Skip to content

cluster: absorb CodeQL path-injection #4349 #4350 #4351 - #4352

Merged
natechadwick-intsof merged 9 commits into
mainfrom
cluster/night-issue-20260905-codeql-path-injection
Sep 6, 2026
Merged

cluster: absorb CodeQL path-injection #4349 #4350 #4351#4352
natechadwick-intsof merged 9 commits into
mainfrom
cluster/night-issue-20260905-codeql-path-injection

Conversation

@natechadwick-intsof

@natechadwick-intsof natechadwick-intsof commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator

Summary

Overnight same-file thrash: three owned CodeQL path-injection PRs all edit the model pack, Advanced config query-filters, and suppressions.md. Absorbing them into one PR against main so those files are not rewritten three times.

Thrash files

  • .github/codeql/codeql-config.yml
  • .github/codeql/models/codeql-pack.yml
  • .github/codeql/models/models/path-injection-guard.model.yml
  • docs/ai-generated/tasks/gh-codeql-alerts/suppressions.md

Union kept every unique runtime fix, model barrier, query-filter, and suppression row:

Supersedes

Supersedes Original PR Head Absorbed Notes
yes #4349 fix/codeql-alert-2039-path-injection yes PSConfigService #2039–#2044 / residual #2055–#2057
yes #4350 fix/codeql-alert-2045-path-injection yes IOTools #2045 / residual #2054
yes #4351 fix/codeql-alert-2046-path-injection yes object-store save #2046–#2050 / residual #2058–#2062

modules_built

modules/utils, deployer, system

build_evidence

JDK 21 (JAVA_HOME=/usr/lib/jvm/java-21-openjdk). Standalone clean install from each module dir (repo-root mvnw). No -DskipTests.

cd modules/utils && ../../mvnw clean install
BUILD SUCCESS
Tests run: 428, Failures: 0, Errors: 0, Skipped: 9

cd deployer && ../mvnw clean install
BUILD SUCCESS
Tests run: 313, Failures: 0, Errors: 0, Skipped: 19

cd system && ../mvnw clean install
BUILD SUCCESS
Tests run: 2869, Failures: 0, Errors: 0, Skipped: 245

No new compiler/Surefire failures on the union tip. Javadoc reference not found noise on system is pre-existing (install still succeeded).

Product documentation

  • N/A — CodeQL residual/model-pack union only; no operator/user/API product-surface change.

Operator

Grok: night-issue-prs (model grok-4.6)

Co-Authored by Grok Build 1.0.13 using grok-4.6 with agent night-issue-prs-cluster.

@natechadwick-intsof
fix(codeql): path-injection #2039–#2044 PSConfigService config files
de3c5b0 
Contain package config files under RxDir via requireSafeFileName and
requireUnderBase before File.exists / FileInputStream. Parent audit #4348.

> Co-Authored by Grok Build 1.0.13 using grok-4.6 with agent night-issue-prs-security.
@natechadwick-intsof
fix(codeql): path-injection #2045 IOTools.getFileContent
9de3a2a 
Reject NUL paths, open the canonical file, and add getFileContentUnderBase
with requireUnderBase. Parent audit #4348.

> Co-Authored by Grok Build 1.0.13 using grok-4.6 with agent night-issue-prs-security.
@natechadwick-intsof
fix(codeql): path-injection #2046–#2050 object-store save files
5f278d2 
Contain application save paths under RxDir via requireFileUnderRxDir
before exists/isFile/mkdirs. Parent audit #4348.

> Co-Authored by Grok Build 1.0.13 using grok-4.6 with agent night-issue-prs-security.
@natechadwick-intsof
docs(codeql): record path-injection residual alerts #2055–#2057
eb0d706 
PR #4349 already has runtime requireUnderBase, sink-line annotations,
query-filters, and tests. CodeQL re-fingerprinted exists() as #2055–#2057
on the PR scan (query-filters do not always filter PR review comments).

> Co-Authored by Grok Build 1.0.13 using grok-4.6 with agent night-issue-prs.
@natechadwick-intsof
docs(codeql): record path-injection residual alert #2054
20cbbf3 
PR #4350 already has NUL reject + getCanonicalFile, getFileContentUnderBase,
sink-line annotations, query-filters, and tests. CodeQL re-fingerprinted
FileInputStream as #2054 on the PR scan.

> Co-Authored by Grok Build 1.0.13 using grok-4.6 with agent night-issue-prs.
@natechadwick-intsof
docs(codeql): record path-injection residual alerts #2058–#2062
8bfdfa1 
PR #4351 already has requireFileUnderRxDir, sink-line annotations,
query-filters, and tests. CodeQL re-fingerprinted save File API as
#2058–#2062 on the PR scan.

> Co-Authored by Grok Build 1.0.13 using grok-4.6 with agent night-issue-prs.
@natechadwick-intsof
cluster: absorb #4349
597512b 
Absorb fix/codeql-alert-2039-path-injection (PSConfigService path-injection).

> Co-Authored by Grok Build 1.0.13 using grok-4.6 with agent night-issue-prs-cluster.
@natechadwick-intsof
cluster: absorb #4350
325b26e 
Absorb fix/codeql-alert-2045-path-injection (IOTools.getFileContent path-injection).
Union: keep PSConfigService and IOTools model barriers + suppression rows.

> Co-Authored by Grok Build 1.0.13 using grok-4.6 with agent night-issue-prs-cluster.
@natechadwick-intsof
cluster: absorb #4351
9092d0e 
Absorb fix/codeql-alert-2046-path-injection (object-store save files).
Union: keep PSConfigService, IOTools, and object-store suppression rows.

> Co-Authored by Grok Build 1.0.13 using grok-4.6 with agent night-issue-prs-cluster.
@natechadwick-intsof natechadwick-intsof added operator:grok Changes authored by Grok operator:night-issue-prs night-issue-prs workflow model:grok-4.6 Session model grok-4.6 labels Sep 5, 2026
This was referenced Sep 5, 2026
Closed
Closed
Closed
Closed
@natechadwick-intsof

natechadwick-intsof commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

Parent audit issue: #4348

This cluster remains the live mitigation for open CodeQL alerts #2039–#2050 (java/path-injection). Security Audit fix-pass skipped new slice PRs (C3) to avoid same-file thrash on the model pack / query-filters / suppressions.md.

Co-Authored by Grok Build 1.0.13 using grok-4.6 with agent night-issue-prs-security.

@natechadwick-intsof

natechadwick-intsof commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator Author

qa_deferred_quality — not assigning human QA for this cluster.

This-run PR #4352 (absorbs superseded #4349/#4350/#4351) is not a QA candidate: CodeQL java/path-injection runtime+model-pack union only (not product UI, not installer/packaging/upgrade, no written UAT acceptance). Product-docs on the PR is N/A.

Quality bar (live snapshot):

Gate Result
Q1 Pass — open, not draft, MERGEABLE (not CONFLICTING/DIRTY). mergeStateStatus=BLOCKED due to review/checks.
Q2 Fail — reviewDecision=REVIEW_REQUIRED; no independent APPROVE (reviews empty).
Q3 Fail — required checks not green on head 9092d0e1f6: Analyze (java-kotlin) IN_PROGRESS; Kilo Code Review QUEUED.
Q4 Pass — C1 standalone mvnw clean install on modules/utils, deployer, system in PR body.
Q5 N/A — not a UI surface (Playwright skipped_non_ui).
Q6 N/A — not a human UAT slice.
Q7 Pass — no open QA (#4352) ticket.
Q8 Pass — Cycle Verify passed on this cluster.

No qa task issue created. @vijaya-boddipudi not assigned. Parent implement/security issue remains unassigned.

Co-Authored by Grok Build 1.0.13 using grok-4.6 with agent night-issue-prs-human-qa.

@natechadwick-intsof
natechadwick-intsof merged commit b42661b into main Sep 6, 2026
5 of 6 checks passed
@natechadwick-intsof
natechadwick-intsof deleted the cluster/night-issue-20260905-codeql-path-injection branch September 6, 2026 02:13
This was referenced Sep 18, 2026
Merged
Closed
natechadwick pushed a commit that referenced this pull request Sep 18, 2026
@natechadwick-intsof OpenCode
fix(security): CodeQL #2076-#2081 path-injection residuals (#4590) (#…
9d44e2c 
…4591)

* fix(security): CodeQL #2076-#2081 path-injection residuals (#4590)

Document the default-branch CodeQL java/path-injection residuals
#2077-#2081 (PSServerXmlObjectStore saveApplicationFile lines
730/731/741/742) and #2076 (ApplicationFileAdaptor
deleteRecursively line 1026) in suppressions.md and extend the
existing .github/codeql/codeql-config.yml query-filter reason text
to cover them.

Ladder steps 1-4 already on main (PR #4352 / #4571 / #4578):
  * requireFileUnderRxDir -> requireUnderBase(RxDir)
    (PSServerXmlObjectStore line 728)
  * resolveUnderAppRoot -> requireUnderBase(appDir, rel)
    (ApplicationFileAdaptor line 1006)
  * same-line // codeql[java/path-injection] annotations on every sink
  * path query-filter glob for both files
  * model pack ReturnValue barriers for both helpers (GHA does not load
    local packs but the documentation is required by contracts/C3)

Sinks were intentionally NOT re-edited - per playbook row 184,
re-editing already-annotated sinks re-fingerprints and reopens a new
alert ID.

Default-branch IDs dismissed as false positive (playbook step 5) after
this PR.

Tests (siblings on main, not re-edited):
  * PSServerXmlObjectStorePathInjectionTest
    .requireFileUnderRxDir_rejectsEscapeAndAcceptsChild
  * ApplicationFileAdaptorTest.deleteRecursively_removesTreeUnderTempDir
    (plus ObjectStore exists/rename/delete under thread RxDir from
    PR #4578)

Partial #4590

Co-Authored-By: OpenCode <noreply@opencode.ai>

* chore(review): erlang pre-merge review for #4591

Durable review record (per AGENTS.md "Erlang review" section). Recommends
approve on the docs/config diff; no bug findings; no rule-file changes.

Refs #4591

---------

Co-authored-by: OpenCode <noreply@opencode.ai>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

model:grok-4.6 Session model grok-4.6 operator:grok Changes authored by Grok operator:night-issue-prs night-issue-prs workflow

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@natechadwick-intsof