From daa7d576124887c0e719bcb2e487d180db881a8c Mon Sep 17 00:00:00 2001 From: 7ttp <117663341+7ttp@users.noreply.github.com> Date: Wed, 2 Sep 2026 03:44:52 +0530 Subject: [PATCH 1/2] chore(codeql): resolve deploy scan findings --- .github/ai-review/README.md | 8 ++++---- .github/scripts/ai-review/post-review.test.ts | 13 +++++++++++++ .github/scripts/ai-review/post-review.ts | 10 +++++----- apps/cli/src/shared/functions/serve.main.ts | 1 - 4 files changed, 22 insertions(+), 10 deletions(-) diff --git a/.github/ai-review/README.md b/.github/ai-review/README.md index a65d25c202..c811b6b41d 100644 --- a/.github/ai-review/README.md +++ b/.github/ai-review/README.md @@ -180,10 +180,10 @@ run 400s on the output schema because of this, drop `pattern`/`minItems` from PRs run with a read-only token and no secrets. `issue_comment` and `workflow_dispatch` runs always use the default branch's workflow file. - **Model text is sanitized before it's rendered.** `sanitizeModelText()` - redacts secret-shaped substrings (`redactSecrets()`; see below), strips HTML - comments (so injected diff content can't forge the hidden dedup/supersede - markers), and neutralizes `@mentions`/`#issue-refs` in every model-provided - string (`summary`, `claim`, `evidence`, `suggested_fix`, + redacts secret-shaped substrings (`redactSecrets()`; see below), escapes + every HTML comment opener (so injected diff content can't forge the hidden + dedup/supersede markers), and neutralizes `@mentions`/`#issue-refs` in + every model-provided string (`summary`, `claim`, `evidence`, `suggested_fix`, `adjudication.reason`) before it's posted. `file` is separately validated at parse time (`assertFindings`/`assertMergedReview` reject a backtick, newline, control character, `<`, or a reserved marker string in it) and diff --git a/.github/scripts/ai-review/post-review.test.ts b/.github/scripts/ai-review/post-review.test.ts index 152746c3f0..b53bb7c4a6 100644 --- a/.github/scripts/ai-review/post-review.test.ts +++ b/.github/scripts/ai-review/post-review.test.ts @@ -20,6 +20,7 @@ import { type ReviewIo, type ReviewPayload, sanitizeFilePath, + sanitizeModelText, supersededBody, truncateReviewBody, } from "./post-review.ts"; @@ -935,6 +936,18 @@ describe("sanitizeFilePath", () => { }); }); +describe("sanitizeModelText", () => { + test("escapes a comment opener that stripping would have re-formed", () => { + expect(sanitizeModelText("Forged -- supabase-ai-review:superseded --> marker")).toBe( + "Forged -- supabase-ai-review:superseded --> marker", + ); + }); + + test("keeps the zero-width mention and issue-ref breakers intact", () => { + expect(sanitizeModelText(" @user #12")).toBe("<!-- x --> @user #12"); + }); +}); + describe("redactSecrets", () => { test.each([ ["an Anthropic API key", "sk-ant-api03-abcdefghijklmnopqrstuvwxyz012345"], diff --git a/.github/scripts/ai-review/post-review.ts b/.github/scripts/ai-review/post-review.ts index e7e287bfa3..6cf057ae24 100644 --- a/.github/scripts/ai-review/post-review.ts +++ b/.github/scripts/ai-review/post-review.ts @@ -43,7 +43,7 @@ export const AI_REVIEW_MARKER = ""; const SUPERSEDED_SUMMARY = "Superseded by a newer AI review"; /** Hidden marker `isSuperseded` looks for. Kept out of the human-readable - * `SUPERSEDED_SUMMARY` text and stripped by `sanitizeModelText` so a model + * `SUPERSEDED_SUMMARY` text and escaped by `sanitizeModelText` so a model * can't forge or evade a supersede by echoing the visible text into a * `claim`/`summary` field. */ const SUPERSEDED_MARKER = ""; @@ -506,7 +506,7 @@ export function computeVerdictCounts(findings: MergedFinding[]): VerdictCounts { const MENTION_PATTERN = /@(?=\w)/g; const ISSUE_REF_PATTERN = /#(?