[uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B)

UK AI Governance — Tier B: recurring `go/bad-redirect-check` false positive across path-traversal guards

Tier: B — Open With Conditions
Source discussion report: see the "UK AI Governance: recent-change risk review (2026-08-24 to 2026-08-31)" discussion created by this run.

Risk-scoring breakdown

Dimension	Rating
Exposure amplification	Low
Patchability	High
Detectability	High (CodeQL)
Operational fragility	Low
Ownership confidence	Medium
Overall	Low-Medium

Finding

Three open CodeQL go/bad-redirect-check alerts (severity: error) flag path-traversal guard functions as if they were redirect handlers:

Codex fails to report failure if unauthorised #668, [Custom Engine Test] Test Issue Created by Custom Engine #669 in pkg/workflow/graders_config.go (lines 441, 448), function IsValidOperationalValueEvaluatorRunPath — validates operational-value evaluator .sh script paths, rejecting empty components, ., .., and paths containing \.
[Custom Engine Test] Test Pull Request - Custom Engine Safe Output #667 in pkg/cli/add_package_manifest_includes.go (line 146), function cleanManifestRelativePath — validates manifest include/destination paths, rejecting absolute paths and traversal outside the root.

CodeQL's message for all three is: "This is a check that this value, which flows into a redirect, has a leading slash, but not that it does not have '/' or '' in its second position." This is the same false-positive shape already assessed for a sibling function cleanManifestRelativePath in pkg/cli/add_package_manifest.go, tracked in still-open issue #54037 (Tier B). None of these three functions produce HTTP redirects; they are filesystem path validators used at workflow-compile time and CLI manifest-processing time.

Remediation action

Consolidate fix across all three flagged functions in one PR:
- Either add an explicit CodeQL suppression annotation with rationale (path-traversal guard, not a redirect handler), or
- Harden each guard to additionally reject a \ (backslash) immediately following the leading /, which silences the CodeQL heuristic without weakening security.
Cross-reference and close out [uk-ai-resilience] UK AI Governance: unreviewed CodeQL go/bad-redirect-check alert in add_package_manifest.go (Tier B) #54037 alongside this fix if the same PR addresses that sibling occurrence too, to avoid duplicate open Tier B tracking for the same underlying pattern.

SLA urgency

Medium — low exploitability (these are not redirect handlers, no user-facing redirect surface), but should be closed to prevent continued alert noise and to keep the Tier B backlog from growing across governance cycles.

Generated by UK AI Operational Resilience · copilot · auto · 55.7 AIC · ⌖ 9.97 AIC · ⊞ 8.1K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.58 AIC · ⌖ 0.758 AIC · ⊞ 20.3K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.26 AIC · ⌖ 0.527 AIC · ⊞ 19.1K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.39 AIC · ⌖ 0.605 AIC · ⊞ 20.3K · ◷

🍪 Issue Monster selected this for Copilot

I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.79 AIC · ⌖ 0.447 AIC · ⊞ 19.1K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.47 AIC · ⌖ 0.534 AIC · ⊞ 20.3K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.14 AIC · ⌖ 1.17 AIC · ⊞ 19.2K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.63 AIC · ⌖ 0.454 AIC · ⊞ 20.5K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.24 AIC · ⌖ 0.617 AIC · ⊞ 20.5K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 4.41 AIC · ⌖ 0.537 AIC · ⊞ 19.4K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.33 AIC · ⌖ 0.621 AIC · ⊞ 20.5K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.43 AIC · ⌖ 19.1 AIC · ⊞ 19.9K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.6 AIC · ⌖ 19.9 AIC · ⊞ 21.1K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 4.94 AIC · ⌖ 19 AIC · ⊞ 19.9K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.5 AIC · ⌖ 23.3 AIC · ⊞ 19.9K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.45 AIC · ⌖ 11.4 AIC · ⊞ 21.1K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 3.31 AIC · ⌖ 22.6 AIC · ⊞ 19.7K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.4 AIC · ⌖ 15.2 AIC · ⊞ 21K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.93 AIC · ⌖ 28.9 AIC · ⊞ 21K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 4.61 AIC · ⌖ 34.1 AIC · ⊞ 19.7K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.04 AIC · ⌖ 52.8 AIC · ⊞ 20.9K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.22 AIC · ⌖ 18.9 AIC · ⊞ 20.8K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.98 AIC · ⌖ 30.4 AIC · ⊞ 20.8K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 4.05 AIC · ⌖ 15 AIC · ⊞ 20.7K · ◷

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.64 AIC · ⌖ 19.4 AIC · ⊞ 20.7K · ◷

Navigation Menu

Repository navigation

[uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472

UK AI Governance — Tier B: recurring `go/bad-redirect-check` false positive across path-traversal guards

Risk-scoring breakdown

Finding

Remediation action

SLA urgency

32 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472

Description

UK AI Governance — Tier B: recurring go/bad-redirect-check false positive across path-traversal guards

Risk-scoring breakdown

Finding

Remediation action

SLA urgency

Activity

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

github-actions commented on Aug 31, 2026

32 remaining items

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 3, 2026

github-actions commented on Sep 4, 2026

github-actions commented on Sep 4, 2026

github-actions commented on Sep 5, 2026

github-actions commented on Sep 5, 2026

github-actions commented on Sep 5, 2026

github-actions commented on Sep 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

UK AI Governance — Tier B: recurring `go/bad-redirect-check` false positive across path-traversal guards