[security-fix] Security Fix: Resolve unsafe quoting vulnerability in network hook generation (Alert #16)#4429
Closed
github-actions[bot] wants to merge 1 commit intomainfrom
Closed
Conversation
**Alert Number**: #16 **Severity**: Critical **Rule**: go/unsafe-quoting ## Vulnerability Description The code was embedding JSON-serialized domain lists directly into a Python script using string formatting without proper escaping. If the JSON contained double quotes in an unexpected way, it could break out of the enclosing quotes and potentially change the structure of the Python code. ## Fix Applied 1. Added `strconv.Quote()` to properly escape the JSON string before embedding it in the Python script template 2. Changed the Python code to use `json.loads()` to parse the escaped JSON string, making the approach more explicit and safer 3. Updated all related tests to check for the new escaped format ## Security Best Practices - Using `strconv.Quote()` ensures that any special characters (including quotes) are properly escaped according to Go string literal rules - Using `json.loads()` on the Python side makes the intent clear and provides an additional layer of safety by parsing the JSON in a structured way - This prevents potential code injection vulnerabilities (CWE-78, CWE-89, CWE-94) ## Testing Considerations All existing tests have been updated and pass successfully. The fix maintains backward compatibility in terms of functionality while improving security. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| print(f"Network validation error: {e}", file=sys.stderr) | ||
| sys.exit(2) # Block on errors | ||
| `, domainsJSON) | ||
| `, quotedDomainsJSON) |
Check failure
Code scanning / CodeQL
Potentially unsafe quoting Critical
Copilot Autofix
AI 3 months ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
pelikhan
deleted the
security-fix-alert-16-unsafe-quoting-13e71b3f61515a55
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fix: Unsafe Quoting in Network Hook Generation
Alert Number: #16
Severity: Critical
Rule: go/unsafe-quoting
File: pkg/workflow/engine_network_hooks.go:123
Vulnerability Description
The code was embedding JSON-serialized domain lists directly into a Python script using string formatting (
fmt.Sprintf) without proper escaping. This created a potential injection vulnerability where:ALLOWED_DOMAINS = %sFix Applied
The fix implements proper escaping and safe parsing:
strconv.Quote()to escape the JSON string before embedding it in the Python templatejson.loads()to parse the properly quoted JSON stringBefore:
After:
Security Best Practices
strconv.Quote()ensures special characters (including quotes) are properly escaped according to Go string literal rulesjson.loads()on the Python side provides an additional layer of safety by parsing JSON in a structured wayTesting Considerations
✅ All existing tests updated and passing
✅ Backward compatibility maintained
✅ No breaking changes to functionality
✅ Security improvement without regression
Files Changed
pkg/workflow/engine_network_hooks.go- Core security fixpkg/workflow/engine_network_test.go- Updated test expectationspkg/workflow/compiler_test.go- Updated integration testspkg/workflow/network_merge_edge_cases_test.go- Updated edge case tests🤖 Generated with Claude Code