Repository navigation
Arena/8806ed4e standards - #1331
Merged
Merged
Conversation
…code CodeQL's actions suite (and Hypatia's WH001/WH012 equivalents) flag attacker-influenced values spliced into shell bodies. Four workflow edits bind them to env instead, so they reach the shell as data: * changelog-reusable: github.ref_name (commit-back push, pr-back --base) and github.event.release.tag_name (release upload) * debt-measure: github.ref_name (PR base) * propagate-hooks: workflow_dispatch inputs (dry-run, target-repo) * check-suite-monitor: check_suite / workflow_run payload fields check-suite-monitor also carried a real defect: github.event.workflow is the workflow OBJECT, not its name, so contains(github.event.workflow, 'GATE:') was permanently false and the GATE analysis never ran. Use .name, and quote $GITHUB_OUTPUT writes so an embedded newline cannot forge a second output line. The K9 Kennel parser assigned document-supplied keys directly (result[key] = ...), which lets a document rewrite the prototype of the parsed map (CWE-915, CodeQL js/prototype-polluting-assignment). Reject __proto__/constructor/prototype outright in both the generator and its inline test copy, and assert it. Finally, add .github/codeql/codeql-config.yml and point both analysis jobs at it: 9-archive/** is a vendored provenance snapshot that this repository does not build and whose fidelity forbids editing, so alerts raised there are permanent noise (de-vendoring: #493). The reusable gains an optional, empty-by-default config-file input, which the CodeQL Action converts back to undefined - existing callers are unaffected. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
This is the single unfiltered finding that has held `governance / Validate Hypatia Baseline` red since 2026-10-23 07:05 — the one required context on main that is currently failing. `refuse_case` took its mutation as a shell string and ran it through `eval`. Nothing untrusted ever reached it (every case is fixed text in this file), but it is exactly the shape hypatia's `eval_in_shell` (and CWE-95) exists to catch, and the string form breaks the moment a fixture path gains a space or a quote. Each mutator is now a function taking the consumer directory, so the harness has no dynamic evaluation left. Behaviour is unchanged: the suite passes identically before and after, including the cases whose mutator must also move `NEW` (record-nowhere) or reuse an existing helper (tiny, desync). Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
hyperpolymath
enabled auto-merge (squash)
October 24, 2026 12:25
Contributor
|
Caution Review failedThe pull request is closed. 📝 Summary
Merge Risk:
 |
Contributor
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers