Repository navigation
Conversation
`scan import --csv` refuses a row whose `path` escapes the repository, is absolute, or carries a drive letter, backslash or control character. The `--json` branch of the same command validated only against the findings JSON schema, which constrains `locations[].path` to a non-empty string, so the same path was accepted. `--dry-run` therefore reported such a document as importable, and the real import failed later in finalization with a message about findings not being preserved, after the source had already been persisted and a scan registered. Apply the existing `safeFindingPath` check to imported JSON finding locations, reporting the finding index the way the duplicate `occurrenceId` check beside it already does.
|
Note You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
mldangelo-oai
changed the title
mldangelo-oai
added
area:findings
alandelong-oai
approved these changes
Oct 15, 2026
alandelong-oai
left a comment
alandelong-oai
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed 4ea06a6 with three independent source-review passes and synthesis. No P0/P1 findings were confirmed. Five focused finding-import tests passed in the completed review. Full integration and cross-platform validation remain outside this review.
mldangelo-oai
changed the title
github-actions
Bot
added
skip-release-notes
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Scan imports already validate findings against the shared current-finding contract before creating state. Add regression coverage for unsafe paths in a secondary location and in code evidence, so both dry-run and saved imports continue to reject them before persistence.
Changes
Extend the existing import-validation test table with two traversal-path cases. Each runs in dry-run and saved-import mode and verifies that the historical JSON reader accepts the artifact, while the import rejects it before resolving Python, invoking the workbench, or creating state and output directories. The source file remains intact.
Testing
Ran
bun test --timeout 30000 ./tests-ts/findings-import.test.ts ./tests-ts/import-scan.test.ts ./tests-ts/cli-scan-import.test.tsfromsdk/typescript, using a private temporary directory. The new rejection cases passed, along with existing real JSON and CSV import tests that verify persisted results, source retention, and indexing.Risk and rollout
Test coverage only; no runtime changes. Import validation continues to use the shared contract, while historical JSON parsing remains compatible with its other consumers, including owner suggestions.
Public disclosure review