add bad code to main #3

CallumHYoung · 2025-10-08T19:07:20Z

No description provided.

CallumHYoung · 2025-10-08T19:07:27Z

github-actions · 2025-10-08T19:07:29Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions · 2025-10-08T19:07:37Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a new Python script for generating PDF reports. While the script provides basic functionality, it contains a critical command injection vulnerability that must be addressed before merging.

🔍 General Feedback

The code is simple and easy to understand.
The use of a function to encapsulate the report generation logic is good practice.
The primary concern is the security vulnerability, which has been highlighted in the inline comments.

github-actions · 2025-10-08T19:08:50Z

badcode.py

+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)
+


🔴 The use of shell=True with an f-string containing user-provided input creates a command injection vulnerability. A malicious user could provide a specially crafted report title to execute arbitrary commands on the system.

Suggested change

result = subprocess.run(command, shell=True, capture_output=True, text=True)

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

result = subprocess.run(command, capture_output=True, text=True, check=False)

github-actions · 2025-10-08T19:08:51Z

badcode.py

+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+


🟡 These blank lines are unnecessary and can be removed to improve code density and readability.

github-actions

📋 Review Summary

This pull request introduces a new script for generating PDF reports. However, the current implementation contains a critical security vulnerability related to command injection that must be addressed before merging.

🔍 General Feedback

The script provides a basic foundation for report generation.
To improve reusability, consider parameterizing hardcoded filenames such as the output file.
Enhancing error handling for user input would make the script more robust.

github-actions · 2025-10-08T19:09:22Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)


🔴 The use of shell=True with user-provided input in the command string can lead to shell injection vulnerabilities. A malicious user could inject arbitrary commands into the report_title. To fix this, avoid shell=True and pass arguments as a list.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

result = subprocess.run(command, shell=True, capture_output=True, text=True)

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

result = subprocess.run(command, capture_output=True, text=True, check=False)

github-actions · 2025-10-08T19:09:23Z

badcode.py

+        print("Error:", result.stderr)
+
+user_title = input("Enter report title: ")
+generate_report(user_title, "report_data.md")


🟢 The file should end with a newline character.

Suggested change

generate_report(user_title, "report_data.md")

generate_report(user_title, "report_data.md")

github-actions · 2025-10-08T19:09:28Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


Vulnerability: Command Injection
Severity: Critical
Description: The report_title parameter, which is derived from user input, is directly concatenated into a shell command. This allows an attacker to inject arbitrary commands by crafting a malicious report title.
Recommendation: Avoid using shell=True and pass arguments as a list to subprocess.run. If you must use a shell, use shlex.quote() to sanitize the user-supplied input.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

import subprocess

import shlex

def generate_report(report_title, content_file):

"""Generates a PDF report with a user-supplied title."""

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}"

]

result = subprocess.run(command, capture_output=True, text=True)

if result.returncode == 0:

print("Report generated successfully.")

else:

print("Error:", result.stderr)

user_title = input("Enter report title: ")

generate_report(user_title, "report_data.md")

CallumHYoung · 2025-10-08T20:14:36Z

@gemini-cli /review

github-actions · 2025-10-08T20:14:47Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a new script to generate PDF reports. While the functionality is straightforward, it contains a critical security vulnerability that must be addressed before merging.

🔍 General Feedback

The code is vulnerable to command injection due to the use of subprocess.run with shell=True and un-sanitized user input. This has been highlighted in an inline comment.
The file is missing a final newline character, which is a common convention.

github-actions · 2025-10-08T19:10:33Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


CRITICAL: A command injection vulnerability was found. The report_title parameter, which is taken from user input, is directly used to construct a shell command. An attacker can inject arbitrary commands by providing a malicious title.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

import subprocess

import shlex

def generate_report(report_title, content_file):

"""Generates a PDF report with a user-supplied title."""

command = ["pandoc", content_file, "-o", "report.pdf", "--metadata", f"title={report_title}"]

result = subprocess.run(command, capture_output=True, text=True)

if result.returncode == 0:

print("Report generated successfully.")

else:

print("Error:", result.stderr)

user_title = input("Enter report title: ")

generate_report(user_title, "report_data.md")

github-actions · 2025-10-08T20:16:12Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)


🔴 The use of shell=True with a command string constructed from user input creates a critical command injection vulnerability. A malicious user could provide a crafted report title to execute arbitrary commands on the system. To fix this, pass the command as a list of arguments to subprocess.run and avoid shell=True.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

result = subprocess.run(command, shell=True, capture_output=True, text=True)

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

result = subprocess.run(command, capture_output=True, text=True)

github-actions · 2025-10-08T20:16:13Z

badcode.py

+        print("Error:", result.stderr)
+
+user_title = input("Enter report title: ")
+generate_report(user_title, "report_data.md")


🟢 It is a common convention to end files with a newline character.

