fix: the build-digest in build-digest.py - #1173
Conversation
Automated security fix generated by OrbisAI Security Signed-off-by: orbisai0security <mediratta@gmail.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthrough
ChangesDigest path validation
Estimated code review effort: 2 (Simple) | ~5 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@build-digest.py`:
- Around line 109-110: Update the path handling around content_dir and
output_file so canonical absolute paths remain available for filesystem
operations but are not emitted in the generated digest source line or completion
message. Preserve the original arguments as display values, or convert them to
repository-relative/generic paths, and use those sanitized values at the output
sites near the digest generation and completion logging.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
Maanvi212006
left a comment
Maanvi212006
left a comment
There was a problem hiding this comment.
The code change itself is fine and mildly useful — .resolve() and the new directory-existence check are harmless improvements. Just address CodeRabbit's comment: since paths are now absolute, they leak into the generated digest header and completion log.
|
Addressed review comments. Pls review. |
Maanvi212006
left a comment
Maanvi212006
left a comment
There was a problem hiding this comment.
Follow the steps given on this link to fix this issue:
https://github.com/layer5io/docs/pull/1173/checks?check_run_id=89745033442
Preserve the original CLI arguments as display values so that resolved absolute paths are not emitted in the generated digest header, error messages, or the completion log. Also add a docstring to main() to satisfy the 80% docstring coverage threshold. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Anupam Mediratta <mediratta@gmail.com>
b0261a1 to
523c55b
Compare
|
signed off. pls review. |
2 participants
Summary
Fix high severity security issue in
build-digest.py.Vulnerability
V-001build-digest.py:105Description: The build-digest.py script accepts command-line arguments directly from sys.argv without sanitization. If these arguments are passed to shell commands without proper escaping, an attacker controlling the arguments could inject shell metacharacters to execute arbitrary commands on the build host.
Evidence
Exploitation scenario: Attacker with control over build script arguments (e.g., through CI/CD pipeline manipulation) supplies malicious arguments containing shell metacharacters: python build-digest.py 'content/; rm -rf.
Scanner confirmation: multi_agent_ai rule
V-001flagged this pattern.Production code: This file is in the production codebase, not test-only code.
Threat Model Context
This is a Node.js library - vulnerabilities affect downstream consumers who use this package.
Changes
build-digest.pyBehavior Preservation
The change is scoped to 1 file on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.
Verification
Automated security fix by OrbisAI Security
Summary by CodeRabbit
stderrerror and exit with code1when the specified content directory is missing or not a directory.