[sighthound] Security findings in github/gh-aw

[github-actions]

Sighthound scan flagged 154 findings (36 Critical, 13 High, 72 Medium) in actionable.json. Top 5 Critical, non-test findings selected for triage:

1. pkg/cli/bootstrap_profile_github_app.go:286 — SQL Injection (Critical/High confidence, CWE-89)

   • mux.HandleFunc("/callback", ...) reads r.URL.Query().Get("state"/"code") and passes code to bootstrapExchangeGitHubAppCode.
   • Likely false positive: no SQL query construction is visible in this snippet; the OAuth code is validated via isBootstrapGitHubAppManifestCode before use. Recommend manually confirming no SQL sink exists downstream in bootstrapExchangeGitHubAppCode.

2. pkg/cli/experiments_command.go:337 — Command Injection (Critical/High, CWE-78)

   • exec.Command("git", "show", ref+":"+constants.EvalsResultFilename) in loadLocalMetricEvalResults.
   • ref is concatenated into a single argument rather than passed separately; while exec.Command doesn't invoke a shell, an attacker-controlled ref could still smuggle unexpected git revision syntax. Remediation: validate ref against an allow-list pattern (e.g., git ref name rules) before use, or pass ref and the path as separate args via -- separator.

3. pkg/cli/forecast.go:78 — Command Injection (Critical/High, CWE-78)

   • Flagged sink is a fmt.Fprintln/logging call, not an actual exec invocation — appears to be a false positive from taint propagation. Recommend verifying no actual command execution uses validationStartDate/validationEndDate unsanitized elsewhere in forecast.go.

4. pkg/cli/git.go:693 — Command Injection (Critical/High, CWE-78)

   • exec.Command("git", "-C", gitRoot, "log", upstream+"..HEAD", "--oneline", "--", relPath) in checkWorkflowFileStatus.
   • upstream is concatenated into a revision range argument. Recommend validating upstream as a well-formed ref/branch name before interpolation, and ensure -- already separates paths (it does) to avoid path/flag confusion for relPath and gitRoot.

5. pkg/cli/grant.go:184 — Command Injection (Critical/High, CWE-78)

   • exec.Command(dockerPath, "run", "--rm", "-v", volumeMount, grantImageRef, "--config", containerPolicyPath, "--output", "json", "check", imageRef) in grantRunOnImage.
   • Arguments passed as a fixed slice (no shell), but imageRef/grantImageRef/volumeMount should be validated as well-formed image references / paths if derived from user/workflow input, to prevent flag injection (e.g., values starting with -).

Note: Several flagged items appear to be false positives from taint analysis (e.g., #1 and #3 point to non-sink code). Recommend manual review before remediation work. Full details available in actionable.json from the Sighthound scan artifact.

Generated by 🛡️ Sighthound Security Scan · auto · 23.4 AIC · ⌖ 2.96 AIC · ⊞ 7.8K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I’ve identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.59 AIC · ⌖ 4.23 AIC · ⊞ 11.7K · ◷

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #52439

View newer issue

---

This action was performed automatically by the Sighthound Security Scan workflow.