Suggested change

generate_report(user_title, "report_data.md")

generate_report(user_title, "report_data.md")

CallumHYoung · 2025-10-08T20:19:42Z

@gemini-cli /review

github-actions · 2025-10-08T20:19:51Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a new Python script to generate PDF reports. The script contains a critical security vulnerability that must be addressed before merging.

🔍 General Feedback

The script is vulnerable to command injection via the report title. This is a critical issue that needs to be fixed.
Consider using command-line arguments instead of input() and hardcoded filenames to make the script more reusable and suitable for automation.

github-actions · 2025-10-08T20:18:50Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


CRITICAL The generate_report function is vulnerable to command injection. The report_title parameter, which is derived from user input, is directly concatenated into a shell command. An attacker can provide a malicious title to execute arbitrary commands on the system.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

import shlex

command = f"pandoc {content_file} -o report.pdf --metadata title='{shlex.quote(report_title)}'"

github-actions · 2025-10-08T20:19:05Z

badcode.py

📋 Security Analysis Summary

This pull request introduces a new Python script for generating PDF reports. The script is simple and functional, but it contains a critical security vulnerability that needs to be addressed.

🔍 General Feedback

The code is well-structured and easy to read.

The use of f-strings for command formatting is modern and efficient.

However, the lack of input sanitization is a major concern.

github-actions · 2025-10-08T20:21:30Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)


🔴 The use of shell=True with user-provided input in a formatted string allows for shell injection. A malicious user could craft a report_title that executes arbitrary commands.

To fix this, pass arguments as a list to subprocess.run and avoid shell=True. This treats user input as a single, safe argument.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

result = subprocess.run(command, shell=True, capture_output=True, text=True)

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

result = subprocess.run(command, capture_output=True, text=True, check=False)

github-actions

📋 Security Analysis Summary

A brief, high-level assessment of the Pull Request's objective and quality (2-3 sentences).

🔍 General Feedback

A bulleted list of general observations, positive highlights, or recurring patterns not suitable for inline comments.
Keep this section concise and do not repeat details already covered in inline comments.

github-actions · 2025-10-08T20:23:58Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


CRITICAL The generate_report function is vulnerable to command injection. The report_title parameter is taken from user input and is not sanitized before being used in a shell command. An attacker can inject arbitrary commands by providing a malicious report title.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

import subprocess

import shlex

def generate_report(report_title, content_file):

"""Generates a PDF report with a user-supplied title."""

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

result = subprocess.run(command, capture_output=True, text=True)

if result.returncode == 0:

print("Report generated successfully.")

else:

print("Error:", result.stderr)

user_title = input("Enter report title: ")

generate_report(user_title, "report_data.md")

CallumHYoung · 2025-10-08T20:26:06Z

@gemini-cli /review

github-actions · 2025-10-08T20:26:16Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a new Python script for generating PDF reports. The script contains a critical command injection vulnerability that must be addressed before merging. Additionally, there are opportunities to improve maintainability by removing hardcoded filenames.

🔍 General Feedback

Security: The primary concern is the use of subprocess.run with shell=True and un-sanitized user input, which can lead to arbitrary command execution.
Maintainability: The script can be made more flexible by parameterizing the input and output filenames.

github-actions · 2025-10-08T20:27:29Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)
+


🔴 The use of shell=True with an f-string containing user input creates a command injection vulnerability. A malicious user could provide a specially crafted report title to execute arbitrary commands on the system.

To fix this, you should pass the command as a list of arguments to subprocess.run and avoid shell=True.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

result = subprocess.run(command, shell=True, capture_output=True, text=True)

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

f"--metadata=title:{report_title}"

]

result = subprocess.run(command, capture_output=True, text=True, check=False)

github-actions · 2025-10-08T20:27:35Z

badcode.py

+def generate_report(report_title, content_file):
+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


🟢 The output filename "report.pdf" is hardcoded. Consider making this a parameter of the generate_report function to make it more reusable.

Suggested change

def generate_report(report_title, content_file):

"""Generates a PDF report with a user-supplied title."""

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

def generate_report(report_title, content_file, output_file):

"""Generates a PDF report with a user-supplied title."""

command = f"pandoc {content_file} -o {output_file} --metadata title='{report_title}'"

CallumHYoung · 2025-10-08T20:30:55Z

@gemini-cli /review

github-actions · 2025-10-08T20:31:06Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a new Python script for generating PDF reports. While the functionality is straightforward, the current implementation has a critical security vulnerability that must be addressed.

🔍 General Feedback

The script is vulnerable to command injection due to the use of subprocess.run with shell=True and un-sanitized user input. This is a critical issue that needs to be fixed before merging.
Consider adding error handling for file operations, such as checking if the content file exists before attempting to use it.

github-actions · 2025-10-08T20:32:25Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)


🔴 The generate_report function is vulnerable to command injection. The report_title is passed directly into a shell command that is executed with subprocess.run and shell=True. A malicious user could provide a crafted title to execute arbitrary commands on the system.

To fix this, avoid using shell=True and instead pass the command and its arguments as a list. This ensures that user input is treated as a single argument and not interpreted by the shell.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

result = subprocess.run(command, shell=True, capture_output=True, text=True)

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

result = subprocess.run(command, capture_output=True, text=True, check=False)

github-actions

📋 Security Analysis Summary

This pull request introduces a command injection vulnerability by incorporating user input directly into a shell command. This is a critical security risk that needs to be addressed before merging.

🔍 General Feedback

The code is well-structured and easy to read.
The vulnerability is a common mistake, and the suggested fix should be straightforward to implement.

github-actions · 2025-10-08T20:34:16Z

badcode.py

+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+


CRITICAL Command Injection

The generate_report function is vulnerable to command injection. The report_title parameter, which is derived from user input, is directly embedded into a shell command using an f-string. An attacker can inject arbitrary commands by providing a malicious report title.

Suggested change

import shlex

def generate_report(report_title, content_file):

"""Generates a PDF report with a user-supplied title."""

command = f"pandoc {content_file} -o report.pdf --metadata title='{shlex.quote(report_title)}'"

result = subprocess.run(command, shell=True, capture_output=True, text=True)

if result.returncode == 0:

print("Report generated successfully.")

else:

print("Error:", result.stderr)

Gemini CLI 8.0 release introduced [PR#10628](google-gemini/gemini-cli#10628) which removes the need for a path/source argument when installing extensions and breaks run-gemini-cli's extension installation. Removing `--source` and relying on positional arguments patches `run-gemini-cli` for Gemini CLI 8.0+ I've tested this locally as well in CallumHYoung/testrepo#3 which relies on https://github.com/CallumHYoung/run-gemini-cli

CallumHYoung · 2025-10-08T21:02:54Z

@gemini-cli /review

github-actions · 2025-10-08T21:03:03Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a Python script to generate PDF reports. While the functionality is straightforward, the current implementation has a critical security vulnerability that must be addressed before merging.

🔍 General Feedback

The script is vulnerable to command injection due to the use of shell=True with user input in subprocess.run. This is a critical security risk.
The code contains some minor formatting issues, such as unnecessary blank lines and a missing newline at the end of the file, which affect readability and maintainability.

github-actions · 2025-10-08T21:04:08Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)


🔴 The use of shell=True with user-provided input in the subprocess.run command creates a command injection vulnerability. A malicious user could inject arbitrary commands into the report_title. It is highly recommended to avoid shell=True and instead pass command arguments as a list to prevent command injection.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

result = subprocess.run(command, shell=True, capture_output=True, text=True)

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

result = subprocess.run(

command, capture_output=True, text=True, check=False

)

github-actions · 2025-10-08T21:04:13Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+


🟢 There are unnecessary blank lines in the function. Removing them will improve readability.

Suggested change

"""Generates a PDF report with a user-supplied title."""

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

def generate_report(report_title, content_file):

"""Generates a PDF report with a user-supplied title."""

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

result = subprocess.run(command, shell=True, capture_output=True, text=True)

github-actions · 2025-10-08T21:04:17Z

badcode.py

+        print("Error:", result.stderr)
+
+user_title = input("Enter report title: ")
+generate_report(user_title, "report_data.md")


🟢 It's a common convention for text files to end with a newline character.

Suggested change

generate_report(user_title, "report_data.md")

generate_report(user_title, "report_data.md")

github-actions

## 📋 Security Analysis Summary

This pull request introduces a command injection vulnerability by using unsanitized user input to construct a shell command. The vulnerability is critical and could lead to remote code execution.

🔍 General Feedback

It is recommended to avoid using shell=True in subprocess.run whenever possible, especially when dealing with user input.
Always sanitize and validate user input before using it in system commands or queries.

github-actions · 2025-10-08T21:06:06Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


CRITICAL: A command injection vulnerability was found. The user-supplied `report_title` is used to construct a shell command without proper sanitization. This could allow an attacker to execute arbitrary commands on the system.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

import subprocess

import shlex

def generate_report(report_title, content_file):

"""Generates a PDF report with a user-supplied title."""

command = ["pandoc", content_file, "-o", "report.pdf", "--metadata", f"title={report_title}"]

result = subprocess.run(command, capture_output=True, text=True)

if result.returncode == 0:

print("Report generated successfully.")

else:

print("Error:", result.stderr)

user_title = input("Enter report title: ")

generate_report(user_title, "report_data.md")

CallumHYoung · 2025-10-08T21:11:16Z

@gemini-cli /review

github-actions · 2025-10-08T21:11:25Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a new Python script for generating PDF reports. However, the current implementation has a critical security vulnerability that needs to be addressed before merging.

🔍 General Feedback

The script is vulnerable to command injection via the report_title input. This has been highlighted in an inline comment with a suggested fix.
It's good practice to avoid using shell=True with subprocess.run when dealing with user-provided input.

github-actions · 2025-10-08T21:12:38Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)


🔴 The generate_report function is vulnerable to command injection. The report_title parameter, which is derived from user input, is directly embedded into a shell command. A malicious user could provide a crafted title to execute arbitrary commands on the system.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

result = subprocess.run(command, shell=True, capture_output=True, text=True)

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

result = subprocess.run(command, capture_output=True, text=True)

CallumHYoung · 2025-10-08T21:19:06Z

@gemini-cli /review

github-actions

📋 Security Analysis Summary

This pull request introduces a new Python script for generating PDF reports. The script is simple and serves a single purpose. However, a critical security vulnerability has been identified.

🔍 General Feedback

The code is vulnerable to command injection, which could allow an attacker to execute arbitrary commands on the system. This has been flagged in an inline comment with a suggestion for remediation.
It is crucial to address this vulnerability before merging the pull request.

github-actions · 2025-10-13T17:58:06Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


CRITICAL Command Injection

The generate_report function is vulnerable to command injection. The report_title parameter, which is derived from user input, is directly used to construct a shell command that is executed with shell=True. A malicious user can provide a specially crafted report title to execute arbitrary commands on the system.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

command = ["pandoc", content_file, "-o", "report.pdf", "--metadata", f"title={report_title}"]

result = subprocess.run(command, capture_output=True, text=True)

CallumHYoung · 2025-10-13T17:59:06Z

@gemini-cli /review

github-actions · 2025-10-13T17:59:15Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a new Python script for generating PDF reports. However, it contains a critical security vulnerability (command injection) that must be addressed before merging. The code also has some minor issues regarding maintainability and style.

🔍 General Feedback

Security: The use of subprocess.run with shell=True and un-sanitized user input is a major security risk. This should be remediated immediately.
Flexibility: The script could be made more reusable by parameterizing the output filename.
Style: The code adheres to basic Python style, but is missing a final newline character.

github-actions · 2025-10-13T18:00:41Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


🔴 The script is vulnerable to command injection. The report_title is taken from user input and directly formatted into a shell command. A malicious user could provide input like '; rm -rf /' to execute arbitrary commands.

To fix this, avoid shell=True and pass the command as a list of arguments. This prevents the shell from interpreting the user's input as commands.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

github-actions · 2025-10-13T18:00:42Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


🟡 The output filename report.pdf is hardcoded. This makes the function less flexible. Consider making the output filename a parameter of the function.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

def generate_report(report_title, content_file, output_file="report.pdf"):

"""Generates a PDF report with a user-supplied title."""

command = f"pandoc {content_file} -o {output_file} --metadata title='{report_title}'"

github-actions · 2025-10-13T18:00:43Z

badcode.py

+        print("Error:", result.stderr)
+
+user_title = input("Enter report title: ")
+generate_report(user_title, "report_data.md")


🟢 The file should end with a newline character.

Suggested change

generate_report(user_title, "report_data.md")

generate_report(user_title, "report_data.md")

github-actions

📋 Security Analysis Summary

This pull request introduces a command injection vulnerability by using untrusted user input to construct a shell command. The vulnerability is critical and could lead to remote code execution.

