Use parameterized GraphQL variables instead of Sprintf interpolation by Copilot · Pull Request #51827 · github/gh-aw

Copilot · 2026-08-10T15:59:47Z

CodeQL (workflow-go-graphql-injection-sprintf, alerts #651/#652) flagged GraphQL queries built by string interpolation. The last such call site was the closing-issues query in pkg/cli/outcome_eval.go, which relied on a hand-rolled escapeGraphQLString helper defined in pkg/cli/project_command.go.

Changes

ghAPIGraphQL accepts variables — new variables map[string]any parameter, forwarded to gh api graphql. Strings use -f (raw field) so gh's @file / {placeholder} expansion can't be triggered by interpolated values; other types use -F for correct GraphQL typing. Args are emitted in sorted key order for determinism.
loadPullRequestIntentData query is now static, declaring $owner, $name, $number.
Removed escapeGraphQLString and its test — manual escaping is no longer needed anywhere. All other GraphQL calls in project_command.go were already variable-based.
Tests — stubs updated for the new signature; added assertions that the query text carries no interpolated values and that owner/name/number arrive as variables.

Before:

query := fmt.Sprintf(`query {
    repository(owner: "%s", name: "%s") {
        pullRequest(number: %d) { ... }
    }
}`, escapeGraphQLString(owner), escapeGraphQLString(name), prNumber)

result, err := objectiveMappingGHAPIGraphQL(ctx, query, repo)

After:

query := `query($owner: String!, $name: String!, $number: Int!) {
    repository(owner: $owner, name: $name) {
        pullRequest(number: $number) { ... }
    }
}`
variables := map[string]any{"owner": owner, "name": name, "number": prNumber}

result, err := objectiveMappingGHAPIGraphQL(ctx, query, variables, repo)

Fixes [uk-ai-resilience] [risk-review] Tier B: GraphQL injection via Sprintf in pkg/cli/project_command.go (CodeQL #651, #652) #51826

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Replaces interpolated GraphQL queries with parameterized variables to address CodeQL injection findings.

Changes:

Adds deterministic, typed GraphQL variable forwarding.
Converts pull-request intent lookup to a static query.
Removes obsolete escaping code and updates tests.

Show a summary per file

File	Description
`pkg/cli/project_command.go`	Removes manual GraphQL escaping.
`pkg/cli/project_command_test.go`	Removes obsolete escaping tests.
`pkg/cli/outcome_eval.go`	Adds variable-based GraphQL execution.
`pkg/cli/outcome_eval_test.go`	Updates stubs and parameterization assertions.

Review details

Files reviewed: 4/4 changed files
Comments generated: 2
Review effort level: Balanced

+	for _, name := range slices.Sorted(maps.Keys(variables)) {
+		switch value := variables[name].(type) {
+		case string:
+			// -f sends the value literally, avoiding gh's @file / {placeholder} expansion.
+			args = append(args, "-f", name+"="+value)


Copilot · 2026-08-10T19:17:16Z

 	assert.Equal(t, "mapped", report.AttributionStatus)
 	assert.Equal(t, "closing_issue", report.AttributionSource)
+
+	assert.NotContains(t, capturedQuery, "owner/repo", "query should not interpolate values into the GraphQL document")


Updated the assertions to check each quoted literal individually ("owner", "repo", and the raw 77) rather than just the concatenated owner/repo string.

github-actions · 2026-08-10T16:24:54Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #51827 does not have the 'implementation' label and has only 33 new lines of code in business logic directories (threshold: 100).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-08-10T16:24:55Z

✅ Ponytail Reviewer completed successfully!

Generated by Ponytail Reviewer for #51827

github-actions · 2026-08-10T16:24:56Z

✅ Test Quality Sentinel completed test quality analysis.

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-08-10T16:25:03Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-08-10T16:25:06Z

✅ PR Code Quality Reviewer completed the code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.individual.githubcopilot.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.individual.githubcopilot.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

github-actions

Good security improvement. Replacing fmt.Sprintf interpolation with parameterized GraphQL variables eliminates injection risk and the escapeGraphQLString workaround. The two existing Copilot inline comments (#3751352069, #3751352151) already capture the actionable gaps (CLI encoding not tested by unit tests; weak NotContains assertion). No additional blocking issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 16.9 AIC · ⌖ 7.06 AIC · ⊞ 5.4K

github-actions

Generated by ✂️ Ponytail Reviewer for #51827 · auto · 23.4 AIC · ⌖ 4.27 AIC · ⊞ 6.8K
_{Comment /ponytail to run again}

github-actions · 2026-08-10T16:30:35Z

+func ghAPIGraphQL(ctx context.Context, query string, variables map[string]any, repo string) (map[string]any, error) {
 	ownerRepo, host := repoutil.NormalizeRepoForAPI(repo)
 	args := []string{"api", "graphql", "-f", "query=" + query}
+	for _, name := range slices.Sorted(maps.Keys(variables)) {


L317: yagni: sorts variable map keys for deterministic arg order, but the only caller passes 3 fixed keys and no test checks arg order. Iterate variables directly, drop the maps/slices imports.

Kept the sorted iteration — it's now exercised directly by TestBuildGraphQLArgs's "deterministic key order" subtest, so it's no longer untested dead weight.

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd — the security fix is correct and well-scoped, but two pre-existing review comments and one new finding flag test coverage gaps worth addressing.

📋 Key Themes & Highlights

Key Themes

Untested encoding path: the -f/-F arg-building loop in ghAPIGraphQL (line 321) is bypassed by the test stub, so the security-critical encoding is never actually exercised
Weak injection assertion: NotContains(capturedQuery, "owner/repo") (line 310) would also pass on the old interpolated query, so it doesn’t prove injection safety
Unguarded %v formatting: non-string variable types use fmt.Sprintf("%v", value) without documenting or enforcing supported types (line 328)

Positive Highlights

✅ Clean removal of hand-rolled escapeGraphQLString — eliminating the unsafe helper is exactly right
✅ Sorted key order for deterministic CLI arg emission
✅ Correct -f (raw) / -F (typed) split for gh api graphql
✅ assert.Equal on capturedVariables gives a strong check that values arrive correctly at the call site

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 32.8 AIC · ⌖ 7.53 AIC · ⊞ 7.1K
_{Comment /matt to run again}

github-actions · 2026-08-10T16:31:14Z

+	}
 	var output []byte
 	var err error
 	if host != "" {


[/diagnosing-bugs] fmt.Sprintf("%v", value) for non-string variables relies on Go's default formatting, but gh api graphql -F expects specific value forms. For current int usage this is fine, but future callers passing float64, bool, or custom types could silently emit wrong values.

💡 Suggestion

Document supported types explicitly, or guard against unexpected ones:

default: return nil, fmt.Errorf("ghAPIGraphQL: unsupported variable type %T for key %q", variables[name], name)

This makes the contract explicit and surfaces bugs early.

@copilot please address this.

Added the explicit type guard as suggested — unsupported variable types now return an error naming the key and %T instead of silently formatting them. Covered by a new test case in TestBuildGraphQLArgs.

github-actions · 2026-08-10T16:32:24Z

🧪 Test Quality Sentinel Report

✅ Test Quality Score: 100/100 — Excellent

Analyzed 1 modified test (Go: 1, JS: 0), 1 design test, 0 violations. (TestEscapeGraphQLString deleted — no longer needed.)

📊 Metrics (1 modified test)

Metric	Value
Analyzed	1 (Go: 1, JS: 0)
✅ Design	1 (100%)
⚠️ Implementation	0 (0%)
Edge/error coverage	1 (100%)
Duplicate clusters	0
Inflation	No (11 test lines / 22 prod lines = 0.5:1)
🚨 Violations	0

Test	File	Classification	Issues
`TestEnrichOutcomeWithObjectiveValue_TracesPullRequestToRootIssue` (modified)	`outcome_eval_test.go`	`behavioral_contract` · `design_test` · `high_value`	None

Verdict

✅ Passed. 0% implementation tests (threshold: 30%). The modified test adds three security-contract assertions directly verifying the injection-prevention design invariant: (1) no owner/repo interpolated into the query document, (2) query declares typed GraphQL variables, (3) values arrive as the variables map. The deleted TestEscapeGraphQLString is a clean removal matching the deleted helper. No build-tag violations, no mock-library violations.

🧪 Test quality analysis by Test Quality Sentinel · sonnet46 · 52.3 AIC · ⌖ 7.7 AIC · ⊞ 7.6K · ◷
_{Comment /review to run again}

github-actions

✅ Test Quality Sentinel: 100/100. 0% implementation tests (threshold: 30%).

pelikhan · 2026-08-10T18:53:20Z

@copilot run pr-finisher skill

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-08-11T16:26:16Z

🎉 This pull request is included in a new release.

Release: v0.86.2

Initial plan

091392e

Copilot AI assigned Copilot and pelikhan Aug 10, 2026

Copilot AI linked an issue Aug 10, 2026 that may be closed by this pull request

[uk-ai-resilience] [risk-review] Tier B: GraphQL injection via Sprintf in pkg/cli/project_command.go (CodeQL #651, #652) #51826

Closed

Copilot started work on behalf of pelikhan August 10, 2026 16:00 View session

Parameterize GraphQL query and drop escapeGraphQLString helper

4db3631

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix GraphQL injection via Sprintf in project_command.go~~ Use parameterized GraphQL variables instead of Sprintf interpolation Aug 10, 2026

Copilot AI requested a review from pelikhan August 10, 2026 16:12

Copilot finished work on behalf of pelikhan August 10, 2026 16:12

pelikhan marked this pull request as ready for review August 10, 2026 16:20

Copilot AI balanced review requested due to automatic review settings August 10, 2026 16:20

Copilot started reviewing on behalf of pelikhan August 10, 2026 16:21 View session

Copilot AI reviewed Aug 10, 2026

View reviewed changes

github-actions Bot approved these changes Aug 10, 2026

View reviewed changes

github-actions Bot mentioned this pull request Aug 10, 2026

[aw] No-Op Runs #48838

Open

github-actions Bot reviewed Aug 10, 2026

View reviewed changes

github-actions Bot added the needs-review label Aug 10, 2026

github-actions Bot reviewed Aug 10, 2026

View reviewed changes

github-actions Bot approved these changes Aug 10, 2026

View reviewed changes

Copilot started work on behalf of pelikhan August 10, 2026 19:03 View session

Copilot AI and others added 2 commits August 10, 2026 19:16

Extract testable buildGraphQLArgs helper and validate variable types

ceaf8bf

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Rename error prefix to match buildGraphQLArgs helper name

a7aeeb9

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 10, 2026 19:19

pelikhan merged commit 359e337 into main Aug 10, 2026

pelikhan deleted the copilot/uk-ai-resilience-risk-review branch August 10, 2026 20:52

github-actions Bot mentioned this pull request Aug 11, 2026

Smoke Test: MAI-Code-1-Flash - 31491017664 #52028

Closed

Uh oh!

Conversation

Copilot AI commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Key Themes

Positive Highlights

Uh oh!

github-actions Bot Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 10, 2026

🧪 Test Quality Sentinel Report

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Aug 10, 2026

Uh oh!

github-actions Bot commented Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading