fix: resolve CodeQL security alerts - #11
Merged
Merged
Conversation
![github-advanced-security[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
_render_check: HTMLParser emits no end tag for a bare void element, so pushing one onto the mount stack leaked a frame and made every later pop close the wrong element — an app mount containing an <img>, or any element closed after a <meta>/<link>, could never be flagged as an empty shell. Skip void tags on both sides so the stack stays balanced. Also accept a BOM anywhere in the leading whitespace run again, not only at index 0. clipboard: the broker must not resolve request text as a host path (the container holds the bearer token), while a native paste has no such boundary — the divergence is intentional but was silent, so a Docker user lost drag-to-attach with no explanation. Document the boundary on both entry points, and have the bridge say why the paste stayed text plus the Finder-copy route that does work. Detection is purely textual so the bridge cannot be used as a host-path existence oracle. widesearch: trailing prose punctuation ended up in netloc, so a parenthesized or sentence-final URL never matched its counterpart. Trim it after matching rather than excluding "." from the class, which would truncate every hostname. ci: restore the two gates dropped when frontierchallenge/checks.yml was folded in — no tracked tasks/** payload (check_public_leaks --allow-empty passes a framework-only tree) and registry consistency. check_restricted_software: the path argument was silently ignored; make it a real optional root instead of a comment that lies. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens multiple components to address existing CodeQL security alerts, focusing on preventing unintended host file staging via the clipboard bridge, tightening URL parsing/validation, and removing regex patterns that can exhibit pathological backtracking.
Changes:
- Prevents container-originated clipboard broker requests from being interpreted as host file paths; adds user-facing explanation when “dropped file URL” gestures can’t be attached through the bridge.
- Reworks HTML “app shell” detection to avoid backtracking-prone regexes by using linear prefix scanning and
HTMLParserstate (including void-element handling). - Improves academic URL routing/validation and API key fingerprinting (keyed HMAC) and adds targeted regression tests (including WideSearch URL matching punctuation).
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
tests/test_file_benchmark_judges.py |
Adds regression coverage for WideSearch URL parsing around trailing prose punctuation. |
tests/test_code_scanning_regressions.py |
Adds security/regression tests for URL routing, PDF conversion, HTML parsing behavior, and keyed API key fingerprinting. |
plugins/tools/_render_check.py |
Replaces backtracking-prone HTML regex checks with linear scanning and HTMLParser-based state for shell detection. |
plugins/tools/_academic_fetch.py |
Validates parsed hostnames and schemes to prevent hostname confusion in routing and PDF URL conversion. |
frontier_agent/infra/summary_llm.py |
Switches API key fingerprinting to process-local keyed HMAC to reduce offline guessability from logs. |
benchmarks/public/judges/widesearch.py |
Introduces permissive URL capture plus trailing punctuation trimming for more robust URL matching. |
benchmarks/frontierchallenge/scripts/check_restricted_software.py |
Makes the restricted-software audit script root-configurable via argparse while keeping existing checks. |
apodex/tui/app.py |
Surfaces broker-provided paste warnings to users when a paste remains text. |
apodex/tests/test_clipboard.py |
Updates and adds tests ensuring broker requests cannot stage host files and that file-URL detection is textual-only. |
apodex/clipboard.py |
Splits trusted local paste handling from broker-supplied text to prevent host path staging; adds explanatory messaging. |
.github/workflows/ci.yml |
Adds CI assertions preventing FrontierChallenge task payloads from being tracked and validating registry integrity. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
dq-ai-dev
approved these changes
Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This addresses the 15 open Code Scanning alerts reported on main (alerts 1-15). GitHub CodeQL should close the matching alerts after the PR analysis completes.
Verification
Note
The repository-wide pytest collection currently requires optional dependencies not present in the base environment (notably pypdf); targeted and affected-area tests pass.