fix(security): resolve CodeQL source code alerts and update GitHub Actions#1252
fix(security): resolve CodeQL source code alerts and update GitHub Actions#1252sriaradhyula merged 3 commits intomainfrom
Conversation
…tions Address 37 CodeQL code scanning alerts across Python and TypeScript: Clear-text logging: redact OAuth client_secret, access tokens, IP addresses, and kubectl commands from logs (rbac.py, oauth_setup.py, get_oauth_jwt_token.py, oauth2_middleware.py, aws/tools.py, aigateway/tools.py). Stack trace exposure: replace str(e) with generic messages in SSE error events (dynamic_agents/routes/chat.py), scan-content response (skills_middleware /router.py), and text ingest endpoint (restapi.py). URL sanitization: use urlparse hostname checks instead of substring matching in jira client, jira search, and readthedocs parser; use hostname === / endsWith() in skill-hubs routes and hub-crawl.ts. Path injection: add path boundary check in write_single_skill_to_temp_tree. YAML escaping: use JSON.stringify instead of manual quote escaping in agent config export (DynamicAgentsTab.tsx); extracted to yaml-serializer.ts util. GitHub Actions: bump harden-runner v2.17.0 to v2.18.0 (25 files) and super-linter v8.5.0 to v8.6.0. Tests: add test_git_tool.py, test_skill_scanner_runner.py, test_url_validation.py, test_sse_error_sanitization.py, test_parsers.py (ReadTheDocs), yaml-serializer.test.ts, url-validation.test.ts. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Sri Aradhyula <sraradhy@cisco.com>
Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Sri Aradhyula <sraradhy@cisco.com>
|
✅ No proprietary content detected. This PR is clear for review! |
1 similar comment
|
✅ No proprietary content detected. This PR is clear for review! |
🧪 CAIPE UI Test Results✅ All tests passed 🔴 Overall Coverage: 30%📊 Detailed Coverage
✅ Test Suites
📈 Coverage Thresholds
|
🐳 Prebuild Dynamic Agents Docker Image PublishedRepository: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-dynamic-agents:fix-npm-and-source-security-3Test in Helm valuesdynamic-agents:
image:
repository: ghcr.io/cnoe-io/prebuild/caipe-dynamic-agents
tag: "fix-npm-and-source-security-3"
|
🐳 Prebuild Dynamic Agents Docker Image PublishedRepository: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-dynamic-agents:fix-npm-and-source-security-2Test in Helm valuesdynamic-agents:
image:
repository: ghcr.io/cnoe-io/prebuild/caipe-dynamic-agents
tag: "fix-npm-and-source-security-2"
|
🐳 Prebuild CAIPE UI Docker Image PublishedRepository: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-ui:fix-npm-and-source-security-2Test in docker-compose# Update docker-compose.dev.yaml
caipe-ui:
image: ghcr.io/cnoe-io/prebuild/caipe-ui:fix-npm-and-source-security-2
# ... rest of config
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-webex:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedRepository: Usagedocker pull ghcr.io/cnoe-io/prebuild/ai-platform-engineering:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/mcp-jira:fix-npm-and-source-security-2
|
🐳 Prebuild CAIPE UI Docker Image PublishedRepository: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-ui:fix-npm-and-source-security-3Test in docker-compose# Update docker-compose.dev.yaml
caipe-ui:
image: ghcr.io/cnoe-io/prebuild/caipe-ui:fix-npm-and-source-security-3
# ... rest of config
|
🐳 Prebuild Docker Image PublishedComponent: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-rag-server:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedRepository: Usagedocker pull ghcr.io/cnoe-io/prebuild/ai-platform-engineering:fix-npm-and-source-security-3
|
🐳 Prebuild Docker Image PublishedComponent: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-rag-ingestors:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-gitlab:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-github:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedComponent: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-rag-agent-ontology:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-jira:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/mcp-jira:fix-npm-and-source-security-3
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-argocd:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-komodor:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-netutils:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedComponent: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-rag-agent-ontology:fix-npm-and-source-security-3
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-pagerduty:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedComponent: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-rag-server:fix-npm-and-source-security-3
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-victorops:fix-npm-and-source-security-2
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-aws:fix-npm-and-source-security-3
|
- Remove unused imports (pytest, write_skills_to_temp_tree, AsyncMock) flagged by ruff F401 in three test files - Drop sensitive error_msg from logger.warning/error calls in aws/tools.py and aigateway/tools.py (CodeQL clear-text-logging) - Replace resolve()+is_relative_to() boundary check with os.path.basename sanitizer in skill_scanner_runner.py (CodeQL path-injection) Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Sri Aradhyula <sraradhy@cisco.com>
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-weather:fix-npm-and-source-security-3
|
|
✅ No proprietary content detected. This PR is clear for review! |
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/mcp-jira:fix-npm-and-source-security-4
|
🐳 Prebuild CAIPE UI Docker Image PublishedRepository: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-ui:fix-npm-and-source-security-4Test in docker-compose# Update docker-compose.dev.yaml
caipe-ui:
image: ghcr.io/cnoe-io/prebuild/caipe-ui:fix-npm-and-source-security-4
# ... rest of config
|
🐳 Prebuild Dynamic Agents Docker Image PublishedRepository: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-dynamic-agents:fix-npm-and-source-security-4Test in Helm valuesdynamic-agents:
image:
repository: ghcr.io/cnoe-io/prebuild/caipe-dynamic-agents
tag: "fix-npm-and-source-security-4"
|
🐳 Prebuild Docker Image PublishedRepository: Usagedocker pull ghcr.io/cnoe-io/prebuild/ai-platform-engineering:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedComponent: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-rag-ingestors:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedComponent: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-rag-server:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-netutils:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedComponent: Usagedocker pull ghcr.io/cnoe-io/prebuild/caipe-rag-agent-ontology:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-confluence:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-gitlab:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-victorops:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-jira:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-github:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-splunk:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-template:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-aws:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-argocd:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-backstage:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-pagerduty:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-weather:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-slack:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-komodor:fix-npm-and-source-security-4
|
🐳 Prebuild Docker Image PublishedAgent: Usagedocker pull ghcr.io/cnoe-io/prebuild/agent-webex:fix-npm-and-source-security-4
|
Summary
rbac.py,oauth_setup.py,get_oauth_jwt_token.py,oauth2_middleware.py,aws/tools.py,aigateway/tools.pystr(e)with generic"An internal error occurred"in SSE error events (chat.py), scan-content responses (router.py), and HTTP error responses (restapi.py)urlparsehostname checks instead of substring matching in Jira client, Jira search, and ReadTheDocs parser; usehostname ===/endsWith()in TypeScript skill-hubs routes andhub-crawl.tsresolve()+is_relative_to()boundary check inwrite_single_skill_to_temp_tree; existing regex sanitization already prevents traversalJSON.stringifyinstead of manualreplace(/"/g, '\\"')in agent config YAML export; extractedtoYamlto testableyaml-serializer.tsutilityharden-runnerv2.17.0 → v2.18.0 andsuper-linterv8.5.0 → v8.6.0add-new-agent-helm-chart.py, scanner result passthrough inrouter.pyTest plan
test_git_tool.py(13 tests, SSH URL + false-positive coverage),test_skill_scanner_runner.py(7 tests, path sanitization),test_url_validation.py(Jira example.com detection),test_sse_error_sanitization.py(SSE error sanitization)test_parsers.pywith ReadTheDocs hostname validation testsyaml-serializer.test.ts(14 tests),url-validation.test.ts(12 tests for skill-hubs and hub-crawl)