CodeQL (GitHub code scanning) reports two high-severity go/path-injection alerts:
User-supplied namespace/name (from GET /v1/memory and /v1/memory/entry query params) flow into file operations in Reader.Read/List.
Current state
safeJoin does filepath.Clean + a prefix check that the resolved path stays under the root, and a live test confirms ../../etc/hosts is rejected (HTTP 400). So traversal is blocked today — but CodeQL's taint analysis does not recognise a prefix-string check as a sanitizer, so the alerts stay open.
Proposed fix (standard approach)
- Validate the cleaned relative path with
filepath.IsLocal (rejects .., absolute, and escaping paths; CodeQL recognises it as a path-injection barrier), keeping the existing prefix check as defense-in-depth.
- (Optional, stronger: on Go 1.24+, switch to
os.Root / os.OpenInRoot, which is traversal-safe by construction.)
- Add a regression test asserting the alert pattern is closed.
Alerts: /security/code-scanning/3 and /security/code-scanning/4
CodeQL (GitHub code scanning) reports two high-severity
go/path-injectionalerts:internal/memory/reader.go:109— code-scanning alert feat: human-in-the-loop approval gate (step 7) #3internal/memory/reader.go:120— code-scanning alert chore: add CODEOWNERS #4User-supplied
namespace/name(fromGET /v1/memoryand/v1/memory/entryquery params) flow into file operations inReader.Read/List.Current state
safeJoindoesfilepath.Clean+ a prefix check that the resolved path stays under the root, and a live test confirms../../etc/hostsis rejected (HTTP 400). So traversal is blocked today — but CodeQL's taint analysis does not recognise a prefix-string check as a sanitizer, so the alerts stay open.Proposed fix (standard approach)
filepath.IsLocal(rejects.., absolute, and escaping paths; CodeQL recognises it as a path-injection barrier), keeping the existing prefix check as defense-in-depth.os.Root/os.OpenInRoot, which is traversal-safe by construction.)Alerts: /security/code-scanning/3 and /security/code-scanning/4