Conversation
There was a problem hiding this comment.
Pull request overview
This PR resolves 86 open high-severity CodeQL findings across Go, Python, and CI workflows. Fixes span path injection (applying filepath.Clean() at taint sources), log injection (stripping \n/\r from auth tokens before printing), command injection (validating $EDITOR with exec.LookPath()), integer overflow (guarding float64→int64 with the 2^53 safe-integer bound), missing CI workflow permissions, unpinned action tags, and Python path injection.
Changes:
- Apply
filepath.Clean()to environment-variable-derived paths (XDG dirs,$HOME,$BASECAMP_THEME) across ~10 Go files to satisfy CodeQLgo/path-injectionrules. - Fix command injection (
exec.LookPathguard on$EDITOR), log injection (\n/\rstrip on token), and integer overflow (math.Trunc+ safe-int bounds) in Go code. - Harden CI workflows: add
permissions: contents: readtotest.yml, SHA-pingolangci-lint-actionandactions/cacheinrelease.yml, and addis_dir()validation guards inscripts/doc_parity.py.
Reviewed changes
Copilot reviewed 17 out of 17 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
scripts/doc_parity.py |
Added is_dir() validation for all user-supplied paths (6 Python path-injection findings) |
internal/tui/workspace/workspace.go |
Apply filepath.Clean(configDir) for keybindings path |
internal/tui/workspace/widget/composer.go |
Add exec.LookPath validation for $EDITOR; apply filepath.Clean(home) |
internal/tui/theme.go |
Apply filepath.Clean to $BASECAMP_THEME and home-derived paths |
internal/richtext/mime_test.go |
New tests for empty-path behaviour in DetectMIME and ValidateFile |
internal/richtext/mime.go |
Guard empty path before filepath.Clean; apply filepath.Clean to non-empty paths |
internal/resilience/store.go |
Apply filepath.Clean to XDG/home-derived cache paths |
internal/output/render.go |
Replace int(v) cast with safe-int-bounded int64(v) using math.Trunc |
internal/output/output_test.go |
Comprehensive boundary tests for float→int formatting |
internal/harness/claude.go |
Apply filepath.Clean(home) for Claude plugin detection paths |
internal/config/config.go |
Apply filepath.Clean to XDG/home-derived config paths |
internal/completion/cache.go |
Apply filepath.Clean to XDG/home-derived cache paths |
internal/commands/migrate.go |
Apply filepath.Clean(home) with proper error guard |
internal/commands/doctor.go |
Apply filepath.Clean(home) with non-empty guard for shell completion checks |
internal/commands/auth.go |
Strip \n/\r from token before fmt.Println (log injection fix) |
.github/workflows/test.yml |
Add permissions: contents: read (7 missing permission findings) |
.github/workflows/release.yml |
SHA-pin golangci-lint-action and actions/cache (1 unpinned action finding) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Apply filepath.Clean() at source functions where environment variables
(XDG_CONFIG_HOME, XDG_CACHE_HOME, HOME) and OS APIs (UserHomeDir,
UserCacheDir, UserConfigDir) produce tainted values. This breaks
CodeQL's taint chain for ~69 downstream path-injection findings.
Uses "fallback first, then clean non-empty" pattern to avoid
filepath.Clean("") returning "." which would redirect to CWD.
Falls back to os.TempDir() when home directory is unavailable.
exec.LookPath() is recognized by CodeQL as a sanitizer for the command-injection finding on $EDITOR-derived exec.Command calls.
… integer-overflow float64 can only represent consecutive integers exactly up to 2^53. Check range before casting to int64 to avoid undefined behavior for large floats. Adds boundary tests for precision edge cases.
…ings - Add top-level permissions: contents: read to test.yml (7 findings) - Pin golangci-lint-action and actions/cache to commit hashes in release.yml
Review carefully before merging. Consider a major version bump. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all 86 open high-severity CodeQL findings from GitHub code scanning:
go/path-injection: Applyfilepath.Clean()at source functions (GlobalConfigDir,defaultCacheDir,defaultStateDir, etc.) where env vars and OS APIs produce tainted values. Uses "fallback first, then clean non-empty" pattern to avoidfilepath.Clean("")returning".".\n/\rfrom auth token before printing.$EDITORwithexec.LookPath()beforeexec.Command().float64→int64conversion with2^53precision bound (largest consecutive-integer range for float64).permissions: contents: readto test.yml.golangci-lint-actionandactions/cacheto commit hashes in release.yml.py/path-injection: ValidatePath.resolve().is_dir()in doc_parity.py.17 files changed, 153 insertions, 27 deletions across 6 atomic commits.
Test plan
make checkpasses (fmt-check, vet, lint, test, test-e2e, provenance-check, check-naming, check-surface)