[uk-ai-resilience] [security] Review network data written to file in ensure-docs-slide-pdf.js (CodeQL #636, CWE-434)

[github-actions]

Summary

CodeQL alert #636 (created 2026-06-26, open 10 days) flags a potential arbitrary file write via network data in a docs-generation script.

File: scripts/ensure-docs-slide-pdf.js line 149
Rule: js/http-to-file-access (CWE-434 — unrestricted file upload, CWE-912 — backdoor indicator)
Severity: Medium (CodeQL)

Tier & Risk Scoring

Dimension	Score	Notes
Exposure amplification	1	Docs-generation script; not production runtime or shipped artifact
Patchability	2	Requires reviewing the download target and adding path validation
Detectability	3	File write from network data; auditable in script output
Operational fragility	1	Scoped to documentation build pipeline
Ownership confidence	3	No assignee; 10 days open
Aggregate	10	Tier B — Open With Conditions

SLA: Medium — fix or accept within 14 days.

Root Cause

scripts/ensure-docs-slide-pdf.js:149 writes data received from an HTTP response directly to the filesystem. CodeQL flags this pattern as a potential backdoor vector (arbitrary file upload if an attacker can influence the HTTP response or request URL).

In context, this is a build-time docs script — likely downloading slide assets — which significantly reduces the attack surface. However, the pattern warrants explicit validation.

Recommended Actions

Option A — Validate the write target (preferred):

• Verify the target file path is within the expected output directory (prevent path traversal)
• Validate the URL is a known, trusted origin before writing response data
• Example: const safePath = path.resolve(expectedDir, filename); if (!safePath.startsWith(expectedDir)) throw new Error('Path traversal')

Option B — Accept as intended (if script is trusted-source only):

• If the URL is a hardcoded, trusted constant (not user-controlled), add a code comment explaining the trust basis
• Dismiss the CodeQL alert with false-positive + rationale in the GitHub Security tab
• Document in the script that the download source is immutable

Human Review Trigger

If the URL at line 149 is dynamically constructed from environment variables, command-line arguments, or any external input, escalate to Tier C and treat as a required fix before the next release.

Governance Context

Identified by the UK AI Open Code Risk & Resilience Governance weekly scan (2026-07-06). See discussion report for full tier classification and remediation queue.

References: CodeQL alert #636 · §28806888795

Generated by UK AI Operational Resilience · 119.2 AIC · ⌖ 6.39 AIC · ⊞ 5.2K · ◷