[uk-ai-resilience] [gov-scan] GraphQL injection risk via fmt.Sprintf in project_command.go (alerts #651, #652)

[github-actions]

Tier: B — Open With Conditions (UK AI Open Code Risk & Resilience Governance sweep, 2026-08-07)

Finding

Code scanning alerts #651 and #652 (rule workflow-go-graphql-injection-sprintf, severity: warning) flag pkg/cli/project_command.go (lines ~269, 272): fmt.Sprintf is used to build a GraphQL query with user-controlled input (owner). escapeGraphQLString() is applied, but manual string escaping is brittle and may miss edge cases.

Risk scoring

• Exposure amplification: Medium (CLI-invoked, requires local/authenticated context to trigger)
• Patchability: High — GraphQL variables are a drop-in replacement for string interpolation
• Detectability: High (already caught by code scanning)
• Operational fragility: Low-Medium
• Ownership confidence: Medium

Remediation action

Replace fmt.Sprintf-based string interpolation for the owner parameter (and any other user-controlled fields) in the GraphQL query construction in pkg/cli/project_command.go with parameterized GraphQL variables, removing reliance on escapeGraphQLString() manual escaping.

SLA urgency

Medium

Reference

Discussion report: UK AI Open Code Risk & Resilience Governance Report — 2026-08-07 (see repository Discussions).

Generated by UK AI Operational Resilience · auto · 43 AIC · ⌖ 2.76 AIC · ⊞ 8.8K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.73 AIC · ⊞ 10.7K · ◷