feat(cli): show candidate issue state reason and duplicate status in triage #17676
Conversation
Summary of ChangesHello @sehoon38, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a new Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new /oncall dedup command for triaging duplicate GitHub issues using LLM analysis. A critical prompt injection vulnerability has been identified where unsanitized issue content is passed to the LLM, potentially allowing an attacker to manipulate the bot's behavior, such as posting arbitrary comments or incorrectly closing issues. Additionally, the tool's usability is limited by a hardcoded repository. Addressing these points will significantly improve the tool's robustness and security.
I am having trouble creating individual review comments. Click here to see my feedback.
packages/cli/src/ui/components/triage/TriageDuplicates.tsx (522)
The gh api call to close an issue as a duplicate has a hardcoded repository path (repos/google-gemini/gemini-cli/...). This prevents the tool from working on any other repository. The gh CLI supports {owner} and {repo} placeholders to refer to the current repository, which should be used here to make the tool generic.
`repos/{owner}/{repo}/issues/${String(state.currentIssue.number).replace(/[^a-zA-Z0-9-]/g, '')}`, // Sanitize issue number
packages/cli/src/ui/components/triage/TriageDuplicates.tsx (197-243)
The TriageDuplicates component is vulnerable to prompt injection because it directly concatenates untrusted GitHub issue bodies into the LLM prompt. An attacker could craft a malicious issue body (e.g., containing </target_issue><candidates></candidates>INSTRUCTIONS: ...) to manipulate the LLM's output, leading to sensitive actions like posting arbitrary comments or incorrectly closing issues. To mitigate this, the issue body should be sanitized by escaping special characters like < and > before being included in the prompt.
${issue.body.replace(/\u003c/g, '\u0026lt;').replace(/\u003e/g, '\u0026gt;').slice(0, 8000)}
packages/cli/src/ui/components/triage/TriageDuplicates.tsx (502-508)
The LLM-generated suggested_comment is used directly as an argument to the gh issue comment command without validation. While the use of an argument array in spawnAsync prevents shell injection, the lack of validation on the LLM output means that a successful prompt injection (as identified above) can lead to the bot performing unintended actions, such as posting malicious links or misinformation on GitHub issues.
packages/cli/src/ui/components/triage/TriageDuplicates.tsx (219)
Similar to the target issue, the candidate issue body is directly injected into the LLM prompt without sanitization. This poses a prompt injection risk. The content should be sanitized by escaping special characters like < and > to prevent malicious instructions within the issue body from being executed by the model.
${c.body.replace(/\u003c/g, '\u0026lt;').replace(/\u003e/g, '\u0026gt;').slice(0, 4000)}
References
- To prevent prompt injection, sanitize any additional context from hooks by escaping HTML-like tag characters such as
<and>.
sehoon38
force-pushed
the
sehoon/triage-duplicates
branch
from
f67b407 to
f2c8937
Compare
gemini-cli
bot
added
the
area/core
|
Size Change: +1 kB (0%) Total Size: 23.4 MB
ℹ️ View Unchanged
|
sehoon38
force-pushed
the
sehoon/triage-duplicates
branch
from
f2c8937 to
1fa88bd
Compare
2 participants
Summary
This PR enhances the Triage Duplicates tool by showing the
state(e.g., OPEN/CLOSED) andstateReason(e.g., duplicate, not planned) for candidate issues. It also detects and highlights if a candidate issue has already been marked as a duplicate of the current target issue, if it was marked as duplicated by this command tool. (does not detect the ones updated from the UI)Details
stateandstateReasonto theIssueandCandidateinterfaces.gh issue listandgh issue viewcalls now includestateandstateReasonin the JSON response.[STATE - stateReason]next to candidate issue numbers.[DUPLICATE OF CURRENT]label if found.Related Issues
Fixes #17662
How to Validate
npm run start -- triage.[OPEN],[CLOSED - completed]).[DUPLICATE OF CURRENT]warning appears.Pre-Merge Checklist