[uk-ai-resilience] [gov-scan] Untrusted-data file write in scripts/ensure-docs-slide-pdf.js (alert #654)

[github-actions]

Tier: B — Open With Conditions (UK AI Open Code Risk & Resilience Governance sweep, 2026-08-07)

Finding

Code scanning alert #654 (rule js/http-to-file-access, severity: warning) flags scripts/ensure-docs-slide-pdf.js (line 167): a file-system write depends on untrusted (network-derived) data without further validation, which the CodeQL rule associates with the risk pattern used by arbitrary file upload / backdoor code (CWE-434, CWE-912).

Risk scoring

• Exposure amplification: Low-Medium (build/docs tooling script, not a runtime service path)
• Patchability: High — add validation of the response/content before writing to disk (e.g., verify expected content-type/size, or restrict to trusted URLs)
• Detectability: High (already caught by code scanning)
• Operational fragility: Low
• Ownership confidence: Medium

Remediation action

Review scripts/ensure-docs-slide-pdf.js:167 and add validation/sanitization of the downloaded content (or restrict source URL to a pinned, trusted origin) before writing it to the local file system, to close the untrusted-write pattern flagged by CodeQL.

SLA urgency

Medium

Reference

Discussion report: UK AI Open Code Risk & Resilience Governance Report — 2026-08-07 (see repository Discussions).

Generated by UK AI Operational Resilience · auto · 43 AIC · ⌖ 2.76 AIC · ⊞ 8.8K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.73 AIC · ⊞ 10.7K · ◷