security-review-bot
  • Joined on 2026-05-02
security-review-bot commented on pull request rodin/review-bot#122 2026-05-14 04:06:18 +00:00
fix(#120): detect VCS host for releases API and derive action-repo

[MAJOR] Command injection risk: unvalidated inputs (SERVER_URL and ACTION_REPO) are used in curl URLs ("${SERVER_URL}/${ACTION_REPO}/releases/download..."). Embedded $(...) or backticks in either value will trigger command substitution and arbitrary command execution.

security-review-bot commented on pull request rodin/review-bot#121 2026-05-14 04:04:51 +00:00
fix(action): detect VCS host type for version resolution and binary download

[MINOR] Binary and checksum downloads use curl without timeouts; a slow or hostile server could stall execution. Add curl --connect-timeout and --max-time (and optionally retry limits) for resilience. This applies to both lines 182 and 184.

security-review-bot commented on pull request rodin/review-bot#121 2026-05-14 04:04:51 +00:00
fix(action): detect VCS host type for version resolution and binary download

[MINOR] Directly echoing unvalidated values to $GITHUB_OUTPUT can be brittle if values ever contain newlines, potentially corrupting outputs or enabling output injection in edge cases. Use the documented multiline syntax with a unique EOF marker to safely write outputs (applies to lines 160–162).

security-review-bot commented on pull request rodin/review-bot#121 2026-05-14 04:04:51 +00:00
fix(action): detect VCS host type for version resolution and binary download

[MINOR] Integrity verification relies on a checksums.txt fetched from the same server as the binary, which does not provide authenticity if the server or repo is compromised. Consider stronger verification (e.g., GPG signatures with a pinned public key, or pinning expected hashes in the workflow) or restricting downloads to trusted hosts.

security-review-bot commented on pull request rodin/review-bot#121 2026-05-14 04:04:51 +00:00
fix(action): detect VCS host type for version resolution and binary download

[MINOR] curl requests to the releases API lack explicit timeouts; a malicious or misbehaving endpoint could hold connections open and stall the job (DoS). Consider adding --connect-timeout and --max-time to bound resource usage.