Fix open CodeQL findings - #391
Conversation
Bundle Size Report
|
|
@codex review this |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7dab7e1638
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review again |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
Root causes
resolveAgentChannelapplied an ambiguous repeated-slash regular expression to configuration-backed path strings, allowing quadratic backtracking on non-matching long inputs. The Telegram proof doctor also usedsh -cfor executable discovery; although the candidate command was passed positionally, the shell boundary caused environment-derived executable paths to reach a shell-command sink.The remaining three alerts were fixed test-fixture URLs used only in string-formatting assertions. They have no production reachability, URL parsing, network request, redirect, or trust-boundary role and were individually dismissed as false positives with that justification.
Validation
pnpm test:file tests/config.test.ts tests/oca-codex-telegram-proof.test.tspnpm verifypnpm check-plugin-securitypnpm audit --prodgit diff --checkOperational boundary
This PR does not merge itself, modify
main, deploy, release, or change runtime configuration.