Skip to content

[security-fix] Security Fix: Unsafe Quoting in Network Hook Generation (Alert #9) #1521

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 5 commits into from
Oct 11, 2025
Merged

[security-fix] Security Fix: Unsafe Quoting in Network Hook Generation (Alert #9) #1521

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2111055
Fix unsafe quoting vulnerability in network hook generation
github-actions[bot] Oct 11, 2025
e7a4b9a
Potential fix for code scanning alert no. 15: Potentially unsafe quoting
pelikhan Oct 11, 2025
6ffbecf
[WIP] Fix unsafe quoting in network hook generation (#1522)
Copilot Oct 11, 2025
7369db0
[WIP] Fix unsafe quoting in network hook generation (#1524)
Copilot Oct 11, 2025
0934789
Add changeset for security fix: unsafe quoting in network hooks
github-actions[bot] Oct 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions pkg/workflow/engine_network_hooks.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
import (
"encoding/json"
"fmt"
"strconv"
"strings"
)

Expand All @@ -13,13 +14,20 @@
func (g *NetworkHookGenerator) GenerateNetworkHookScript(allowedDomains []string) string {
// Convert domain list to JSON for embedding in Python
// Ensure empty slice becomes [] not null in JSON
var domainsJSON []byte
var domainsJSON string
if allowedDomains == nil {
domainsJSON = []byte("[]")
domainsJSON = "[]"
} else {
domainsJSON, _ = json.Marshal(allowedDomains)
jsonBytes, _ := json.Marshal(allowedDomains)
domainsJSON = string(jsonBytes)
}

// Use strconv.Quote to safely escape the JSON string for Python
// This prevents any quote-related injection vulnerabilities (CWE-78, CWE-89, CWE-94)
quotedJSON := strconv.Quote(domainsJSON)

// Build the Python script using a safe template approach
// The JSON string is properly quoted and escaped, then parsed at runtime
return fmt.Sprintf(`#!/usr/bin/env python3
"""
Network permissions validator for Claude Code engine.
Expand All @@ -32,7 +40,8 @@
import re

# Domain allow-list (populated during generation)
ALLOWED_DOMAINS = %s
# JSON string is safely escaped using Go's strconv.Quote
ALLOWED_DOMAINS = json.loads(%s)

def extract_domain(url_or_query):
"""Extract domain from URL or search query."""
Expand Down Expand Up @@ -101,7 +110,7 @@
except Exception as e:
print(f"Network validation error: {e}", file=sys.stderr)
sys.exit(2) # Block on errors
`, string(domainsJSON))
`, quotedJSON)
Comment thread Fixed
}

// GenerateNetworkHookWorkflowStep generates a GitHub Actions workflow step that creates the network permissions hook
Expand Down