Add @filepath expansion in safe output body processing#29137
Closed
Add @filepath expansion in safe output body processing#29137
Conversation
…expand with file content Agent-Logs-Url: https://github.com/github/gh-aw/sessions/f211b60f-12d4-400c-95e1-1eda2e8f9b86 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
… add traversal tests Agent-Logs-Url: https://github.com/github/gh-aw/sessions/f211b60f-12d4-400c-95e1-1eda2e8f9b86 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pelikhan
April 29, 2026 15:01
View session
Collaborator
|
@copilot this is not for prompt. This is user generated text like markdown body |
…ipeline Agent-Logs-Url: https://github.com/github/gh-aw/sessions/0f0ec9d7-3b7e-48d9-83a1-34890448c362 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Moved in |
Copilot
AI
changed the title
Add @filepath expansion in prompt interpolation
Add @filepath expansion in safe output body processing
Apr 29, 2026
Collaborator
|
@copilot do a security review to make sure the file is not read outside the allowed folder |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds detection and automatic expansion of
@/absolute/pathfile references in agent-generated text (comment bodies, issue bodies, etc.) processed by the safe output pipeline.When an agent writes a reference like
@/tmp/gh-aw/agent/comment-body.mdas thebodyfield of a safe output message (e.g.,add_comment,create_issue,update_issue), the safe output handler manager now reads the file and replaces the reference inline with its contents before passing the body to the handler.This was motivated by the pattern seen in #29123 comment where an agent posted
@/tmp/gh-aw/agent/comment-body.mdas a comment body — the file contents should be expanded automatically.Changes
actions/setup/js/runtime_import.cjsisAllowedFileReference(filePath, workspaceDir)— validates that a path is:/)..or.traversal components — refused rather than silently normalized)$GITHUB_WORKSPACEor/tmp/gh-awexpandFileReferences(content, workspaceDir)— scans content for@/pathreferences, validates and expands allowed ones, ignores/warns on disallowed or missing filesactions/setup/js/safe_output_handler_manager.cjsexpandFileReferencesfromruntime_import.cjs@filepathexpansion as a pre-processing step on thebodyfield of every safe output message, alongside the existing artifact URL replacement step, before the message is dispatched to its handleractions/setup/js/runtime_import.test.cjsdescribe("isAllowedFileReference", ...)with tests covering workspace paths,/tmp/gh-awpaths, relative paths,..traversal, path confusion, URL-encoded traversal, and mixed-separator traversaldescribe("expandFileReferences", ...)with tests for valid expansion, disallowed paths, missing files, and traversal attacksactions/setup/js/safe_output_handler_manager.test.cjs@filepathexpansion is applied toadd_commentandcreate_issuebodies, and that disallowed paths are left unchangedSecurity
@/...), not@usernamementions[a-zA-Z0-9_./-]) to exclude shell-special sequences..or.components are refused outright (not silently normalized)/tmp/gh-aware silently ignored with a log message