Repository navigation
Conversation
|
Thanks for opening your first pull request in the Codna CLI! Please make sure the checks are green and that the change follows CONTRIBUTING.md. A maintainer will review it shortly. |
![codna-ai[bot]](https://avatars.githubusercontent.com/in/4061960?s=60&v=4){kind=small}
| digest = hashlib.sha256(canonical.encode()).hexdigest() | ||
| episodes = _run_dir(active.runs_root, request.context.run_id) / "episodes" | ||
| episodes.mkdir(parents=True, exist_ok=True) | ||
| path = episodes / f"{request.context.task_id}.json" |
There was a problem hiding this comment.
🟡 MEDIUM · security — Path traversal: task_id used unsanitized as filename in remember_episode
Line 841 constructs the episode file path as episodes / f"{request.context.task_id}.json". The task_id field is validated only by require_ref (checks non-empty, length ≤ 512, strips whitespace) which does NOT reject path-unsafe characters such as ../ or /. A task_id like ../../evil would cause the episode file to be written outside the intended <run>/episodes/ directory. While task_id comes from Temporal workflow history, it originates from CLI input that is only lightly validated via require_ref, not by a path-safety check.
| path = episodes / f"{request.context.task_id}.json" | |
| Replace `path = episodes / f"{request.context.task_id}.json"` with a check that the resolved path remains inside `episodes`, or strip path separators from `task_id` before constructing the filename: e.g., `safe = request.context.task_id.replace('/', '_').replace('..', '_')` and then use `episodes / f"{safe}.json"`. Alternatively, validate `task_id` against a stricter pattern (alphanumeric, hyphens, underscores only) in `require_ref` or at the `TaskSpec` boundary. |
Reply @codna fix and Codna opens a verified, test-green, risk-gated fix PR.
| DURABLE_RANGES: Final[dict[str, str]] = { | ||
| "temporalio": ">=1.34,<2", | ||
| "langgraph": ">=1,<2", | ||
| "langchain-core": ">=1,<2", | ||
| } |
There was a problem hiding this comment.
⚪ LOW · correctness — DURABLE_RANGES missing entry for langgraph-checkpoint
DURABLE_PINS defines four requirements including langgraph-checkpoint (minimum=(4,), maximum=(5,)), but DURABLE_RANGES only defines three entries and omits langgraph-checkpoint. When require_durable() finds an out-of-range langgraph-checkpoint version and constructs the error details (line 254: DURABLE_RANGES.get(requirement.distribution, "")), it reports range: "" instead of the actual range ">=4,<5". This makes the actionable error message less informative for operators trying to diagnose a version incompatibility.
| DURABLE_RANGES: Final[dict[str, str]] = { | |
| "temporalio": ">=1.34,<2", | |
| "langgraph": ">=1,<2", | |
| "langchain-core": ">=1,<2", | |
| } | |
| Add `"langgraph-checkpoint": ">=4,<5"` to the DURABLE_RANGES dict. |
Reply @codna fix and Codna opens a verified, test-green, risk-gated fix PR.
Automated mirror of cli/ (flattened), the root allowlist (server.json, glama.json, LICENSE, .gitleaks.toml) and the public-root/ community tree from thyn-ai/codna at 64b0c1336370e4f575b0ffa1a70a11b1478fa4a1. Merges itself via auto-merge once the mirror's required checks (codna review, Analyze (python)) pass and the codna-ai review approves; if a later sync lands first, this PR is closed as superseded -- every sync PR is a full snapshot of the exported surface.