pelikhan · Oct 11, 2025 · Oct 11, 2025 · Oct 11, 2025 · Oct 11, 2025 · Oct 11, 2025
diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml
diff --git a/.github/workflows/changeset-generator.lock.yml b/.github/workflows/changeset-generator.lock.yml
diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml
diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml
diff --git a/.github/workflows/notion-issue-summary.lock.yml b/.github/workflows/notion-issue-summary.lock.yml
diff --git a/.github/workflows/security-fix-pr.lock.yml b/.github/workflows/security-fix-pr.lock.yml
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml
diff --git a/pkg/workflow/engine_network_hooks.go b/pkg/workflow/engine_network_hooks.go
@@ -2,7 +2,8 @@

 import (
 	"encoding/json"
 	"fmt"
+	// "strconv" removed; no longer needed
 	"strings"
 )
 
@@ -13,13 +14,20 @@
 func (g *NetworkHookGenerator) GenerateNetworkHookScript(allowedDomains []string) string {
 	// Convert domain list to JSON for embedding in Python
 	// Ensure empty slice becomes [] not null in JSON
-	var domainsJSON []byte
+	var domainsJSON string
 	if allowedDomains == nil {
-		domainsJSON = []byte("[]")
+		domainsJSON = "[]"
 	} else {
-		domainsJSON, _ = json.Marshal(allowedDomains)
+		jsonBytes, _ := json.Marshal(allowedDomains)
+		domainsJSON = string(jsonBytes)
 	}
 
+	// Embed domain list JSON directly as a Python literal (safe for []string from json.Marshal)
+	// This prevents any quote-related injection vulnerabilities (CWE-78, CWE-89, CWE-94)
+	// Use domainsJSON directly for ALLOWED_DOMAINS assignment
+
+	// Build the Python script using a safe template approach
+	// The JSON array is embedded directly as a Python list literal
 	return fmt.Sprintf(`#!/usr/bin/env python3
 """
 Network permissions validator for Claude Code engine.
@@ -32,6 +40,7 @@
 import re
 
 # Domain allow-list (populated during generation)
+# JSON array safely embedded as Python list literal
 ALLOWED_DOMAINS = %s
 
 def extract_domain(url_or_query):
@@ -101,7 +110,7 @@
 except Exception as e:
     print(f"Network validation error: {e}", file=sys.stderr)
     sys.exit(2)  # Block on errors
-`, string(domainsJSON))
+`, domainsJSON)
 }
 
 // GenerateNetworkHookWorkflowStep generates a GitHub Actions workflow step that creates the network permissions hook