fix: the working-directory input parameter is accept... in main.js

[anupamme]

Summary

Fix high severity security issue in src/main.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	src/main.js:20
Assessment	Likely exploitable

Description: The working-directory input parameter is accepted from workflow configuration without validation and used directly in file system operations. The gomod() function constructs file paths using string concatenation without sanitizing traversal sequences, allowing access to files outside the intended workspace directory.

Evidence

Exploitation scenario: An attacker with workflow modification access sets working-directory to '../../../etc' causing the action to attempt reading /etc/go.mod.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a private Node.js application (not published to npm). Vulnerabilities affect this application's own runtime only.

Changes

• src/main.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

Automated security fix by OrbisAI Security

[CLAassistant]

All committers have signed the CLA.

[Copilot]

🟡 Changes recommended

The new workspace-boundary check can still be bypassed via symlinks/junctions within the workspace and needs additional hardening and regression coverage before it reliably addresses the reported vulnerability.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR hardens the GitHub Action’s handling of the working-directory input to mitigate a path traversal risk when reading go.mod, aligning with the stated goal of fixing a high-severity security issue in src/main.js.

Changes:

• Added path-based normalization and an “inside workspace” check for working-directory before reading go.mod.
• Switched from string concatenation to path.join() when constructing the go.mod path.

File summaries

File	Description
src/main.js	Resolves and validates working-directory against the workspace before reading go.mod.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[anupamme]

✅ Review Feedback Addressed

I've automatically addressed 1 review comment(s):

The reviewer flagged that there are no regression tests for the new workspace-boundary validation and that the current path.resolve + startsWith check does not catch symlink-based escapes.

Changes made:

1. src/main.js – fs is imported; the validation logic is extracted into an exported validateWorkingDirectory() function that (a) keeps the existing string-based traversal check and (b) adds fs.realpathSync calls to reject symlinks that point outside the workspace. realpathSync ENOENT errors are swallowed so that a legitimately missing directory still falls through to the existing gomod() error. The top-level run() call is guarded by process.env.NODE_ENV !== 'test' so the file can be imported in tests without executing the action.
2. __tests__/main.test.js – A new describe('validateWorkingDirectory', ...) block is appended with four tests: rejects ../.., rejects an absolute path outside the workspace, accepts an empty string (workspace root), accepts a valid subdirectory, and rejects a real symlink that points outside the workspace.

Files modified:

• src/main.js
• __tests__/main.test.js

The changes have been pushed to this PR branch. Please review!