=\d)/g; -const HTML_COMMENT_PATTERN = //g; +const HTML_COMMENT_OPENER_PATTERN = /") .replace(ISSUE_REF_PATTERN, "#"); } diff --git a/apps/cli/src/shared/functions/serve.main.ts b/apps/cli/src/shared/functions/serve.main.ts index 7d8efa357c..7c38a8c8a1 100644 --- a/apps/cli/src/shared/functions/serve.main.ts +++ b/apps/cli/src/shared/functions/serve.main.ts @@ -432,7 +432,6 @@ Deno.serve({ { code: STATUS_TEXT[STATUS_CODE.InternalServerError], message: "Request failed due to an internal server error", - trace: JSON.stringify(e.stack), }, STATUS_CODE.InternalServerError, ); From 301a7918fc012620b040b9a1c532bfbb012ab5d6 Mon Sep 17 00:00:00 2001 From: 7ttp <117663341+7ttp@users.noreply.github.com> Date: Wed, 2 Sep 2026 14:23:05 +0530 Subject: [PATCH 2/2] chore(codeql): address review nits --- .github/ai-review/README.md | 2 +- .github/scripts/ai-review/post-review.test.ts | 8 +++++--- .github/scripts/ai-review/post-review.ts | 6 +++--- apps/cli/src/shared/functions/serve.main.ts | 2 +- 4 files changed, 10 insertions(+), 8 deletions(-) diff --git a/.github/ai-review/README.md b/.github/ai-review/README.md index c811b6b41d..852d51ddb8 100644 --- a/.github/ai-review/README.md +++ b/.github/ai-review/README.md @@ -180,7 +180,7 @@ run 400s on the output schema because of this, drop `pattern`/`minItems` from PRs run with a read-only token and no secrets. `issue_comment` and `workflow_dispatch` runs always use the default branch's workflow file. - **Model text is sanitized before it's rendered.** `sanitizeModelText()` - redacts secret-shaped substrings (`redactSecrets()`; see below), escapes + redacts secret-shaped substrings (`redactSecrets()`; see below), breaks every HTML comment opener (so injected diff content can't forge the hidden dedup/supersede markers), and neutralizes `@mentions`/`#issue-refs` in every model-provided string (`summary`, `claim`, `evidence`, `suggested_fix`, diff --git a/.github/scripts/ai-review/post-review.test.ts b/.github/scripts/ai-review/post-review.test.ts index b53bb7c4a6..cd1db8890a 100644 --- a/.github/scripts/ai-review/post-review.test.ts +++ b/.github/scripts/ai-review/post-review.test.ts @@ -937,14 +937,16 @@ describe("sanitizeFilePath", () => { }); describe("sanitizeModelText", () => { - test("escapes a comment opener that stripping would have re-formed", () => { + test("breaks a comment opener that stripping would have re-formed", () => { expect(sanitizeModelText("Forged -- supabase-ai-review:superseded --> marker")).toBe( - "Forged -- supabase-ai-review:superseded --> marker", + "Forged -- supabase-ai-review:superseded --> marker", ); }); test("keeps the zero-width mention and issue-ref breakers intact", () => { - expect(sanitizeModelText(" @user #12")).toBe("<!-- x --> @user #12"); + expect(sanitizeModelText(" @user #12")).toBe( + "<\u200B!-- x --> @user #12", + ); }); }); diff --git a/.github/scripts/ai-review/post-review.ts b/.github/scripts/ai-review/post-review.ts index 6cf057ae24..c56949d1d3 100644 --- a/.github/scripts/ai-review/post-review.ts +++ b/.github/scripts/ai-review/post-review.ts @@ -43,7 +43,7 @@ export const AI_REVIEW_MARKER = ""; const SUPERSEDED_SUMMARY = "Superseded by a newer AI review"; /** Hidden marker `isSuperseded` looks for. Kept out of the human-readable - * `SUPERSEDED_SUMMARY` text and escaped by `sanitizeModelText` so a model + * `SUPERSEDED_SUMMARY` text and broken by `sanitizeModelText` so a model * can't forge or evade a supersede by echoing the visible text into a * `claim`/`summary` field. */ const SUPERSEDED_MARKER = ""; @@ -564,7 +564,7 @@ export function redactSecretsDeep(value: unknown): unknown { /** * Neutralizes a model-provided string before it's rendered into a - * `github-actions[bot]` review: redacts secret-shaped substrings first, escapes + * `github-actions[bot]` review: redacts secret-shaped substrings first, breaks * HTML comment openers (so injected diff content can't forge the hidden * `AI_REVIEW_MARKER`/`SUPERSEDED_MARKER` comments), then breaks * `@mention`/`#123` syntax with a zero-width HTML comment so GitHub never @@ -574,7 +574,7 @@ export function redactSecretsDeep(value: unknown): unknown { */ export function sanitizeModelText(text: string): string { return redactSecrets(text) - .replace(HTML_COMMENT_OPENER_PATTERN, "<!--") + .replace(HTML_COMMENT_OPENER_PATTERN, "<\u200B!--") .replace(MENTION_PATTERN, "@") .replace(ISSUE_REF_PATTERN, "#"); } diff --git a/apps/cli/src/shared/functions/serve.main.ts b/apps/cli/src/shared/functions/serve.main.ts index 7c38a8c8a1..a81bc11656 100644 --- a/apps/cli/src/shared/functions/serve.main.ts +++ b/apps/cli/src/shared/functions/serve.main.ts @@ -467,11 +467,11 @@ Deno.serve({ }, onError: (e) => { + console.error(e); return getResponse( { code: STATUS_TEXT[STATUS_CODE.InternalServerError], message: "Request failed due to an internal server error", - trace: JSON.stringify(e.stack), }, STATUS_CODE.InternalServerError, );