited after an authorized trigger cannot be injected into Claude's prompt (TOCTOU protection). Reviews and inline review comments were not: fetchGitHubData returned reviewData filtered by actor only, and formatReviewComments renders it into the prompt, so a review submitted or edited after the trigger reached Claude verbatim. filterReviewsToTriggerTime already existed (added alongside the comment filter in anthropics#512) but was only wired to the image-download list, never to the returned reviewData. Filter reviewData.nodes through filterReviewsToTriggerTime and each review's inline comments through filterCommentsToTriggerTime, alongside the existing actor filter, then build the review image-processing lists from those already-filtered nodes (removing a now-redundant second filter pass). Strengthen the two integration tests to assert post-trigger and edited-after reviews/comments are dropped.
EffortlessSteven
added a commit
to EffortlessSteven/claude-code-action
that referenced
this pull request
Jun 5, 2026
Issue/PR comments (anthropics#512) and the issue/PR body (anthropics#710) are filtered to the trigger timestamp so content created or edited after an authorized trigger cannot be injected into Claude's prompt (TOCTOU protection). Reviews and inline review comments were not: fetchGitHubData returned reviewData filtered by actor only, and formatReviewComments renders it into the prompt, so a review submitted or edited after the trigger reached Claude verbatim. filterReviewsToTriggerTime already existed (added alongside the comment filter in anthropics#512) but was only wired to the image-download list, never to the returned reviewData. Filter reviewData.nodes through filterReviewsToTriggerTime and each review's inline comments through filterCommentsToTriggerTime, alongside the existing actor filter, then build the review image-processing lists from those already-filtered nodes (removing a now-redundant second filter pass). Strengthen the two integration tests to assert post-trigger and edited-after reviews/comments are dropped.
ashwin-ant
pushed a commit
that referenced
this pull request
Jun 22, 2026
) Issue/PR comments (#512) and the issue/PR body (#710) are filtered to the trigger timestamp so content created or edited after an authorized trigger cannot be injected into Claude's prompt (TOCTOU protection). Reviews and inline review comments were not: fetchGitHubData returned reviewData filtered by actor only, and formatReviewComments renders it into the prompt, so a review submitted or edited after the trigger reached Claude verbatim. filterReviewsToTriggerTime already existed (added alongside the comment filter in #512) but was only wired to the image-download list, never to the returned reviewData. Filter reviewData.nodes through filterReviewsToTriggerTime and each review's inline comments through filterCommentsToTriggerTime, alongside the existing actor filter, then build the review image-processing lists from those already-filtered nodes (removing a now-redundant second filter pass). Strengthen the two integration tests to assert post-trigger and edited-after reviews/comments are dropped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add trigger-time validation for issue/PR body content to prevent attackers from exploiting a race condition where they edit the body between when an authorized user triggers @claude and when Claude processes the request.
The existing filterCommentsToTriggerTime() already protected comments - this extends the same pattern to the main issue/PR body via isBodySafeToUse().
🤖 Generated with Claude Code