SonarCloud: code security review (pythonsecurity)

2 open SonarCloud finding(s) in combsmith/.github, worst severity MAJOR. Generated by the org SonarCloud Audit.

Findings

Rule	Count	Representative message
pythonsecurity:S8707	2	Path Traversal via command-line argument

Affected files

.github/scripts/feature-ideation/validate-signals.py (2)

Priority

Labeled priority:major — mapped from this bucket's worst SonarCloud severity (MAJOR).

Acceptance

All findings in this workstream resolved to zero in SonarCloud
No behavior change; CI green
Real fixes (no blanket NOSONAR unless a confirmed false positive, noted inline)

Idempotent issue — updated automatically each audit run; auto-closed when the finding count reaches zero.

SonarCloud Audit (2026-10-27): still open — 2 finding(s), worst severity MAJOR.

Dev-Lead Implementation Plan

Issue: #1361 — SonarCloud: code security review (pythonsecurity)

Scope

Clear the 2 pythonsecurity:S8707 findings at the two read_text calls in validate-signals.py. The current realpath + commonpath guard (from #1333) was in the 2026-10-26 analysis of 1ea9ee1, and SonarCloud still traces the taint from argv through _confine_path → Path(candidate) → read_text. The analyzer does not treat that guard as a sanitizer.

The fix: once a path is proven to be inside an allowed root, rebuild it from os.scandir listings, starting at the trusted root. Each part of the relative path is matched by name against real directory entries, and the returned path is made only of those entries. No string from argv reaches the file-read sink. CLI, exit codes and messages stay the same.

Implementation Checklist

.github/scripts/feature-ideation/validate-signals.py: add _rebuild_from_root(root, rel) (walks the scandir entries). _confine_path returns the rebuilt path, or raises FileNotFoundError when a part is missing, so the "not found" exit 2 message is kept.
main: handle the missing-file case through the confinement result rather than a separate exists() on a tainted path

Tests to Write

_confine_path returns the real path for a nested file inside a root (built from directory entries)
_confine_path raises FileNotFoundError for a missing file or a missing intermediate dir inside a root
main still exits 2 with not found for a missing signals file or schema inside a root
The existing traversal / absolute / schema-outside / roots tests stay green

Test Command

python3 -m pytest test/feature-ideation/test_validate_signals.py -v and bats test/workflows/feature-ideation/

Dev-Lead: Implementation Complete — PR #1383

The implementation for issue #1361 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.

Pull request: feat: implement issue #1361 — SonarCloud: code security review (pythonsecurity) #1383
Head commit: 7447f9c097e327288854ce3f23be538b75ee067c
Net change against main: 3 file(s), +93/-11 lines
Run: https://github.com/combsmith/.github/actions/runs/40585812334

Review happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.

SonarCloud Audit (2026-11-03): still open — 2 finding(s), worst severity MAJOR.

Navigation Menu

Repository navigation

SonarCloud: code security review (pythonsecurity) #1361