fix(security): resolve open Dependabot and CodeQL alerts#21
Conversation
- Bump github.com/xuri/excelize/v2 from 2.10.1 to 2.11.0 (checkSheet unbounded row allocation DoS, Dependabot #10) - Bump astro to 7.1.3 in docs (reflected XSS via View Transition animation properties, Dependabot #11) - Force js-yaml >=4.3.0 in docs via pnpm override (quadratic CPU from merge-key chains, CVE-2026-59869, Dependabot #12) - Reject ".." traversal sequences in the permission catalog dir parameter before building paths (CodeQL #16, #17)
|
Warning Review limit reached
Next review available in: 30 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
WalkthroughDependency constraints are updated for documentation and Go modules. Catalog directory resolution now rejects raw ChangesDependency updates
Catalog path validation
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/cli/permission_catalog.go`:
- Around line 49-53: Update the traversal validation in the directory-handling
function to reject only exact ".." path components after splitting or
normalizing the input, rather than any substring match. Preserve rejection of
actual traversal segments while allowing legitimate names such as
"reports..archive", and add a regression test covering that valid directory
name.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9b312728-6a64-476d-9fc6-c58a3e3676e6
⛔ Files ignored due to path filters (2)
docs/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlgo.sumis excluded by!**/*.sum
📒 Files selected for processing (4)
docs/package.jsongo.modpkg/cli/permission_catalog.gopkg/cli/permission_catalog_test.go
| // Reject traversal sequences in the raw input before any path is built; | ||
| // the prefix check below is defense in depth. | ||
| if strings.Contains(dir, "..") { | ||
| return "", fmt.Errorf("dir %q contains a path traversal sequence", dir) | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Reject .. path segments, not arbitrary substrings.
strings.Contains rejects valid directory names such as reports..archive, even though they do not perform traversal. Check normalized path components for an exact .. segment and add a regression test for a legitimate double-dot directory name.
Proposed fix
- if strings.Contains(dir, "..") {
- return "", fmt.Errorf("dir %q contains a path traversal sequence", dir)
+ for _, segment := range strings.Split(filepath.ToSlash(dir), "/") {
+ if segment == ".." {
+ return "", fmt.Errorf("dir %q contains a path traversal sequence", dir)
+ }
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| // Reject traversal sequences in the raw input before any path is built; | |
| // the prefix check below is defense in depth. | |
| if strings.Contains(dir, "..") { | |
| return "", fmt.Errorf("dir %q contains a path traversal sequence", dir) | |
| } | |
| // Reject traversal sequences in the raw input before any path is built; | |
| // the prefix check below is defense in depth. | |
| for _, segment := range strings.Split(filepath.ToSlash(dir), "/") { | |
| if segment == ".." { | |
| return "", fmt.Errorf("dir %q contains a path traversal sequence", dir) | |
| } | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/cli/permission_catalog.go` around lines 49 - 53, Update the traversal
validation in the directory-handling function to reject only exact ".." path
components after splitting or normalizing the input, rather than any substring
match. Preserve rejection of actual traversal segments while allowing legitimate
names such as "reports..archive", and add a regression test covering that valid
directory name.
2 participants
Fixes the two open CodeQL alerts and all three open Dependabot alerts:
v2.10.1→v2.11.0ingo.mod— unbounded row index allocation DoS incheckSheet()(Feat/dod gate #10)7.1.3indocs— reflected XSS via unescaped View Transition animation properties (feat: add agent framework with Genkit and Claude Agent SDK providers #11)>=4.3.0indocsvia pnpm override — quadratic CPU from YAML merge-key chains, CVE-2026-59869 (Restructure codex provider to emit tool call + EventToolResult on the live stream #12). Required an override because@mdxeditor/editorpinsjs-yaml@4.2.0exactly.resolveCatalogDirnow rejects anydirquery value containing..before building paths, the barrier pattern CodeQL recognizes; the existing workspace-prefix check remains as defense in depth. Added a test case for..segments that would still resolve inside the workspace.go build ./...andgo test ./pkg/cli/pass.Generated by Claude Code
Summary by CodeRabbit
Bug Fixes
...Documentation
Tests