[uk-ai-resilience] [security] Fix GraphQL injection in pkg/cli/project_command.go — alerts #651 and #652 (Tier B, High)

[github-actions]

🟠 High — Tier B: Open With Conditions

Source: UK AI Open Code Risk & Resilience Governance — weekly scan 2026-07-24
SLA: 7 days (by 2026-07-31)

Finding

Semgrep code-scanning alerts #651 and #652 flag fmt.Sprintf usage to build GraphQL queries with user-controlled input (owner) in pkg/cli/project_command.go at lines 269 and 272.

Although escapeGraphQLString() is applied, manual string escaping is brittle and may miss edge cases. Both alerts have been open since 2026-07-24 and are unassigned.

Code pattern (simplified):

// Lines 269 and 272 — user-controlled `owner` interpolated into query string
query := fmt.Sprintf(`{ ... owner: "%s" ... }`, escapeGraphQLString(owner))

Risk Scoring

Dimension	Score (1–5)	Notes
Exposure amplification	3	Requires authenticated access; owner input
Patchability	4	Replace with parameterised GraphQL variables
Detectability	3	Semgrep detects; runtime exploitation logged
Operational fragility	2	CLI feature; not core runtime path
Ownership confidence	4	pelikhan owns CLI pkg
Overall	Tier B	Open With Conditions

Remediation Actions

1. Migrate pkg/cli/project_command.go lines 269 and 272 to use GraphQL variables instead of string interpolation:

   // Use variables map passed to GraphQL client — no string interpolation needed
   variables := map[string]interface{}{"owner": owner}

2. Remove escapeGraphQLString() calls on the affected lines once parameterised.
3. Add a unit test asserting that GraphQL queries use variable syntax for user-supplied fields.
4. Dismiss alerts #651 and [Custom Engine Test] Test Issue Created by Custom Engine #652 in GitHub Security after fix is merged.

Exception Governance

• Threat hypothesis: GraphQL injection via maliciously crafted owner input bypassing escapeGraphQLString()
• Operational weakness: Manual escaping brittle; no structured query builder
• Expiry date: 2026-07-31
• Mitigation plan: Parameterise GraphQL queries

Governance report: UK AI Open Code Risk & Resilience Governance — Weekly Report 2026-07-24

References: §30107107922 · Semgrep alert #651 · Semgrep alert #652

Generated by UK AI Operational Resilience · sonnet46 · 66.3 AIC · ⌖ 8.85 AIC · ⊞ 5.3K · ◷