Skip to content

Fix multiple code scanning security issues#1373

Merged
brianmcgillion merged 3 commits intotiiuae:mainfrom
brianmcgillion:fix-sec-warn
Sep 9, 2025
Merged

Fix multiple code scanning security issues#1373
brianmcgillion merged 3 commits intotiiuae:mainfrom
brianmcgillion:fix-sec-warn

Conversation

@brianmcgillion
Copy link
Copy Markdown
Collaborator

@brianmcgillion brianmcgillion commented Sep 4, 2025

  • Remove hardcoded GitHub client ID, make it configurable
  • Add input validation to shell scripts to prevent path traversal
  • Improve error handling in Python script to prevent info disclosure
  • Add URL validation to JavaScript extension to prevent XSS
  • Enhanced device validation in installer and flash scripts
  • Remove Python cache file and update .gitignore
  • Fix Python path validation to allow absolute paths and improve device/filename validation

Description of Changes

Type of Change

  • New Feature
  • Bug Fix
  • Improvement / Refactor

Related Issues / Tickets

Checklist

  • Clear summary in PR description
  • Detailed and meaningful commit message(s)
  • Commits are logically organized and squashed if appropriate
  • Contribution guidelines followed
  • Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
  • Author has run make-checks and it passes
  • All automatic GitHub Action checks pass - see actions
  • Author has added reviewers and removed PR draft status

Testing Instructions

Applicable Targets

  • Orin AGX aarch64
  • Orin NX aarch64
  • Lenovo X1 x86_64
  • Dell Latitude x86_64
  • System 76 x86_64

Installation Method

  • Requires full re-installation
  • Can be updated with nixos-rebuild ... switch
  • Other:

Test Steps To Verify:

  1. Test the installer for any x86 target
  2. Test the flashing of the AGX or NX device
  3. Check that the ability to create a bug report with the github token
  4. check that the "open in real browser" still works

- Remove hardcoded GitHub client ID, make it configurable
- Add input validation to shell scripts to prevent path traversal
- Improve error handling in Python script to prevent info disclosure
- Add URL validation to JavaScript extension to prevent XSS
- Enhanced device validation in installer and flash scripts
- Remove Python cache file and update .gitignore
- Fix Python path validation to allow absolute paths and improve device/filename validation

Signed-off-by: Brian McGillion <bmg.avoin@gmail.com>
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR addresses multiple security vulnerabilities identified by code scanning tools across the Ghaf framework. The changes focus on hardening input validation, preventing path traversal attacks, and improving error handling to prevent information disclosure.

Key changes include:

  • Replacing hardcoded GitHub client ID with configurable option
  • Adding comprehensive input validation to prevent path traversal in shell scripts and Python code
  • Implementing URL validation in JavaScript extension to prevent XSS attacks

Reviewed Changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
packages/pkgs-by-name/open-normal-extension/open_normal.js Added URL validation to prevent XSS attacks and improved error handling
packages/pkgs-by-name/ghaf-installer/ghaf-installer.sh Enhanced device name validation with regex patterns to prevent path traversal
packages/pkgs-by-name/flash-script/flash.sh Added input validation for device paths and filenames to prevent path traversal
modules/reference/hardware/jetpack/nvidia-jetson-orin/mk-esp-contents.py Improved error handling to prevent info disclosure and added path validation
modules/common/services/github.nix Made GitHub client ID configurable instead of hardcoded

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Brian McGillion <bmg.avoin@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Brian McGillion <bmg.avoin@gmail.com>
@leivos-unikie
Copy link
Copy Markdown
Contributor

Verified test steps 1-2

  1. Test the installer for any x86 target
  • Installed ghaf on lenovo-x1 with ghaf-installer. Ghaf boots ok.
  1. Test the flashing of the AGX or NX device
  • Built flash scirpt: nix build .#packages.x86_64-linux.nvidia-jetson-orin-agx-debug-from-x86_64-flash-script
  • Flashed Orin AGX with the flash script
  • Booted ghaf on AGX and checked that desktop works.

Agreed with Brian to ignore steps 3-4, they don't work currently in main.

@leivos-unikie leivos-unikie added Tested on Lenovo X1 Carbon This PR has been tested on Lenovo X1 Carbon Tested on Orin AGX Cross This PR has been tested on NVIDIA Jetson AGX Orin cross-compiled and removed Needs Testing CI Team to pre-verify labels Sep 9, 2025
@brianmcgillion brianmcgillion merged commit 1d7ef64 into tiiuae:main Sep 9, 2025
28 checks passed
@brianmcgillion brianmcgillion deleted the fix-sec-warn branch September 9, 2025 09:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Tested on Lenovo X1 Carbon This PR has been tested on Lenovo X1 Carbon Tested on Orin AGX Cross This PR has been tested on NVIDIA Jetson AGX Orin cross-compiled

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants