UK AI Governance — Tier C: Untrusted network data written to disk without validation
Tier: C — Restricted Pending Review
Source: CodeQL alert #654 (js/http-to-file-access, severity: warning)
File: scripts/ensure-docs-slide-pdf.js
Risk-scoring breakdown
| Dimension |
Score |
| Exposure amplification |
Low (docs build script only, not user-facing runtime) |
| Patchability |
High (simple content validation fix) |
| Detectability |
Low (no runtime alerting/observability today) |
| Operational fragility |
Low |
| Ownership confidence |
Medium |
Finding
CodeQL flagged that network response data is written to the file system without further validation in the docs build script, which "allows arbitrary file upload and might indicate a backdoor" per the rule description. This was surfaced as part of the recent-changes-focused UK AI Open Code Risk & Resilience Governance review (7-day lookback).
Remediation action
Validate/sanitize the network response content before writing to disk in scripts/ensure-docs-slide-pdf.js — e.g., verify content-type, enforce a size limit, and/or checksum the expected artifact rather than trusting the raw HTTP response body.
SLA urgency: High
Governance report
Full context, asset graph, and control-verification findings are in the linked governance discussion report (UK AI Open Code Risk & Resilience Governance — 2026-08-18).
Generated by UK AI Operational Resilience · auto · 51.6 AIC · ⌖ 2.27 AIC · ⊞ 9.3K · ◷
UK AI Governance — Tier C: Untrusted network data written to disk without validation
Tier: C — Restricted Pending Review
Source: CodeQL alert #654 (
js/http-to-file-access, severity: warning)File:
scripts/ensure-docs-slide-pdf.jsRisk-scoring breakdown
Finding
CodeQL flagged that network response data is written to the file system without further validation in the docs build script, which "allows arbitrary file upload and might indicate a backdoor" per the rule description. This was surfaced as part of the recent-changes-focused UK AI Open Code Risk & Resilience Governance review (7-day lookback).
Remediation action
Validate/sanitize the network response content before writing to disk in
scripts/ensure-docs-slide-pdf.js— e.g., verify content-type, enforce a size limit, and/or checksum the expected artifact rather than trusting the raw HTTP response body.SLA urgency: High
Governance report
Full context, asset graph, and control-verification findings are in the linked governance discussion report (UK AI Open Code Risk & Resilience Governance — 2026-08-18).