fix: Fetch remote branch before creating worktree

[finxo]

Pull Request

📝 Summary

This PR fixes a potential error in the setup_worktree operation where creating a worktree from a remote branch could fail. The failure occurred if the branch existed on the remote but its reference had not yet been fetched to the local repository. This change ensures the branch is fetched before the worktree is created.

🔧 Changes Made

• In setup_worktree, added a git_client.fetch call for the specified remote and branch.
• This ensures the remote reference (e.g., origin/feature-branch) is available locally before the git worktree add command is executed.

🧪 Testing

• Unit tests added/updated (poetry run pytest)
• All tests passing (make test)
• Manual testing with titan-dev

📊 Logs

• No new log events

✅ Checklist

• Self-review done
• Follows the project's logging rules (no secrets, no content in logs)
• New and existing tests pass
• Documentation updated if needed

[wiz-40084b5e03]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	1
Software Management Findings	-
Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[wiz-40084b5e03]

 SAST Finding

SQL Injection in Manually Constructed Queries (CWE-89)

More Details

SQL injection is a technique where malicious SQL statements are inserted into application-generated queries to manipulate the database. This vulnerability arises when user input is directly concatenated into SQL queries without proper sanitization. An attacker can craft input that modifies the intended logic of the query, potentially allowing unauthorized data access, modification, or deletion. The consequences can be severe, including data breaches, data corruption, and complete system compromise. To avoid SQL injection, always use parameterized queries or prepared statements that separate user input from the query logic. Never construct dynamic SQL queries by concatenating user input.

Attribute	Value
Impact
Likelihood

Remediation

SQL injection is a technique where malicious SQL statements are inserted into application-generated queries to manipulate the database. This can lead to unauthorized data access, data loss, and even full system compromise. SQL injection attacks are a serious threat to web applications that interact with databases.

To remediate SQL injection vulnerabilities, user input should never be directly concatenated into SQL queries. Instead, use parameterized queries or prepared statements provided by your database library. These mechanisms automatically escape user input and prevent it from being interpreted as part of the SQL query.

Code examples:

// VULNERABLE CODE - User input is concatenated into the SQL query
query = "SELECT * FROM users WHERE name = '" + user_input + "'"
cursor.execute(query)

// SECURE CODE - User input is passed as a parameter to the query
query = "SELECT * FROM users WHERE name = ?"
cursor.execute(query, (user_input,))

Additional recommendations:

• Follow the principle of least privilege and only grant the minimum required database permissions.
• Use the latest versions of database libraries and frameworks, as they often include security improvements.
• Implement input validation and sanitization to filter out malicious input before it reaches the database layer.
• Regularly review and test your application for SQL injection vulnerabilities, especially after making changes or updates.
• Adhere to secure coding practices outlined in standards like the OWASP Top 10 and the CERT Secure Coding Standards.
• Consider using an Object-Relational Mapping (ORM) library, which can provide an additional layer of abstraction and security when interacting with databases.
• As an alternative approach, consider using NoSQL databases or other data storage solutions that are less susceptible to SQL injection attacks.

Rule ID: WS-PYTHON-00330

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason

If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate