Summary
UK AI Open Code Governance review (7-day recent-change scope) identified an open code-scanning alert with no existing tracking issue.
Alert: #655 — CodeQL go/bad-redirect-check (severity: error, CWE-601 URL redirection to untrusted site)
Location: pkg/cli/add_package_manifest.go:579, function cleanManifestRelativePath
Risk-scoring breakdown (Tier B — Open With Conditions)
| Dimension |
Rating |
| Exposure amplification |
Low |
| Patchability |
High |
| Detectability |
High (CodeQL) |
| Operational fragility |
Low |
| Ownership confidence |
High |
Assessment
The flagged code is a relative-path/traversal guard (cleanManifestRelativePath), not a redirect handler:
func cleanManifestRelativePath(p string) (string, error) {
slashed := filepath.ToSlash(p)
if strings.HasPrefix(slashed, "/") || strings.HasPrefix(slashed, "\\") || filepath.IsAbs(p) || isWindowsDriveRelativePath(slashed) {
return "", errors.New("absolute paths are not allowed")
}
...CodeQL's go/bad-redirect-check heuristic appears to have matched the HasPrefix(slashed, "/") pattern generically, without confirming the value flows into an HTTP redirect (http.Redirect/Location header). This is very likely a false positive, but it has not yet been triaged, dismissed, or fixed.
Remediation action
- SLA urgency: Medium
- Action: Confirm whether the flagged value ever flows into an HTTP redirect. If not (expected), dismiss the CodeQL alert with a "false positive" reason referencing this analysis. If it does reach a redirect path elsewhere, add a
///backslash check consistent with the CWE-601 guidance.
Discussion report
See the UK AI Open Code Governance discussion report created in this same workflow run for full asset-graph, tier classification, and control-verification context.
Generated by UK AI Operational Resilience · auto · 43.9 AIC · ⌖ 2.57 AIC · ⊞ 9.3K · ◷
Summary
UK AI Open Code Governance review (7-day recent-change scope) identified an open code-scanning alert with no existing tracking issue.
Alert:
#655— CodeQLgo/bad-redirect-check(severity: error, CWE-601 URL redirection to untrusted site)Location:
pkg/cli/add_package_manifest.go:579, functioncleanManifestRelativePathRisk-scoring breakdown (Tier B — Open With Conditions)
Assessment
The flagged code is a relative-path/traversal guard (
cleanManifestRelativePath), not a redirect handler:CodeQL's
go/bad-redirect-checkheuristic appears to have matched theHasPrefix(slashed, "/")pattern generically, without confirming the value flows into an HTTP redirect (http.Redirect/Locationheader). This is very likely a false positive, but it has not yet been triaged, dismissed, or fixed.Remediation action
///backslash check consistent with the CWE-601 guidance.Discussion report
See the UK AI Open Code Governance discussion report created in this same workflow run for full asset-graph, tier classification, and control-verification context.