Repository navigation
[night-issues: Security Audit - Fix Pass] #4590
Description
Activity
Mitigation PR: #4591 (
3577b5a55f)- Alerts build(deps): bump junit5.version from 6.0.2 to 6.1.2 #2077–build(deps): bump jackson.version from 3.1.5 to 3.2.1 #2081 (
PSServerXmlObjectStoresaveApplicationFileexists/isFile/mkdirs/isDirectorylines 730/731/741/742): runtimerequireFileUnderRxDir→requireUnderBase(RxDir)already on main (PR cluster: absorb CodeQL path-injection #4349 #4350 #4351 #4352). Same-line// codeql[java/path-injection]since 2026-09-05; not re-edited (re-fingerprint thrash). - Alert docs(505): close-out #1920 catalog/system/ui Jackson re-inventory #2076 (
ApplicationFileAdaptordeleteRecursivelyFiles.deleteIfExistsline 1026): runtimeresolveUnderAppRoot→requireUnderBase(appDir, rel)already on main (PR feat(developer): application-file folder create/delete/rename (#4544) #4571). Same-line// codeql[java/path-injection]; not re-edited. - All six default-branch IDs dismissed as false positive (playbook step 5) after documenting in
suppressions.mdrows 2077–2081 / 2076 + extendingcodeql-config.ymlquery-filtersreason text.
Build evidence:
cd system && JAVA_HOME=/usr/lib/jvm/java-21-openjdk ../mvnw -B -Dtest='PSServerXmlObjectStorePathInjectionTest,PSXmlObjectStoreHandlerPathInjectionTest' test→ BUILD SUCCESS; Tests run: 16, Failures: 0cd projects/sitemanage && JAVA_HOME=/usr/lib/jvm/java-21-openjdk ../../mvnw -B -Dtest='ApplicationFileAdaptorTest' test→ BUILD SUCCESS; Tests run: 41, Failures: 0
Co-Authored by OpenCode 1.18.31 using minimax-m3 with agent night-issue-prs-security-audit.
- Alerts build(deps): bump junit5.version from 6.0.2 to 6.1.2 #2077–build(deps): bump jackson.version from 3.1.5 to 3.2.1 #2081 (
night-issue-prs reconcile: closing — 100% implemented. Mitigation PR #4591 merged; alerts #2076–#2081 dismissed as FP with runtime barriers + suppressions documented; live code-scanning open-alert count is now 0. No open children or remaining steps.
Co-Authored by OpenCode 1.18.31 using muse-spark-1.3-contributor-free with agent night-issue-prs.
| 2076 | java/path-injection | error/high |
projects/sitemanage/.../apibridge/ApplicationFileAdaptor.java:1026| https://github.com/intersoftdatalabs-in/percussioncms/security/code-scanning/2076 | dismissed FP (#4591) || 2077 | java/path-injection | error/high |
system/.../PSServerXmlObjectStore.java:730| https://github.com/intersoftdatalabs-in/percussioncms/security/code-scanning/2077 | dismissed FP (#4591) || 2078 | java/path-injection | error/high |
system/.../PSServerXmlObjectStore.java:731| https://github.com/intersoftdatalabs-in/percussioncms/security/code-scanning/2078 | dismissed FP (#4591) || 2079 | java/path-injection | error/high |
system/.../PSServerXmlObjectStore.java:741| https://github.com/intersoftdatalabs-in/percussioncms/security/code-scanning/2079 | dismissed FP (#4591) || 2080 | java/path-injection | error/high |
system/.../PSServerXmlObjectStore.java:741| https://github.com/intersoftdatalabs-in/percussioncms/security/code-scanning/2080 | dismissed FP (#4591) || 2081 | java/path-injection | error/high |
system/.../PSServerXmlObjectStore.java:742| https://github.com/intersoftdatalabs-in/percussioncms/security/code-scanning/2081 | dismissed FP (#4591) |All alerts re-fingerprints of the #2046–#2062 / #2063–#2075 family. Same sinks already covered by
requireFileUnderRxDir/requireUnderBase/resolveUnderAppRoot, same-line// codeql[java/path-injection]annotations, model-pack ReturnValue barriers, path query-filter**/PSServerXmlObjectStore.java+**/apibridge/ApplicationFileAdaptor.java. GHA does not load local model packs — query-filters do not always filter PR CodeQL results.Agent progress (night-issue-prs / security-audit)
requireFileUnderRxDir/resolveUnderAppRootalready on main. Suppressions.md + codeql-config.yml reason text extended; sinks not re-edited.