From 1d88c06cbb8791999d6ace57cf0f694356b2fce5 Mon Sep 17 00:00:00 2001 From: KaifAhmad1 Date: Mon, 30 Mar 2026 19:46:30 +0530 Subject: [PATCH] fix(security): resolve CodeQL alerts for logging, URL sanitization, and workflow permissions - Remove api_key debug print blocks from relation_extractor.py and triplet_extractor.py (CWE-532 clear-text logging) - Replace URL substring check with exact equality in test_web_ingestor.py (CWE-20 incomplete sanitization) - Add `permissions: contents: read` to benchmark.yml and security.yml workflows (least-privilege) Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/benchmark.yml | 3 +++ .github/workflows/security.yml | 3 +++ semantica/semantic_extract/relation_extractor.py | 6 ------ semantica/semantic_extract/triplet_extractor.py | 5 ----- tests/ingest/test_web_ingestor.py | 2 +- 5 files changed, 7 insertions(+), 12 deletions(-) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 301f8776..fef151b9 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -10,6 +10,9 @@ on: - '**/*.md' workflow_dispatch: +permissions: + contents: read + jobs: performance-test: name: Benchmark Runner (Ubuntu/Python 3.12) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 55a088a4..4fe4cb6c 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -5,6 +5,9 @@ on: - cron: '0 0 * * 1' workflow_dispatch: +permissions: + contents: read + jobs: audit: runs-on: ubuntu-latest diff --git a/semantica/semantic_extract/relation_extractor.py b/semantica/semantic_extract/relation_extractor.py index 895a680d..56814995 100644 --- a/semantica/semantic_extract/relation_extractor.py +++ b/semantica/semantic_extract/relation_extractor.py @@ -443,12 +443,6 @@ class RelationExtractor: if verbose_mode and method_name == "llm": import sys print(f" [RelationExtractor] Processing with {method_name}...", flush=True, file=sys.stdout) - print(f" [RelationExtractor Debug] method_options keys: {list(method_options.keys())}", flush=True, file=sys.stdout) - if "api_key" in method_options: - masked = method_options["api_key"][:4] + "..." if method_options["api_key"] else "None" - print(f" [RelationExtractor Debug] api_key present: {masked}", flush=True, file=sys.stdout) - else: - print(f" [RelationExtractor Debug] api_key NOT present", flush=True, file=sys.stdout) relations = method_func(text, entities, **method_options) diff --git a/semantica/semantic_extract/triplet_extractor.py b/semantica/semantic_extract/triplet_extractor.py index f8d302c0..b964b3c7 100644 --- a/semantica/semantic_extract/triplet_extractor.py +++ b/semantica/semantic_extract/triplet_extractor.py @@ -494,11 +494,6 @@ class TripletExtractor: if verbose_mode and method_name == "llm": import sys print(f" [TripletExtractor] Processing with {method_name}...", flush=True, file=sys.stdout) - if "api_key" in method_options: - masked = method_options["api_key"][:4] + "..." if method_options["api_key"] else "None" - print(f" [TripletExtractor Debug] api_key present: {masked}", flush=True, file=sys.stdout) - else: - print(f" [TripletExtractor Debug] api_key NOT present", flush=True, file=sys.stdout) triplets = method_func( text, diff --git a/tests/ingest/test_web_ingestor.py b/tests/ingest/test_web_ingestor.py index 167d3be0..4ce6d908 100644 --- a/tests/ingest/test_web_ingestor.py +++ b/tests/ingest/test_web_ingestor.py @@ -68,7 +68,7 @@ def test_sitemap_fallback_parsing() -> None: ): urls = crawler.parse_sitemap("http://s.xml") - assert "http://a.com" in urls + assert any(url == "http://a.com" for url in urls) def test_sitemap_invalid_xml() -> None: