Skip to content

[security-fix] Security Fix: Unsafe Quoting in Network Hook Generation (Alert #9) #1521

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 5 commits into from
Oct 11, 2025
Merged

[security-fix] Security Fix: Unsafe Quoting in Network Hook Generation (Alert #9) #1521

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2111055
Fix unsafe quoting vulnerability in network hook generation
github-actions[bot] Oct 11, 2025
e7a4b9a
Potential fix for code scanning alert no. 15: Potentially unsafe quoting
pelikhan Oct 11, 2025
6ffbecf
[WIP] Fix unsafe quoting in network hook generation (#1522)
Copilot Oct 11, 2025
7369db0
[WIP] Fix unsafe quoting in network hook generation (#1524)
Copilot Oct 11, 2025
0934789
Add changeset for security fix: unsafe quoting in network hooks
github-actions[bot] Oct 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Potential fix for code scanning alert no. 15: Potentially unsafe quoting 
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
  • Loading branch information
@pelikhan @github-advanced-security
pelikhan and github-advanced-security[bot] authored Oct 11, 2025
commit e7a4b9a4d020286b4dc3c3c368301457467e929c
12 changes: 6 additions & 6 deletions pkg/workflow/engine_network_hooks.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
import (
"encoding/json"
"fmt"
"strconv"
// "strconv" removed; no longer needed
"strings"
)

Expand All @@ -14,7 +14,7 @@
func (g *NetworkHookGenerator) GenerateNetworkHookScript(allowedDomains []string) string {
// Convert domain list to JSON for embedding in Python
// Ensure empty slice becomes [] not null in JSON
var domainsJSON string

Check failure on line 17 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Run Unit Tests 

declared and not used: domainsJSON

Check failure on line 17 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Build Code and Recompile (ubuntu-latest) 

declared and not used: domainsJSON

Check failure on line 17 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Lint Code 

declared and not used: domainsJSON

Check failure on line 17 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Lint Code 

declared and not used: domainsJSON

Check failure on line 17 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Lint Code 

declared and not used: domainsJSON

Check failure on line 17 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Test Agentics Repository Integration 

declared and not used: domainsJSON

Check failure on line 17 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Run Unit Tests 

declared and not used: domainsJSON

Check failure on line 17 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Build Code and Recompile (ubuntu-latest) 

declared and not used: domainsJSON

Check failure on line 17 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Lint Code 

declared and not used: domainsJSON

Check failure on line 17 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Lint Code 

declared and not used: domainsJSON

Check failure on line 17 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Lint Code 

declared and not used: domainsJSON
if allowedDomains == nil {
domainsJSON = "[]"
} else {
Expand All @@ -22,12 +22,12 @@
domainsJSON = string(jsonBytes)
}

// Use strconv.Quote to safely escape the JSON string for Python
// Embed domain list JSON directly as a Python literal (safe for []string from json.Marshal)
// This prevents any quote-related injection vulnerabilities (CWE-78, CWE-89, CWE-94)
quotedJSON := strconv.Quote(domainsJSON)
// Use domainsJSON directly for ALLOWED_DOMAINS assignment

// Build the Python script using a safe template approach
// The JSON string is properly quoted and escaped, then parsed at runtime
// The JSON array is embedded directly as a Python list literal
return fmt.Sprintf(`#!/usr/bin/env python3
"""
Network permissions validator for Claude Code engine.
Expand All @@ -40,8 +40,8 @@
import re

# Domain allow-list (populated during generation)
# JSON string is safely escaped using Go's strconv.Quote
ALLOWED_DOMAINS = json.loads(%s)
# JSON array safely embedded as Python list literal
ALLOWED_DOMAINS = %s

def extract_domain(url_or_query):
"""Extract domain from URL or search query."""
Expand Down Expand Up @@ -110,7 +110,7 @@
except Exception as e:
print(f"Network validation error: {e}", file=sys.stderr)
sys.exit(2) # Block on errors
`, quotedJSON)

Check failure on line 113 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Run Unit Tests 

undefined: quotedJSON

Check failure on line 113 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Build Code and Recompile (ubuntu-latest) 

undefined: quotedJSON

Check failure on line 113 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Lint Code 

undefined: quotedJSON) (typecheck)

Check failure on line 113 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Lint Code 

undefined: quotedJSON (typecheck)

Check failure on line 113 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Lint Code 

undefined: quotedJSON) (typecheck)

Check failure on line 113 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Test Agentics Repository Integration 

undefined: quotedJSON

Check failure on line 113 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Run Unit Tests 

undefined: quotedJSON

Check failure on line 113 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Build Code and Recompile (ubuntu-latest) 

undefined: quotedJSON

Check failure on line 113 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Lint Code 

undefined: quotedJSON) (typecheck)

Check failure on line 113 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Lint Code 

undefined: quotedJSON (typecheck)

Check failure on line 113 in pkg/workflow/engine_network_hooks.go

View workflow job for this annotation

GitHub Actions / Lint Code 

undefined: quotedJSON) (typecheck)
Comment thread Fixed
}

// GenerateNetworkHookWorkflowStep generates a GitHub Actions workflow step that creates the network permissions hook
Expand Down
Loading