fix(security): close open CodeQL alerts (0600 lock file, hostname-safe URL asserts, pinned actions)#589
Open
the-data-viking wants to merge 2 commits into
Open
fix(security): close open CodeQL alerts (0600 lock file, hostname-safe URL asserts, pinned actions)#589the-data-viking wants to merge 2 commits into
the-data-viking wants to merge 2 commits into
Conversation
…L asserts, pinned actions - checkpoint.py: create the checkpoint lock file 0600 instead of 0o644 (py/overly-permissive-file). - tests: replace URL substring/prefix assertions with urllib.parse hostname comparisons in test_credentials and test_pack_calibrate (py/incomplete-url-substring-sanitization). - workflows: pin pypa/gh-action-pypi-publish and the four docker/* actions to commit SHAs (actions/unpinned-tag). The py/clear-text-logging-sensitive-data alerts (pack-diff gender composition of synthetic personas; printing the *name* of the SynthBench API key env var) are heuristic false positives and were dismissed with comments rather than masked. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Deploying synthpanel with
|
| Latest commit: |
d050d99
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://45b76f33.synthpanel.pages.dev |
| Branch Preview URL: | https://fix-codeql-alert-sweep.synthpanel.pages.dev |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…satisfy CodeQL '"console.anthropic.com" in linked_hosts' is exact-match against a list of parsed hostnames, but py/incomplete-url-substring-sanitization flags any 'in' test with a hostname-like literal. Use an explicit == comparison instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes out the CodeQL alerts surfaced when #587 re-attributed pre-existing lines.
Code fixes
src/althing/checkpoint.py:172): the checkpoint.lockfile was created0o644; now0o600. Verified locally that the file lands on disk as0600.tests/test_credentials.py:"console.anthropic.com" in msg→ extract URLs from the message and compareurlparse(...).hostname.tests/test_pack_calibrate.py:startswith("https://althing.dev")(spoofable byalthing.dev.evil.com) → assert parsed scheme + hostname equal("https", "althing.dev").publish.yml:pypa/gh-action-pypi-publish→ba38be9e(v1.14.1, the currentrelease/v1head; matches the pin style already used in publish-test.yml)docker.yml:docker/setup-qemu-action→ v4.2.0,docker/setup-buildx-action→ v4.2.0,docker/login-action→ v4.4.0,docker/build-push-action→ v7.3.0Dismissed as false positives (not fixed in code)
The three py/clear-text-logging-sensitive-data alerts are name-heuristic hits, not actual secret/PII logging, and were dismissed with comments:
cli/commands.pypack-diff output (2 alerts): prints the aggregate gender composition of synthetic persona packs — thegender_splitfield name trips CodeQL's "private" heuristic. Masking it would gutalthing pack diff.cli/commands.pySynthBench submit guard (1 alert): prints the name of the required env var (SYNTHBENCH_API_KEY) in a "set this variable" error; the key's value is never read into the message.Verification
ruff check/ruff format --checkclean on touched files._acquire_dir_lock→stat→0o600).🤖 Generated with Claude Code