fix: resolve CodeQL security alerts and update Rust time crate - #269
Merged
Conversation
CodeQL fixes (30 alerts → 8 dismissed as false positives, 22 fixed): Command injection (#121): - system.ts: replace shell interpolation with execFileSync (no user input in command string) TOCTOU race conditions (#105, #109, #120, #122): - pipeline-config.ts: remove existsSync guard, catch ENOENT from statSync - aletheia.ts: try/catch readFileSync instead of existsSync check - export.ts: post-read size validation to avoid stat/read race - workspace.ts: remove existsSync guard, catch ENOENT in error handler Insecure temp files (#96-102, #106-108, #115-119, #123): - All test files: use mkdtempSync() instead of predictable /tmp paths - project-files.ts: add PID+timestamp to atomic write temp file names Dismissed as false positives (with explanations): - #103, #104: recall.ts sends queries to localhost memory sidecar (by design) - #111-114: propose-patch.ts intentional read-modify-test-rollback workflow - #127, #128: retrospective.ts writes to workspace dirs, not temp dirs Dependabot fix: - Bump TUI rust-version from 1.85 to 1.88 to allow time 0.3.47 (fixes CVE-2026-25727 stack exhaustion DoS)
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if (isTextFile(entry) && stat.size <= MAX_FILE_SIZE) { | ||
| try { | ||
| files[relPath] = readFileSync(fullPath, "utf-8"); | ||
| const data = readFileSync(fullPath, "utf-8"); |
Check failure
Code scanning / CodeQL
Potential file system race condition High
Runtime (Node): - @hono/node-server 1.14.0 → 1.19.9 - @modelcontextprotocol/sdk 1.26.0 → 1.27.1 - hono 4.12.2 → 4.12.3 - tslog 4.9.3 → 4.10.2 - zod 3.24.2 → 3.25.76 (latest v3; v4 blocked by SDK peer deps) - @types/node 25.3.0 → 25.3.2 - tsx 4.19.2 → 4.21.0 - typescript 5.7.3 → 5.9.3 UI (Node): - @sveltejs/vite-plugin-svelte 5.0.0 → 6.2.4 - @testing-library/svelte 5.0.0 → 5.3.1 - jsdom 26.0.0 → 28.1.0 - oxlint 1.48.0 → 1.50.0 - svelte-check 4.0.0 → 4.4.4 - typescript 5.7.0 → 5.9.3 - vite 6.0.0 → 7.3.1 - vitest 3.0.0 → 4.0.18 - dompurify 3.2.0 → 3.3.1 - highlight.js 11.11.0 → 11.11.1 - marked 15.0.0 → 17.0.3 - three 0.182.0 → 0.183.1 TUI (Rust): - toml 0.8 → 1.0 - 20 transitive crate updates (rustls, zerocopy, wasm-bindgen, etc.) - reqwest stays at 0.12 (reqwest-eventsource 0.6 lacks 0.13 support) Python sidecar: - fastapi 0.133.0 → 0.133.1 - ruff 0.15.2 → 0.15.4 Verified: tsc ✓, svelte-check ✓, cargo check ✓, vitest 2382/2382 ✓, UI tests 35/35 ✓, vite build ✓, tsdown build ✓
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all actionable security alerts from the GitHub security tab.
CodeQL Fixes (22 alerts fixed by code changes)
execFileSyncreplaces shell interpolation in system.tsexistsSyncguards; use try/catch on actual fs opsmkdtempSync()replaces predictable/tmppathsDismissed as False Positives (8 alerts, with explanations)
recall.tssends queries to localhost memory sidecar — by designpropose-patch.tsintentional read-modify-test-rollback workflowretrospective.tswrites to workspace dirs, CodeQL misidentifies as tempDependabot Fix
rust-version1.85 → 1.88 to unlocktime0.3.47 (fixes CVE-2026-25727)cargo checkpasses on Rust 1.93Remaining After Merge
Once CodeQL re-scans post-merge, the 22 code-fix alerts should auto-close. The 8 dismissed alerts stay dismissed. The Dependabot
timealert closes when the updated Cargo.lock hits main. Expected: 0 open alerts.