From 3264def65822d698038e50aed28907e8f43476f2 Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Fri, 2 Oct 2026 10:59:54 +0100 Subject: [PATCH] AI codebase review fix: sanitise snapshot follow mode; least-privilege CI token The scan-info view printed the snapshot's "follow" metadata string unsanitised (the canvas filter was the only defence). The CI workflow ran with the repository's default GITHUB_TOKEN permissions; it only needs to read the code. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 2 ++ internal/tui/infoview.go | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 107beb4..0428f35 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,6 +2,8 @@ name: ci on: push: pull_request: +permissions: + contents: read jobs: test: strategy: diff --git a/internal/tui/infoview.go b/internal/tui/infoview.go index 6c31444..ed3da63 100644 --- a/internal/tui/infoview.go +++ b/internal/tui/infoview.go @@ -110,7 +110,7 @@ func (v *infoView) paint(m *Model, cv *Canvas, r treemap.Rect) { } line("Exclusions", excl, value) line("One filesystem", fmt.Sprint(st.OneFileSystem), value) - line("Follow symlinks", st.Follow, value) + line("Follow symlinks", textutil.Sanitize(st.Follow), value) line("Size mode", m.sizeMode.String(), value) units := "IEC (1024)" if textutil.SI {