Repository navigation
[uk-ai-resilience] Untracked GraphQL sprintf alerts #651/#652 in project_command.go #64527
Description
Activity
🍪 Issue Monster selected this for Copilot
I identified this as a strong automated-fix candidate in the CLI GraphQL/query-construction area and requested assignment to the Copilot coding agent.
If assignment succeeds, Copilot will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪
🍪 Om nom nom by Issue Monster · pi · gpt54 · 6.75 AIC · ⌖ 10.6 AIC · ⊞ 14.1K · ◷
Tier B — Untracked GraphQL string-interpolation alerts #651/#652
Location:
pkg/cli/project_command.go:269,272(ruleworkflow-go-graphql-injection-sprintf, open since 2026-07-24, no tracking issue).Risk scoring (1–5): exposure 3, patchability 2, detectability 2, fragility 2, ownership 4 → priority high.
Remediation: build queries with GraphQL variables (or strictly validate/escape inputs) instead of
fmt.Sprintf; add a unit test with hostile input.SLA: high (≈7 days). Human review trigger: ownership confidence low (no CODEOWNERS, see #61637).
Discussion report: see the "UK AI governance report - 2026-09-30" discussion created in this run.