test: e2e review target (eval + secret leak) #3

2026-08-17T22:56:22Z

pragent-bot bot commented

2026-08-17 22:56:22 +00:00

Throwaway PR to verify the opencode review engine posts a real review. Safe to delete after.

pragent-bot bot added 1 commit 2026-08-17 22:56:23 +00:00

test: add buggy helper for e2e review 076f569625

pragent-bot bot reviewed 2026-08-17 22:56:58 +00:00

pragent-bot bot left a comment

🤖 AI Review · pragent pilot · glm-5.2:cloud · 076f5696

Adds test-e2e/bug.ts with parseAmount/loadToken helpers. Despite being a throwaway e2e fixture, the code has real security defects: eval-based arbitrary code execution and an unvalidated secret read. No repo-level TS tooling was available to run. 1 critical, 1 high.

2 inline comment(s) posted below.

🤖 **AI Review** · pragent pilot · glm-5.2:cloud · `076f5696` Adds test-e2e/bug.ts with parseAmount/loadToken helpers. Despite being a throwaway e2e fixture, the code has real security defects: eval-based arbitrary code execution and an unvalidated secret read. No repo-level TS tooling was available to run. 1 critical, 1 high. _2 inline comment(s) posted below._

test-e2e/bug.ts

pragent-bot bot commented

2026-08-17 22:56:58 +00:00

[CRITICAL] eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything.

Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input.

export function parseAmount(input: string): number {
  const n = Number(input);
  if (!Number.isFinite(n)) {
    throw new RangeError(`parseAmount: not a finite number: ${input}`);
  }
  return n;
}

📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

**[CRITICAL]** eval(input) executes arbitrary user-supplied code, enabling remote code execution; return type is also number but eval can yield anything. Fix: Replace eval with a safe numeric parser (e.g. Number() / parseFloat with validation) and reject non-finite/non-numeric input. ```suggestion export function parseAmount(input: string): number { const n = Number(input); if (!Number.isFinite(n)) { throw new RangeError(`parseAmount: not a finite number: ${input}`); } return n; } ``` 📎 ref: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval

pragent-bot bot commented

2026-08-17 22:56:58 +00:00

[HIGH] process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface.

Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter.

export function loadToken(): string {
  const token = process.env.SECRET_TOKEN;
  if (!token) {
    throw new Error('SECRET_TOKEN is not set');
  }
  return token;
}

📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information

**[HIGH]** process.env.SECRET_TOKEN is returned unguarded; when unset it yields undefined (despite the string return type) and exposes a secret to callers/logs, creating a leak surface. Fix: Require the env var at access time, fail loudly if missing, and avoid returning raw secrets from a generic getter. ```suggestion export function loadToken(): string { const token = process.env.SECRET_TOKEN; if (!token) { throw new Error('SECRET_TOKEN is not set'); } return token; } ``` 📎 ref: https://owasp.org/www-community/Exposure_of_sensitive_information

masi closed this pull request

2026-08-18 04:18:50 +00:00

masi deleted branch pragent-e2e-test

2026-08-18 04:18:52 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: gitea_admin/pragent#3