Conversation
![cycode-readonly-pr[bot]](https://avatars.githubusercontent.com/in/408170?s=60&v=4){kind=small}
| if (pat.endsWith('/*') && tgt.endsWith('/*')) { | ||
| out.push({ prefix: pat.slice(0, -1), base: path.resolve(baseUrl, tgt.slice(0, -1)) }); | ||
| } else { | ||
| out.push({ exact: pat, file: path.resolve(baseUrl, tgt) }); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| function resolveImport(fromFile, spec) { | ||
| // Returns { file: absolutePath|null, isBarrel: bool }. | ||
| if (spec.startsWith('.')) { | ||
| return tryResolveFile(path.resolve(path.dirname(fromFile), spec)); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| // extension-guessing tryResolveFile does — the spec already carries its | ||
| // extension, we just need the alias/relative base it points at. | ||
| function resolveStaticAsset(fromFile, spec) { | ||
| if (spec.startsWith('.')) return path.resolve(path.dirname(fromFile), spec); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| const nDead = measured.filter(r => r.kept === 0).length; | ||
| const nSeeded = records.length - measured.length; | ||
| console.log('browsergnome playbook'); | ||
| console.log(` wrote ${path.resolve(mdOut)}`); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| 'vite.config.js', 'vite.config.ts', 'vite.config.mjs', | ||
| ]; | ||
| for (const name of candidates) { | ||
| const p = path.join(repoRoot, name); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| const md = buildMarkdown(records, meta); | ||
| const json = JSON.stringify({ generatedAt: new Date().toISOString(), meta, records }, null, 2); | ||
|
|
||
| const mdOut = path.join(dotMetrognomeDir, 'playbook.md'); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| const nSeeded = records.length - measured.length; | ||
| console.log('browsergnome playbook'); | ||
| console.log(` wrote ${path.resolve(mdOut)}`); | ||
| console.log(` wrote ${path.resolve(jsonOut)}`); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| try { | ||
| if (fs.existsSync(base) && fs.statSync(base).isDirectory()) { | ||
| for (const ext of CONFIG.exts) { | ||
| const cand = path.join(base, 'index' + ext); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| try { if (fs.existsSync(dir) && !fs.statSync(dir).isDirectory()) dir = path.dirname(dir); } catch {} | ||
| for (let i = 0; i < 8; i++) { | ||
| for (const name of ['tsconfig.json', 'jsconfig.json']) { | ||
| const cfg = path.join(dir, name); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| } | ||
|
|
||
| function loadAliases(startDir) { | ||
| let dir = path.resolve(startDir); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| const json = JSON.parse(stripJsonComments(fs.readFileSync(cfg, 'utf8'))); | ||
| const co = json.compilerOptions || {}; | ||
| if (!co.paths) continue; | ||
| const baseUrl = path.resolve(dir, co.baseUrl || '.'); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| const json = JSON.stringify({ generatedAt: new Date().toISOString(), meta, records }, null, 2); | ||
|
|
||
| const mdOut = path.join(dotMetrognomeDir, 'playbook.md'); | ||
| const jsonOut = path.join(dotMetrognomeDir, 'playbook.json'); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| // Run | ||
|
|
||
| function run(dotMetrognomeDir) { | ||
| const ledgerDir = path.join(dotMetrognomeDir, 'ledger'); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| const allHypotheses = []; | ||
| for (const f of ledgerFiles) { | ||
| try { | ||
| const content = fs.readFileSync(path.join(ledgerDir, f), 'utf8'); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| # moves with GitHub's own update schedule, not this repo's). Pin a version here the same way | ||
| # .mcp.json pins chrome-devtools-mcp's own version — don't float either one on @latest. | ||
| - name: Set up Chrome | ||
| uses: browser-actions/setup-chrome@v1 |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Third party actions not pinned to commit SHA'.
Risk Score: 26 (LOW)
Severity: High
Description
An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
Cycode Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
| const tgt = Array.isArray(targets) ? targets[0] : null; | ||
| if (!tgt) continue; | ||
| if (pat.endsWith('/*') && tgt.endsWith('/*')) { | ||
| out.push({ prefix: pat.slice(0, -1), base: path.resolve(baseUrl, tgt.slice(0, -1)) }); |
There was a problem hiding this comment.
❗Cycode: SAST violation: 'Unsanitized dynamic input in file path'.
Risk Score: 51 (MEDIUM)
Severity: High
Description
Using unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.
Company Remediation Guideline
If you have any doubts about how to fix this vulnerability, or any improvement feedback for the Application Security team (@alex.sa, @diogo.salvador) regarding the tool, please reach out to them.
Currently, the alerts created by Cycode are being used for visibility purposes, instead of as a restrictive quality gate. Basically, you can provide a reason to ignore the alert and proceed with the merge.
If you want to have early visibility of security vulnerabilities before even committing the code, you can use the Cycode CLI or IDE Extension as documented in our Notion workspace: https://www.notion.so/uphold/Security-tools-in-developer-workflows-Cycode-CLI-IDE-Plugin-27f6261a4ab781e59d3ec003582526c5
Tell us how you wish to proceed using one of the following commands:
| Tag | Short Description |
|---|---|
| #cycode_sast_ignore_here <reason> | Ignore this violation — applies to this violation only |
| #cycode_ai_remediation | Request remediation guidance using Cycode AI |
81602a2 to
e49cba5
Compare
1 participant
Merges the complete commit history from the personal repo (xavi-999/browsergnome) into this new public repo, resolving the README conflict in favor of the real project README. Merge with a merge commit to preserve history.