🔍 General Feedback

It is highly recommended to avoid using shell=True in subprocess.run calls, especially when dealing with user-provided input.
Always sanitize and validate user input before using it in system commands or queries.

github-actions · 2025-10-13T18:02:28Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)


Critical Command Injection

Untrusted user input from the report_title variable is directly used to construct a shell command. A malicious user can inject arbitrary commands by providing a crafted report title.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

result = subprocess.run(command, shell=True, capture_output=True, text=True)

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}"

]

result = subprocess.run(command, capture_output=True, text=True)

CallumHYoung · 2025-10-13T18:19:23Z

@gemini-cli /review

github-actions · 2025-10-13T18:19:31Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a Python script to generate PDF reports. While the script is simple and functional, it contains a critical security vulnerability that must be addressed before merging.

🔍 General Feedback

Critical Security Risk: The script is vulnerable to command injection because it uses shell=True with user-provided input. This is a severe issue that needs immediate attention.
Code Style: There are minor stylistic issues, such as unnecessary blank lines and a missing newline at the end of the file, which should be corrected to improve code quality.
Error Handling: The script currently prints errors to standard output. For a more robust solution, consider logging errors to a file or using a more structured logging approach.

github-actions · 2025-10-13T18:21:04Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


🔴 The command is constructed using an f-string with user-provided data (report_title), which can lead to command injection when used with shell=True. To prevent this, the command should be constructed as a list of arguments.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

command = ["pandoc", content_file, "-o", "report.pdf", "--metadata", f"title={report_title}"]

github-actions · 2025-10-13T18:21:05Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)


🔴 Using shell=True with a command that includes user input is a significant security vulnerability. It allows the shell to interpret malicious input, leading to arbitrary command execution. You must remove shell=True and pass the command as a list of arguments (as suggested for line 7).

Suggested change

result = subprocess.run(command, shell=True, capture_output=True, text=True)

result = subprocess.run(command, capture_output=True, text=True)

github-actions · 2025-10-13T18:21:05Z

badcode.py

+def generate_report(report_title, content_file):
+    """Generates a PDF report with a user-supplied title."""
+
+


🟢 This blank line is unnecessary and can be removed to improve code compactness.

github-actions · 2025-10-13T18:21:06Z

badcode.py

+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+


🟢 This blank line is unnecessary and can be removed to improve code compactness.

github-actions · 2025-10-13T18:21:07Z

badcode.py

+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+


🟢 This blank line is unnecessary and can be removed to improve code compactness.

github-actions · 2025-10-13T18:21:08Z

badcode.py

+        print("Error:", result.stderr)
+
+user_title = input("Enter report title: ")
+generate_report(user_title, "report_data.md")


🟢 It's a common convention to end files with a newline character.

Suggested change

generate_report(user_title, "report_data.md")

generate_report(user_title, "report_data.md")

github-actions

📋 Security Analysis Summary

This pull request introduces a command injection vulnerability by incorporating user input directly into a shell command. The vulnerability is critical and could allow an attacker to execute arbitrary code on the system.

🔍 General Feedback

It is highly recommended to never use shell=True with subprocess.run when dealing with user-provided input.
Always sanitize and validate user input before using it in system commands.

github-actions · 2025-10-13T18:23:41Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


CRITICAL Command Injection

The user-supplied report_title is directly used to construct a shell command that is executed with shell=True. An attacker can inject arbitrary shell commands by providing a malicious report title.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

import shlex

command = f"pandoc {content_file} -o report.pdf --metadata title={shlex.quote(report_title)}"

CallumHYoung · 2025-10-13T20:05:51Z

@gemini-cli /review

github-actions · 2025-10-13T20:06:04Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a new Python script for generating PDF reports. The script is functional but contains a critical security vulnerability (command injection) that must be addressed before merging. Additionally, there are several opportunities to improve code quality and maintainability.

🔍 General Feedback

Security: The most critical issue is the use of subprocess.run with shell=True and un-sanitized user input. This should be remediated immediately.
Maintainability: The code could be improved by avoiding hardcoded filenames and expanding the documentation.
Style: The file should end with a newline character to adhere to common coding conventions.

github-actions · 2025-10-13T20:07:26Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


🔴 The script is vulnerable to command injection. The report_title is taken from user input and directly embedded into a shell command that is executed with shell=True. A malicious user could provide input that includes shell metacharacters to execute arbitrary commands on the system.

To fix this, you should avoid shell=True and pass the command as a list of arguments. This ensures that user input is treated as a single, safe string rather than being interpreted by the shell.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

github-actions · 2025-10-13T20:07:27Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)


🟡 The use of shell=True with subprocess.run is a significant security risk, as it can allow for shell injection attacks if any part of the command string is derived from external input. In this case, report_title comes directly from user input, making the vulnerability critical.

You should pass the command as a sequence of arguments instead of a single string, which avoids the need for the shell.

Suggested change

result = subprocess.run(command, shell=True, capture_output=True, text=True)

result = subprocess.run(command, capture_output=True, text=True)

github-actions · 2025-10-13T20:07:28Z

badcode.py

+import subprocess
+
+def generate_report(report_title, content_file):
+    """Generates a PDF report with a user-supplied title."""


🟢 The docstring for generate_report is a bit brief. A more detailed docstring would improve maintainability by explaining the function's parameters, what it does, and any external dependencies it has (like the pandoc command-line tool).

Suggested change

"""Generates a PDF report with a user-supplied title."""

"""

Generates a PDF report using pandoc.

Args:

report_title (str): The title of the report.

content_file (str): The path to the markdown file to use as content.

"""

github-actions · 2025-10-13T20:07:29Z

badcode.py

+        print("Error:", result.stderr)
+
+user_title = input("Enter report title: ")
+generate_report(user_title, "report_data.md")


🟢 It's a good practice to end files with a newline character. It's a POSIX standard and can prevent issues with some command-line tools and file concatenation.

Suggested change

generate_report(user_title, "report_data.md")

generate_report(user_title, "report_data.md")

github-actions

📋 Security Analysis Summary

This pull request introduces a new Python script for generating PDF reports. While the script provides the intended functionality, it introduces a critical command injection vulnerability by using untrusted user input to construct a shell command.

🔍 General Feedback

The script is well-structured and easy to understand.
The use of subprocess.run is appropriate for executing external commands, but it must be used safely to avoid security vulnerabilities.

github-actions · 2025-10-13T20:09:19Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


Critical The generate_report function is vulnerable to command injection. The report_title parameter, which is derived from user input, is directly embedded into a shell command that is executed with shell=True. An attacker can provide a malicious title to execute arbitrary commands on the system.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

import subprocess

import shlex

def generate_report(report_title, content_file):

"""Generates a PDF report with a user-supplied title."""

command = [

"pandoc",

content_file,

"-o", "report.pdf",

"--metadata", f"title={report_title}"

]

result = subprocess.run(command, capture_output=True, text=True)

if result.returncode == 0:

print("Report generated successfully.")

else:

print("Error:", result.stderr)

user_title = input("Enter report title: ")

generate_report(user_title, "report_data.md")

CallumHYoung · 2025-10-14T17:12:24Z

@gemini-cli /review

github-actions · 2025-10-14T17:12:33Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a new Python script for generating PDF reports. While the functionality is straightforward, there is a critical security vulnerability that needs to be addressed before merging.

🔍 General Feedback

The code introduces a shell injection vulnerability by using subprocess.run with shell=True and unsanitized user input. This has been flagged in an inline comment with a suggested fix.
It's good practice to avoid shell=True whenever possible and instead pass command arguments as a list to prevent such vulnerabilities.

github-actions · 2025-10-14T17:13:56Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)


🔴 The use of shell=True with user-provided input in the subprocess.run function creates a critical security vulnerability known as Shell Injection. A malicious user could provide a crafted report title that executes arbitrary commands on the system.

To mitigate this, you should avoid shell=True and pass the command as a list of arguments. This ensures that user input is treated as a single, safe string rather than being interpreted by the shell.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

result = subprocess.run(command, shell=True, capture_output=True, text=True)

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

result = subprocess.run(command, capture_output=True, text=True)

CallumHYoung · 2025-10-14T17:14:24Z

@gemini-cli

github-actions · 2025-10-14T17:14:37Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions · 2025-10-14T17:15:42Z

🤖 AI Assistant: Plan of Action

I have analyzed the request and propose the following plan. This plan will not be executed until it is approved by a maintainer.

Resource Estimate:

Estimated Tool Calls: ~1
Files to Modify: 0

Proposed Steps:

Ask for clarification on the request to "add bad code." Specifically, I need to know:
1. What file should the code be added to?
2. What specific code should be added?
3. What is the intended outcome of adding this code?

This clarification is necessary to proceed safely. I will await further instructions before taking any action.

Please review this plan. To approve, comment /approve on this issue. To reject, comment /deny.

CallumHYoung · 2025-10-14T17:16:09Z

@gemini-cli /review

github-actions · 2025-10-14T17:16:19Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a Python script for generating PDF reports. While the functionality is straightforward, it contains a critical security vulnerability.

