[uk-ai-resilience] [Security] Tier C: Network data written to file in scripts/ensure-docs-slide-pdf.js (CWE-434/912, alert #636)

[github-actions]

Tier C — Restricted Pending Review

Source: UK AI Open Code Risk & Resilience Governance — 2026-07-23 run
Discussion report: #aw_disc_gov

Risk-Scoring Breakdown

Dimension	Score (1–5)
Exposure amplification	3
Patchability (ease of fix)	2
Detectability (exploitation visibility)	4
Operational fragility	2
Ownership confidence	3
Composite score	2.8 / 5

Finding Description

Alert #636 (CodeQL, js/http-to-file-access, warning severity — CWE-434/CWE-912):

scripts/ensure-docs-slide-pdf.js:149 writes data retrieved from a remote HTTP/HTTPS source directly to the local file system without validation. This pattern is flagged as potentially indicating a backdoor or arbitrary file-upload vulnerability — a compromised upstream source could write arbitrary content to the local filesystem.

CWE-434 — Unrestricted file upload
CWE-912 — Hidden functionality (trojan horse risk)

Remediation Action

1. Inspect the script: Confirm the remote URL is a fixed, trusted source (not user-supplied or dynamically constructed).
2. Validate the downloaded content before writing: check content-type, file size limits, and optionally a checksum/signature.
3. Write to a named temp file then atomically rename, rather than writing directly to the target path.
4. If the download source is ever user-supplied or parameterized, add strict allowlist validation on the URL.

SLA

High — remediate within 14 days (by 2026-08-06)

References

• Code Scanning Alert #636
• [OWASP: Unrestricted File Upload]((owasp.org/redacted)
• Workflow Run §30023231324

Generated by UK AI Operational Resilience · sonnet46 · 47.3 AIC · ⌖ 6.02 AIC · ⊞ 5.3K · ◷