UK AI Governance — Tier B: New CodeQL alerts from commit #54370
Tier: B — Open With Conditions (both findings; low current exploitability, but real code patterns worth fixing promptly).
Commit 41cfb1aaa2631246f71f75915cc9bc38cefc4c24 ("Fix Copilot threat-detection summary initialization", #54370) introduced two new open CodeQL alerts on main:
Alert #659 — go/allocation-size-overflow (warning)
- Location:
pkg/workflow/plugin_installation.go:119
- Code:
steps := make([]GitHubActionStep, 0, len(workflowData.Plugins)*2)
- Risk-scoring: exposure amplification = low (Plugins slice size is bounded by parsed workflow frontmatter, not attacker-controlled at runtime); patchability = high (single-line, add explicit bound check or widen the capacity computation); detectability = high (already caught by CodeQL); operational fragility = low; ownership confidence = high.
- Remediation: add an explicit bounds/overflow guard (or use a wider integer type) before computing capacity for the allocation.
- SLA urgency: Medium.
Alert #658 — go/unsafe-quoting (warning)
- Location:
pkg/workflow/runner_temp_safety.go:77
- Code:
rewrittenLine = matches[1] + matches[2] + "path.join(actionsDir, '" + matches[3] + "')" + matches[4]
- Risk-scoring: exposure amplification = medium (this interpolation is embedded into every compiled workflow's generated JS script block); patchability = high (escape single quotes or use a safe JSON-string builder for the interpolated value); detectability = high (already caught by CodeQL); operational fragility = low; ownership confidence = high.
- Remediation: escape/serialize the captured action name safely (e.g., via
JSON.stringify-equivalent encoding) instead of raw string concatenation into single-quoted JS.
- SLA urgency: High.
Context
- Discussion report: see the linked "UK AI Governance Report — Recent-Changes Risk Review (2026-08-21)" discussion created in this same run for the full asset graph, tier table, and control-verification notes.
- Note: automated sub-agent classification (asset-tier-classifier / control-verifier) did not return usable output this run; this issue and the linked report were compiled directly from verified git/CodeQL evidence.
Suggested next step
Patch both one-line issues in a single PR; low cost, low risk, high value (removes two open CodeQL warnings introduced in the latest commit).
Generated by UK AI Operational Resilience · auto · 53.8 AIC · ⌖ 5.14 AIC · ⊞ 9.3K · ◷
UK AI Governance — Tier B: New CodeQL alerts from commit #54370
Tier: B — Open With Conditions (both findings; low current exploitability, but real code patterns worth fixing promptly).
Commit
41cfb1aaa2631246f71f75915cc9bc38cefc4c24("Fix Copilot threat-detection summary initialization", #54370) introduced two new open CodeQL alerts onmain:Alert #659 —
go/allocation-size-overflow(warning)pkg/workflow/plugin_installation.go:119steps := make([]GitHubActionStep, 0, len(workflowData.Plugins)*2)Alert #658 —
go/unsafe-quoting(warning)pkg/workflow/runner_temp_safety.go:77rewrittenLine = matches[1] + matches[2] + "path.join(actionsDir, '" + matches[3] + "')" + matches[4]JSON.stringify-equivalent encoding) instead of raw string concatenation into single-quoted JS.Context
Suggested next step
Patch both one-line issues in a single PR; low cost, low risk, high value (removes two open CodeQL warnings introduced in the latest commit).