feat: task add vercel bypass token

[Caknoooo]

Refactor PR

Goals

• Add vercel header token on lenscore ci template

Scope

Which code areas/components are touched.

Impact

Expected behavior changes (there should be none for a pure refactor).

Checklist

• Test coverage does not decrease
• No API/contract changes without strong justification
• Reduced complexity / improved structure
• Lint & build pass

[greptile-apps]

Greptile Summary

This PR adds support for Vercel bypass tokens to the LensCore CI template, allowing accessibility scans to bypass Vercel's protection layer. The implementation also removes verbose logging and input descriptions to clean up the workflow.

Critical Issues Found:

• Shell injection vulnerability in header argument construction (lines 71-86) - the quoted string within HEADER_ARGS will not be preserved when expanded in sh -c, breaking the --header flag and potentially allowing command injection

Minor Changes:

• Removed input descriptions for cleaner workflow definition
• Removed verbose echo statements throughout the workflow
• Removed job name and step ID that were unused

Confidence Score: 1/5

• This PR contains a critical shell injection vulnerability that will prevent the feature from working correctly
• The header argument construction has a fundamental shell quoting error that breaks the intended functionality. The double quotes inside HEADER_ARGS will be removed by shell word splitting when expanded in sh -c, causing the --header flag to receive incorrect arguments. This needs to be fixed before merging.
• .github/workflows/lens-core-template.yml requires immediate attention to fix the shell injection vulnerability in the header construction logic

Important Files Changed

Filename	Overview
.github/workflows/lens-core-template.yml	Added Vercel bypass token support with shell injection vulnerability in header construction

Sequence Diagram

sequenceDiagram
    participant GHA as GitHub Actions
    participant Docker as Docker Container
    participant LensCore as LensCore Service
    participant Target as Target URL (Vercel)

    GHA->>Docker: Pull accesstimeco/lenscore image
    GHA->>Docker: Start container with env vars
    Docker->>LensCore: Initialize service
    
    loop Health Check (max 60s)
        GHA->>LensCore: GET /api/health
        alt Service Ready
            LensCore-->>GHA: 200 OK
        else Not Ready
            LensCore-->>GHA: Connection Failed
            GHA->>GHA: Wait 2 seconds
        end
    end
    
    alt VERCEL_BYPASS_TOKEN provided
        GHA->>GHA: Construct HEADER_ARGS with token
        GHA->>Docker: exec: node cli.js with --header flag
    else No token
        GHA->>Docker: exec: node cli.js without header
    end
    
    Docker->>LensCore: Execute accessibility scan
    LensCore->>Target: HTTP Request (with/without bypass header)
    Target-->>LensCore: HTML Response
    LensCore->>LensCore: Run accessibility checks
    LensCore->>Docker: Write report.json
    
    Docker-->>GHA: Copy report.json
    GHA->>GHA: Generate summary from report
    GHA->>GHA: Upload artifact
    GHA->>Docker: Stop and remove container

Loading

[greptile-apps]

_{1 file reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

logic: Shell injection vulnerability: HEADER_ARGS is constructed with unescaped quotes and then used in sh -c, causing the --header flag to fail and potentially allowing command injection if the secret contains shell metacharacters.

Suggested change

	HEADER_ARGS=""
	if [ -n "${{ secrets.VERCEL_BYPASS_TOKEN }}" ]; then
	HEADER_ARGS="--header \"${{ inputs.vercel_bypass_header_name }}: ${{ secrets.VERCEL_BYPASS_TOKEN }}\""
	fi
	if [ -n "${{ secrets.VERCEL_BYPASS_TOKEN }}" ]; then
	HEADER_ARGS="--header '${{ inputs.vercel_bypass_header_name }}: ${{ secrets.VERCEL_BYPASS_TOKEN }}'"
	fi

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/lens-core-template.yml
Line: 71:75

Comment:
**logic:** Shell injection vulnerability: `HEADER_ARGS` is constructed with unescaped quotes and then used in `sh -c`, causing the `--header` flag to fail and potentially allowing command injection if the secret contains shell metacharacters.

```suggestion
          if [ -n "${{ secrets.VERCEL_BYPASS_TOKEN }}" ]; then
            HEADER_ARGS="--header '${{ inputs.vercel_bypass_header_name }}: ${{ secrets.VERCEL_BYPASS_TOKEN }}'"
          fi
```

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

logic: The sh -c with unquoted $HEADER_ARGS expansion will cause word splitting and quote removal, breaking the --header argument. The inner quotes in HEADER_ARGS won't be preserved.

Suggested change

	docker exec lenscore sh -c \
	"node dist/cli.js scan \"${{ inputs.url }}\" \
	--ci \
	-u ${{ inputs.max_urls }} \
	-d ${{ inputs.scan_depth }} \
	-t ${{ inputs.timeout }} \
	--skip-cache \
	$HEADER_ARGS \
	-o /app/report.json \
	--no-exit-on-violations" || true
	docker exec lenscore sh -c \
	"node dist/cli.js scan \"${{ inputs.url }}\" \
	--ci \
	-u ${{ inputs.max_urls }} \
	-d ${{ inputs.scan_depth }} \
	-t ${{ inputs.timeout }} \
	--skip-cache \
	${HEADER_ARGS} \
	-o /app/report.json \
	--no-exit-on-violations" || true

Note: This requires fixing HEADER_ARGS construction (line 74) to use single quotes as suggested.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/lens-core-template.yml
Line: 77:86

Comment:
**logic:** The `sh -c` with unquoted `$HEADER_ARGS` expansion will cause word splitting and quote removal, breaking the `--header` argument. The inner quotes in `HEADER_ARGS` won't be preserved.

```suggestion
          docker exec lenscore sh -c \
            "node dist/cli.js scan \"${{ inputs.url }}\" \
              --ci \
              -u ${{ inputs.max_urls }} \
              -d ${{ inputs.scan_depth }} \
              -t ${{ inputs.timeout }} \
              --skip-cache \
              ${HEADER_ARGS} \
              -o /app/report.json \
              --no-exit-on-violations" || true
```

Note: This requires fixing `HEADER_ARGS` construction (line 74) to use single quotes as suggested.

How can I resolve this? If you propose a fix, please make it concise.