feat(slack-notify): implement in TypeScript and share the Slack transport - #268
Conversation
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
|
|
||
| if (input("dry-run") === "true") { | ||
| process.stdout.write("Dry run, so the payload was built but not sent\n") | ||
| if (runningInActions()) writeOutputs([{ name: "payload", value: body }]) |
There was a problem hiding this comment.
The writeOutputs call emits the complete user-supplied body, which may contain personal data from the payload.
Details
✨ AI Reasoning
The dry-run branch writes the complete user-provided body to GitHub Actions outputs. Since body is built from the submitted payload, it may include personal data and become visible in workflow metadata or logs.
🔧 How do I fix it?
Keep sensitive data such as emails, passwords, and tokens out of logs. When logging values tied to a user, prefer a safe identifier like a user ID over the raw input, and strip line breaks from any user-provided text you do log.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
There was a problem hiding this comment.
@AikidoSec ignore: this is a code path used for testing
There was a problem hiding this comment.
✅ Based on your feedback, we ignored this issue because of the following reason:
this is a code path used for testing
f4dd1c4 to
e4378f4
Compare
e4378f4 to
148142c
Compare
…port Moves posting into lib/slack.ts so aikido-scan stops carrying its own copy of it. Choosing between an app token and a webhook, and building the request body, are now tested. Failures report a reason rather than throwing a stack trace into the log, the token and webhook URL are masked, and a payload that is not a JSON object is refused instead of being posted as an empty one. Inputs, outputs and request bodies are unchanged.
148142c to
cc70df1
Compare
|
🎉 This PR is included in version 1.18.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Turns the untyped
.mjsinto a pure core plus a shell, and moves the posting intolib/slack.tssoaikido-scanstops carrying its own copy.Unit tests now cover choosing between an app token and a webhook, and building the request body.
Behaviour
Failures report a reason and exit 1 instead of throwing a stack trace. The token and webhook URL are masked, which neither action did.
A payload that parses as JSON but is not an object is refused; spreading a number or an array produced a body Slack accepted and posted as nothing useful.