examples: add review finding fixture - #4
Conversation
The review workflow needs a deterministic, line-addressable flaw to validate that Codex reports actionable findings as native inline PR comments. - add a minimal Node handler with unsanitized shell interpolation - keep the fixture isolated from workflow implementation files - make the vulnerable exec call the explicit inline-review target Generated with [Codex](https://github.com/openai)
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| export function showRevision(request, response) { | ||
| const revision = request.query.revision; | ||
|
|
||
| exec(`git show ${revision}`, (error, stdout) => { |
There was a problem hiding this comment.
revision comes directly from request.query and is interpolated into a shell command passed to exec. An attacker can supply shell metacharacters (for example, ?revision=HEAD%3B...) to execute arbitrary commands under the server process. Validate against a strict revision format and pass arguments via execFile/spawn without a shell.
Useful? React with 👍 / 👎.
|
Inline-review smoke validation completed successfully; closing the intentionally vulnerable test PR. |
|
@codex review |
| export function showRevision(request, response) { | ||
| const revision = request.query.revision; | ||
|
|
||
| exec(`git show ${revision}`, (error, stdout) => { |
There was a problem hiding this comment.
revision comes directly from request.query and is passed to exec, which invokes a shell. An attacker can supply shell metacharacters (for example, main; <command>) to execute arbitrary commands. Validate against an expected Git revision format and invoke Git without a shell (for example, execFile with argument arrays).
Useful? React with 👍 / 👎.
|
@codex review |
1 similar comment
|
@codex review |
| export function showRevision(request, response) { | ||
| const revision = request.query.revision; | ||
|
|
||
| exec(`git show ${revision}`, (error, stdout) => { |
There was a problem hiding this comment.
revision is request-controlled and is interpolated into exec, which invokes a shell. A value such as HEAD; <command> executes arbitrary commands on the server. Validate against a strict revision format and invoke git without a shell (for example, execFile with argument arrays).
Useful? React with 👍 / 👎.
|
@codex review |
1 similar comment
|
@codex review |
|
Reclosing the smoke PR after reaction-lifecycle investigation. The failure evidence remains in Actions history. |
1 participant
Purpose
Deliberately adds a small command-injection fixture to validate the reusable OpenAI PR-review workflow.
Expected review result
The reviewer should leave a native inline finding on the
execcall because the untrustedrevisionvalue is interpolated into a shell command.Validation
node --check examples/review-fixture.jsgit diff --check