Repository navigation
Harden workflows and Flask routes for CodeQL findings (permissions, path handling, error leakage) - #96
Draft
ariedotcodotnz with Copilot wants to merge 2 commits into
Draft
Harden workflows and Flask routes for CodeQL findings (permissions, path handling, error leakage)#96ariedotcodotnz with Copilot wants to merge 2 commits into
ariedotcodotnz with Copilot wants to merge 2 commits into
Conversation
Co-authored-by: ariedotcodotnz <78839335+ariedotcodotnz@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return redirect(url_for('admin.error_logs')) | ||
|
|
||
| if os.path.exists(filepath): | ||
| if os.path.exists(real_filepath): |
| if os.path.exists(real_filepath): | ||
| try: | ||
| with open(filepath, 'r', encoding='utf-8', errors='replace') as f: | ||
| with open(real_filepath, 'r', encoding='utf-8', errors='replace') as f: |
| return redirect(url_for('admin.error_logs')) | ||
|
|
||
| if not os.path.exists(filepath): | ||
| if not os.path.exists(real_filepath): |
| log_activity('admin_action', f'Downloaded log file: {filename}') | ||
|
|
||
| return send_file(filepath, as_attachment=True, download_name=filename) | ||
| return send_file(real_filepath, as_attachment=True, download_name=filename) |
| return redirect(url_for('admin.error_logs')) | ||
|
|
||
| if not os.path.exists(filepath): | ||
| if not os.path.exists(real_filepath): |
| try: | ||
| # Truncate the file | ||
| with open(filepath, 'w') as f: | ||
| with open(real_filepath, 'w', encoding='utf-8') as f: |
Copilot
AI
changed the title
[WIP] Fix code scanning alerts flagged in repository
Harden workflows and Flask routes for CodeQL findings (permissions, path handling, error leakage)
Sep 20, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR addresses the targeted code-scanning findings by applying least-privilege workflow permissions and tightening Flask-side security checks. It updates the flagged areas across GitHub Actions and web routes with minimal, localized changes.
Workflow security: explicit token permissions
permissionsblocks to workflow/job definitions that were relying on default broadGITHUB_TOKENscopes.contentswhere sufficient, and retained required write scope only for SARIF upload (security-events: write).Path-injection hardening in admin log endpoints
os.path.realpath+os.path.commonpath.Stack-trace / exception detail exposure reduction
logger.exception) while returning stable generic messages to clients.Alert triage outcome
style_idis typed asint, filename is deterministic, and serving is constrained to a fixed directory viasend_from_directory).