Address Aikido security findings - #3
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c43f9185f8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # @param path [String] the path to save the artifact | ||
| # @return [String] the full path where the file was saved | ||
| def save(path = nil) | ||
| raise ArgumentError, 'path cannot contain parent directory traversal' if path.to_s.split(/[\\\/]/).include?('..') |
There was a problem hiding this comment.
On Windows, drive-relative paths can put the parent segment in the drive component, e.g. C:..\escaped or C:../escaped. This split sees that first component as C:.. rather than .., so the new guard allows the path and the following File.write still traverses upward when the CLI/API receives such an output path. If the intent is to block parent-directory traversal, normalize/expand against an allowed base path or strip the drive prefix before checking segments.
Useful? React with 👍 / 👎.
1 participant
Summary
actions/checkoutandruby/setup-rubyto immutable release commits.Rationale
The reported findings came from mutable workflow dependencies, persisted repository credentials, an unsanitized output path, and treating URL fragments as jQuery selectors. These changes narrow each boundary while preserving normal artifact destinations and documentation anchor navigation.