Repository navigation
[uk-ai-resilience] UK AI Governance: untrusted network data written to file in scripts/ensure-docs-slide-pdf.js (Tier C) #53737
Description
UK AI Governance — Tier C: Untrusted network data written to disk without validation
Tier: C — Restricted Pending Review
Source: CodeQL alert #654 (js/http-to-file-access, severity: warning)
File: scripts/ensure-docs-slide-pdf.js
Risk-scoring breakdown
| Dimension | Score |
|---|---|
| Exposure amplification | Low (docs build script only, not user-facing runtime) |
| Patchability | High (simple content validation fix) |
| Detectability | Low (no runtime alerting/observability today) |
| Operational fragility | Low |
| Ownership confidence | Medium |
Finding
CodeQL flagged that network response data is written to the file system without further validation in the docs build script, which "allows arbitrary file upload and might indicate a backdoor" per the rule description. This was surfaced as part of the recent-changes-focused UK AI Open Code Risk & Resilience Governance review (7-day lookback).
Remediation action
Validate/sanitize the network response content before writing to disk in scripts/ensure-docs-slide-pdf.js — e.g., verify content-type, enforce a size limit, and/or checksum the expected artifact rather than trusting the raw HTTP response body.
SLA urgency: High
Governance report
Full context, asset graph, and control-verification findings are in the linked governance discussion report (UK AI Open Code Risk & Resilience Governance — 2026-08-18).
Generated by UK AI Operational Resilience · auto · 51.6 AIC · ⌖ 2.27 AIC · ⊞ 9.3K · ◷
Activity
github-actions commentedon Aug 18, 2026
🍪 Issue Monster selected this for Copilot
I identified this issue as a strong candidate for automated resolution and requested assignment to the Copilot coding agent.
This topic is independent from the other issues selected in this run, which helps avoid conflicting changes.
Om nom nom! 🍪