Repository navigation
[uk-ai-resilience] [UK AI Governance] Verify/parameterize GraphQL query construction in project_command.go (code scanning warnings) #52749
Description
Activity
🍪 Issue Monster selected this for Copilot
I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
🍪 Om nom nom by Issue Monster · gpt54 · 3.58 AIC · ⌖ 8.98 AIC · ⊞ 13.1K · ◷
- linked a pull request that will close this issueHarden `project_command` GraphQL construction against interpolation-based injection #52758
on Aug 14, 2026
Context
UK AI Open Code Risk & Resilience Governance run (2026-08-14, 7-day lookback) — see discussion report for full analysis.
Tier
Tier B — Open With Conditions
Risk-scoring breakdown
Finding
Two open code-scanning alerts (warning severity), rule
workflow-go-graphql-injection-sprintf, both inpkg/cli/project_command.go:These flag GraphQL query strings built via
Sprintf-style formatting, which risks GraphQL injection if any interpolated value originates from untrusted/user-controlled input.Remediation action
Review both call sites and either (a) confirm all interpolated values are compile-time constants or already-validated/allow-listed identifiers (and add a code comment/test asserting this), or (b) migrate to parameterized GraphQL queries (variables) instead of string formatting to eliminate the injection class entirely.
SLA urgency
High — target remediation or documented risk acceptance within 14 days.
Report
See the full UK AI Open Code Risk & Resilience Governance discussion report generated in this run for asset graph, control verification, and full remediation queue.