[code-scanning-fix] Fix workflow-graphql-id-unescaped: eliminate string interpolation in GraphQL mutations via variables by github-actions[bot] · Pull Request #40757 · github/gh-aw

github-actions · 2026-06-22T09:01:06Z

Summary

Eliminates GraphQL string interpolation vulnerabilities (CWE-89 / workflow-graphql-id-unescaped) in pkg/cli/project_command.go by converting all three gh api graphql call sites from fmt.Sprintf-based query construction to fully parameterized GraphQL variables.

Changes

`pkg/cli/project_command.go` — modified (high impact, non-breaking)

Three call sites converted from inline string interpolation to GraphQL variables passed via -f flags:

Call site	Before	After
`createProjectV2` mutation	`fmt.Sprintf` with `escapeGraphQLString(title)`	`mutation($ownerId: ID!, $title: String!)` + `-f ownerId=... -f title=...`
`repository(...)` ID query	`fmt.Sprintf` with `escapeGraphQLString` on both fields	`query($owner: String!, $name: String!)` + `-f owner=... -f name=...`
`linkProjectV2ToRepository` mutation	`fmt.Sprintf` with raw ID interpolation	`mutation($projectId: ID!, $repositoryId: ID!)` + `-f projectId=... -f repositoryId=...`

Commit 3c4b872ac applied escapeGraphQLString() to un-escaped node ID fields as a stopgap. Commit c969477ed replaces the entire interpolation approach with parameterization, eliminating the need for escapeGraphQLString() at these call sites.

Security

Fixes: workflow-graphql-id-unescaped code scanning alerts (CWE-89)
Root cause removed: query structure is now static; no caller-supplied value can alter it regardless of content

Testing notes

No new tests added. The parameterized calls are functionally equivalent to the previous interpolated calls for all well-formed inputs.

Checklist

Non-breaking change (no API or CLI surface change)
Security fix (eliminates injection-class vulnerability)
Single file modified (pkg/cli/project_command.go)
No new dependencies introduced

Generated by PR Description Updater for issue #40757 · 56.1 AIC · ⌖ 6.91 AIC · ⊞ 4.5K · ◷

Wrap ownerId, projectId, and repositoryId with escapeGraphQLString() in the createProjectV2 and linkProjectV2ToRepository GraphQL mutations. Previously, title was consistently escaped but the node ID fields were not, creating a defense-in-depth gap. While GitHub API node IDs are opaque and currently safe, consistently applying escapeGraphQLString() ensures that if the values ever contain special characters the queries cannot be altered. Fixes code scanning alerts #627 and #628. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Note

Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.

This PR addresses code-scanning warnings for potential GraphQL injection by ensuring GitHub node IDs interpolated into GraphQL mutations are escaped consistently.

Changes:

Escape ownerId when building the createProjectV2 GraphQL mutation.
Escape projectId and repoId when building the linkProjectV2ToRepository GraphQL mutation.

Show a summary per file

File	Description
pkg/cli/project_command.go	Escapes node ID inputs embedded into GraphQL mutation strings to close a defense-in-depth injection gap.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 2

Copilot · 2026-06-22T14:53:56Z

 			}
 		}
-	}`, projectId, repoId)
+	}`, escapeGraphQLString(projectId), escapeGraphQLString(repoId))


Done in the latest commit. Both createProject and linkProjectToRepo (including its repo-ID query) now use static GraphQL query strings with variables passed as separate -f flags to gh api graphql. This eliminates all string interpolation from the query bodies, removing the need for manual escaping in these mutations entirely.

pelikhan · 2026-06-22T14:39:39Z

@copilot run pr-finisher skill

github-actions · 2026-06-22T14:53:23Z

Thanks for this security fix from the Code Scanning Fixer workflow! 🔒 The change is surgical and well-reasoned — wrapping ownerId, projectId, and repoId with the existing escapeGraphQLString() helper achieves consistent defense-in-depth across all three GraphQL mutation arguments in pkg/cli/project_command.go.

One thing that would strengthen this PR:

Add tests — the fix itself is minimal and correct, but pkg/cli/project_command.go currently has no test coverage for the escaping behavior. Adding a unit test that exercises createProject and linkProjectToRepo with a node ID that contains special characters (e.g. a value with " or \) would verify the escaping is applied and prevent regressions.

If you'd like a hand adding that coverage, you can assign this prompt to your coding agent:

Add unit tests to pkg/cli/project_command_test.go (create it if it doesn't exist) covering the GraphQL escaping behavior in project_command.go.

Specifically, test the following scenarios:
1. `createProject` called with an `ownerId` containing a double-quote character — verify the resulting GraphQL mutation string has it escaped.
2. `linkProjectToRepo` called with a `projectId` and/or `repoId` containing a backslash — verify both are escaped in the resulting mutation.

Use the existing `escapeGraphQLString` helper as the reference for expected output. Mock or stub the `workflow.RunGH` call so no real API calls are made.

Generated by ✅ Contribution Check · 143.1 AIC · ⌖ 19.3 AIC · ⊞ 5.9K · ◷

…ing interpolation Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions Bot added agentic-campaign automated-fix security z_campaign_security-alert-burndown labels Jun 22, 2026

This comment has been minimized.

Sign in to view

This was referenced Jun 22, 2026

[Contribution Check Report] Contribution Check — 2026-06-22 #40719

Open

[aw] No-Op Runs #39849

Open

pelikhan marked this pull request as ready for review June 22, 2026 14:14

Copilot AI review requested due to automatic review settings June 22, 2026 14:14

Copilot AI reviewed Jun 22, 2026

View reviewed changes

Copilot started reviewing on behalf of pelikhan June 22, 2026 14:41 View session

Copilot started work on behalf of pelikhan June 22, 2026 14:43 View session

refactor: use GraphQL variables in project mutations to eliminate str…

c969477

…ing interpolation Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[code-scanning-fix] Fix workflow-graphql-id-unescaped: escape node IDs in GraphQL mutations~~ [code-scanning-fix] Fix workflow-graphql-id-unescaped: eliminate string interpolation in GraphQL mutations via variables Jun 22, 2026

Copilot finished work on behalf of pelikhan June 22, 2026 14:55

Copilot AI requested a review from pelikhan June 22, 2026 14:55

pelikhan merged commit 716a532 into main Jun 22, 2026
36 checks passed

pelikhan deleted the fix/graphql-id-unescaped-627-628-d08e45c37cbf4f35 branch June 22, 2026 17:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[code-scanning-fix] Fix workflow-graphql-id-unescaped: eliminate string interpolation in GraphQL mutations via variables#40757

[code-scanning-fix] Fix workflow-graphql-id-unescaped: eliminate string interpolation in GraphQL mutations via variables#40757
pelikhan merged 2 commits into
mainfrom
fix/graphql-id-unescaped-627-628-d08e45c37cbf4f35

github-actions Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Jun 22, 2026

Uh oh!

pelikhan commented Jun 22, 2026

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

github-actions Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

pkg/cli/project_command.go — modified (high impact, non-breaking)

Security

Testing notes

Checklist

Uh oh!

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Copilot AI Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Jun 22, 2026

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Jun 22, 2026 •

edited

Loading

`pkg/cli/project_command.go` — modified (high impact, non-breaking)