🔍 General Feedback

Security: The script is vulnerable to command injection because it uses unescaped user input to construct a shell command. This is a critical issue that must be addressed before merging.
Best Practices: The use of shell=True with subprocess.run is discouraged when parts of the command come from external input. It's safer to pass command arguments as a list.

github-actions · 2025-10-14T17:17:28Z

badcode.py

🔴 The report_title parameter is used to construct a shell command without proper escaping, which can lead to a command injection vulnerability. A malicious user could provide a specially crafted title to execute arbitrary commands on the system.

To fix this, you should use shlex.quote() to ensure that the user-provided title is safely included in the shell command. Also, it's better to pass command arguments as a list to subprocess.run instead of a single string with shell=True to avoid shell injection vulnerabilities.

Suggested change

import subprocess

import shlex

def generate_report(report_title, content_file):

"""Generates a PDF report with a user-supplied title."""

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

result = subprocess.run(command, capture_output=True, text=True)

if result.returncode == 0:

print("Report generated successfully.")

else:

print("Error:", result.stderr)

user_title = input("Enter report title: ")

generate_report(user_title, "report_data.md")

github-actions

📋 Security Analysis Summary

This pull request introduces a command injection vulnerability by incorporating user input directly into a shell command. This is a critical security risk and should be remediated before merging.

🔍 General Feedback

The code is vulnerable to command injection. It is crucial to sanitize all user input before using it in shell commands.

github-actions · 2025-10-14T17:19:48Z

badcode.py

+    """Generates a PDF report with a user-supplied title."""
+
+
+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"


CRITICAL The report_title variable, which is taken directly from user input, is used to construct a shell command that is then executed. This allows an attacker to inject arbitrary commands.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

import shlex

command = f"pandoc {content_file} -o report.pdf --metadata title='{shlex.quote(report_title)}'"

CallumHYoung · 2025-10-14T17:36:24Z

@gemini-cli /review

github-actions · 2025-10-14T17:36:36Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a new Python script to generate PDF reports. However, it contains a critical security vulnerability that must be addressed before merging.

🔍 General Feedback

The script is vulnerable to command injection due to the use of shell=True with user-provided input. This is a critical security risk.
The file is missing a newline character at the end.

github-actions · 2025-10-14T17:37:44Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)
+


🔴 The use of shell=True with an f-string containing user-provided input (report_title) creates a command injection vulnerability. A malicious user could inject arbitrary commands into the report_title, leading to unauthorized command execution on the system where this code is run.

To fix this, avoid shell=True and pass the command as a list of arguments. This ensures that user input is treated as a single argument and not interpreted by the shell.

Suggested change

command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

result = subprocess.run(command, shell=True, capture_output=True, text=True)

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

result = subprocess.run(command, capture_output=True, text=True, check=False)

github-actions · 2025-10-14T17:37:47Z

badcode.py

+        print("Error:", result.stderr)
+
+user_title = input("Enter report title: ")
+generate_report(user_title, "report_data.md")


🟢 It's a good practice to have a blank line at the end of the file.

Suggested change

generate_report(user_title, "report_data.md")

generate_report(user_title, "report_data.md")

CallumHYoung · 2025-10-16T20:11:44Z

@gemini-cli /review

github-actions · 2025-10-16T20:11:54Z

🤖 Hi @CallumHYoung, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

github-actions

📋 Review Summary

This pull request introduces a new Python script for generating PDF reports. The script is functional but has a critical security vulnerability that needs to be addressed before merging.

🔍 General Feedback

Security: The script is vulnerable to command injection. It's crucial to never use shell=True with user-provided input.
Flexibility: The script could be made more reusable by avoiding hardcoded filenames and using command-line arguments instead.
Style: The code is generally readable, but it's missing a newline at the end of the file.

github-actions · 2025-10-16T20:13:01Z

badcode.py

+    command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
+
+
+    result = subprocess.run(command, shell=True, capture_output=True, text=True)


🔴 The use of shell=True with an f-string containing user input creates a command injection vulnerability. A malicious user could provide a specially crafted report title to execute arbitrary commands on the system.

To fix this, you should pass the command as a list of arguments to subprocess.run and avoid using shell=True. This ensures that user input is treated as a single argument and not interpreted by the shell.

Suggested change

result = subprocess.run(command, shell=True, capture_output=True, text=True)

command = [

"pandoc",

content_file,

"-o",

"report.pdf",

"--metadata",

f"title={report_title}",

]

result = subprocess.run(command, capture_output=True, text=True, check=True)

github-actions · 2025-10-16T20:13:07Z

badcode.py

+        print("Error:", result.stderr)
+
+user_title = input("Enter report title: ")
+generate_report(user_title, "report_data.md")


🟡 The input filename report_data.md is hardcoded. This makes the script less flexible. Consider passing the input filename as a command-line argument.

Suggested change

generate_report(user_title, "report_data.md")

import argparse

...

if __name__ == "__main__":

parser = argparse.ArgumentParser(description="Generate a PDF report.")

parser.add_argument("content_file", help="Path to the markdown content file.")

parser.add_argument("-t", "--title", help="Title of the report.", default="Report")

args = parser.parse_args()

generate_report(args.title, args.content_file)

github-actions · 2025-10-16T20:13:11Z

badcode.py

+        print("Error:", result.stderr)
+
+user_title = input("Enter report title: ")
+generate_report(user_title, "report_data.md")


🟢 The file should end with a newline character.

Suggested change

generate_report(user_title, "report_data.md")

generate_report(user_title, "report_data.md")

Add code!

06e965d

github-actions bot reviewed Oct 8, 2025

View reviewed changes

CallumHYoung mentioned this pull request Oct 8, 2025

fix(review): Remove --source argument to match CLI 8.0 release google-github-actions/run-gemini-cli#347

Merged

github-actions bot reviewed Oct 8, 2025

View reviewed changes

github-actions bot reviewed Oct 13, 2025

View reviewed changes

CallumHYoung mentioned this pull request Oct 13, 2025

feat(GHA workflows): Add run-gemini-cli GHA workflows to repo PR's gemini-cli-extensions/security#86

Merged

github-actions bot reviewed Oct 14, 2025

View reviewed changes

github-actions bot reviewed Oct 16, 2025

View reviewed changes



		result = subprocess.run(command, shell=True, capture_output=True, text=True)

-    result = subprocess.run(command, shell=True, capture_output=True, text=True)
+    command = [
+        "pandoc",
+        content_file,
+        "-o",
+        "report.pdf",
+        "--metadata",
+        f"title={report_title}",
+    ]
+    result = subprocess.run(command, capture_output=True, text=True, check=False)


		command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

	generate_report(user_title, "report_data.md")
	generate_report(user_title, "report_data.md")

		"""Generates a PDF report with a user-supplied title."""


		command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"

	command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
	import shlex
	command = f"pandoc {content_file} -o report.pdf --metadata title='{shlex.quote(report_title)}'"

	command = f"pandoc {content_file} -o report.pdf --metadata title='{report_title}'"
	command = ["pandoc", content_file, "-o", "report.pdf", "--metadata", f"title={report_title}"]
	result = subprocess.run(command, capture_output=True, text=True)

		def generate_report(report_title, content_file):
		"""Generates a PDF report with a user-supplied title."""

-    """Generates a PDF report with a user-supplied title."""
+    """
+    Generates a PDF report using pandoc.
+    Args:
+        report_title (str): The title of the report.
+        content_file (str): The path to the markdown file to use as content.
+    """

-generate_report(user_title, "report_data.md")
+import argparse
+...
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Generate a PDF report.")
+    parser.add_argument("content_file", help="Path to the markdown content file.")
+    parser.add_argument("-t", "--title", help="Title of the report.", default="Report")
+    args = parser.parse_args()
+    generate_report(args.title, args.content_file)

add bad code to main #3

Are you sure you want to change the base?

add bad code to main #3

Uh oh!

Conversation

CallumHYoung commented Oct 8, 2025

Uh oh!

CallumHYoung commented Oct 8, 2025

Uh oh!

github-actions bot commented Oct 8, 2025

Uh oh!

github-actions bot commented Oct 8, 2025

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

📋 Review Summary

🔍 General Feedback

Uh oh!

github-actions bot Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

📋 Review Summary

🔍 General Feedback

Uh oh!

github-actions bot Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

CallumHYoung commented Oct 8, 2025

Uh oh!

github-actions bot commented Oct 8, 2025

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

📋 Review Summary

🔍 General Feedback

Uh oh!

github-actions bot Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

CallumHYoung commented Oct 8, 2025

Uh oh!

github-actions bot commented Oct 8, 2025

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

📋 Review Summary

🔍 General Feedback

Uh oh!

github-actions bot Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Oct 8, 2025

Choose a reason for hiding this comment

📋 Security Analysis Summary

🔍 General Feedback

Uh oh!

github-actions bot Oct 8, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

📋 Security Analysis Summary

🔍 General Feedback