Skip to content

fix: high/medium severity security vulnerabilities detected via codeql - #125

Open
NeethuESim wants to merge 5 commits into
secure-buildfrom
stesol-576-secure-build
Open

fix: high/medium severity security vulnerabilities detected via codeql#125
NeethuESim wants to merge 5 commits into
secure-buildfrom
stesol-576-secure-build

Conversation

@NeethuESim

@NeethuESim NeethuESim commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

PR Description

PR fixes the high & medium severity security vulnerabilities detected via codeql - https://github.com/arm/mcp/security/code-scanning

  • Harden GitHub URL normalization to avoid incomplete substring sanitization
  • Mitigates host-confusion bypass risk from string-based URL checks.
  • Aligns with CodeQL guidance for py/incomplete-url-substring-sanitization by validating parsed host/path values.
  • Add explicit permissions block to the workflow so GITHUB_TOKEN is restricted regardless of repository/org defaults.

NeethuESim and others added 5 commits July 28, 2026 11:54
… sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
… sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@NeethuESim NeethuESim changed the title fix: high severity security vulnerabilities detected via codeql fix: high/medium severity security vulnerabilities detected via codeql Jul 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant