Skip to content

Fix command-line injection in grader process launch - #15

Merged
Lee Stott (leestott) merged 2 commits into
mainfrom
copilot/fix-code-scanning-alerts
Aug 24, 2026
Merged

Fix command-line injection in grader process launch#15
Lee Stott (leestott) merged 2 commits into
mainfrom
copilot/fix-code-scanning-alerts

Conversation

Copilot AI commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Addresses CodeQL alert #4 for uncontrolled command-line construction when launching the grader test executable. User-controlled values are now passed as discrete process arguments instead of being interpolated into a single command-line string.

  • Process invocation
    • Replaced ProcessStartInfo.Arguments string interpolation with ProcessStartInfo.ArgumentList.
    • Preserves the existing executable, working directory, and argument order.
info.ArgumentList.Add(tempCredentialsFilePath);
info.ArgumentList.Add(tempDir);
info.ArgumentList.Add(trace);
info.ArgumentList.Add(filter);

Co-authored-by: leestott <2511341+leestott@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix code scanning alert #4 Fix command-line injection in grader process launch Aug 24, 2026
@leestott
Lee Stott (leestott) marked this pull request as ready for review August 24, 2026 11:43
@leestott
Lee Stott (leestott) merged commit 87fd781 into main Aug 24, 2026
5 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants