Skip to content

Validate UV executable path before package lookup #76157

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Copilot wants to merge 6 commits into
base: main
Choose a base branch
from
+37 −4
Open

Validate UV executable path before package lookup #76157

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1f89349
Initial plan
Copilot Nov 9, 2026
f40038a
Validate UV executable path before lookup
Copilot Nov 9, 2026
0e4bb06
Merge branch 'main' into copilot/sighthound-security-findings-again
pelikhan Nov 9, 2026
daa618b
Make UV path regression test meaningful
Copilot Nov 9, 2026
5af9005
Merge remote-tracking branch 'origin/main' into copilot/sighthound-se…
Copilot Nov 9, 2026
fcedaeb
test: match semantic refactor step name
Copilot Nov 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions pkg/workflow/argument_injection_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -588,6 +588,28 @@ printf "%s\n" "$@" > "$GH_AW_TEST_UV_ARGS_FILE"
}
}

func TestValidateUvPackagesWithExecutable_RejectsUnvalidatedExecutablePath(t *testing.T) {
tempDir := t.TempDir()
argsFile := filepath.Join(tempDir, "uv-args.txt")
uvPath := filepath.Join(tempDir, "uv")
script := `#!/bin/sh
printf "%s\n" "$@" > "$GH_AW_TEST_UV_ARGS_FILE"
`
if err := os.WriteFile(uvPath, []byte(script), 0o755); err != nil {
t.Fatalf("failed to write fake uv executable: %v", err)
}
t.Setenv("GH_AW_TEST_UV_ARGS_FILE", argsFile)

Copilot AI Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the regression test to change into the fixture directory and invoke ./uv, so the fake executable runs if the path guard is removed. Commit: daa618b.

t.Chdir(tempDir)

err := NewCompiler().validateUvPackagesWithExecutable([]string{"requests"}, "./uv")
if err == nil {
t.Fatal("expected relative executable path to be rejected")
}
if _, err := os.Stat(argsFile); !os.IsNotExist(err) {
t.Fatalf("expected invalid executable path to be rejected before uv execution; stat error = %v", err)
}
}

// TestValidateUvPackages_RejectsInvalidPackageName verifies that uv package names
// which do not conform to the PyPI naming rules are rejected before being passed
// as arguments to the uv CLI. This validation happens before uv/pip is resolved
Expand Down
17 changes: 14 additions & 3 deletions pkg/workflow/pip_validation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,17 @@ func (c *Compiler) validateUvPackages(workflowData *WorkflowData) error {
}

func (c *Compiler) validateUvPackagesWithExecutable(packages []string, uvPath string) error {
validatedUvPath, err := fileutil.ValidateExecutablePath(uvPath)
if err != nil {
return NewOperationError(
"validate",
"uv packages",
"",
err,
"Install uv to enable package validation:\n\n$ curl -LsSf https://astral.sh/uv/install.sh | sh",
)
}

var errors []string
for _, pkg := range packages {
pkgName := stripUvPackageVersion(pkg)
Expand All @@ -244,10 +255,10 @@ func (c *Compiler) validateUvPackagesWithExecutable(packages []string, uvPath st
}

// Use uv pip show to check if package exists on PyPI
// #nosec G204 -- uvPath is resolved from the hardcoded executable name "uv" via
// fileutil.ResolveExecutablePath and validated before calling this method;
// #nosec G204 -- uvPath is validated above and resolved from the hardcoded
// executable name "uv" via fileutil.ResolveExecutablePath by the caller;
// pkgName is validated above by validatePipPackageName against the strict PEP 508 allowlist.
cmd := exec.Command(uvPath, "pip", "show", "--no-cache", "--", pkgName)
cmd := exec.Command(validatedUvPath, "pip", "show", "--no-cache", "--", pkgName)
_, err := cmd.CombinedOutput()

if err != nil {
Expand Down
2 changes: 1 addition & 1 deletion pkg/workflow/semantic_function_refactor_workflow_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ func TestSemanticFunctionRefactorWorkflowCostGuardrails(t *testing.T) {
`GH_AW_MAX_AI_CREDITS: "300"`,
`\"maxAiCredits\":${GH_AW_MAX_AI_CREDITS}`,
`claude-sonnet-5`,
`name: Precompute semantic refactor slice`,
`name: Pre-compute semantic refactor slice`,
`/tmp/gh-aw/agent/semantic-function-refactor/analysis.json`,
`go run ./scripts/semantic-refactor-slice`,
`--max-turns 50`,
Expand Down
Loading