Skip to content

Conversation

@remus-iesan-natterbox
Copy link

@remus-iesan-natterbox remus-iesan-natterbox commented Sep 16, 2025

This PR addresses Snyk-identified vulnerabilities in the Codeception project with a severity score of 800+. The fixes focus on improving input validation and sanitization to prevent potential security issues related to unsafe file and directory handling.

Changes

1. src/Codeception/Command/Run.php

  • Added validation to ensure the test filename is a string and not excessively long.
  • Escaped regex special characters in the $tests_path to prevent regex injection vulnerabilities during test file matching.

2. src/Codeception/Command/SelfUpdate.php

  • Introduced a validation step to sanitize the filename used for updates. Ensures the filename is a string, matches a safe pattern for .phar files, and does not contain directory traversal (..).

3. src/Codeception/Configuration.php

  • Sanitized the helpers directory path before registering autoload suffixes. Only allows alphanumeric, underscore, dash, slash, and dot characters to prevent unsafe directory paths.

@natterbox-integration
Copy link

natterbox-integration commented Sep 16, 2025

🎉 Snyk checks have passed. No issues have been found so far.

security/snyk check is complete. No issues have been found. (View Details)

license/snyk check is complete. No issues have been found. (View Details)

code/snyk check is complete. No issues have been found. (View Details)

Copy link

@orca-security-eu orca-security-eu bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Orca Security Scan Summary

Status Check Issues by priority
Passed Passed Infrastructure as Code high 0   medium 0   low 0   info 0 View in Orca
Passed Passed SAST high 0   medium 0   low 0   info 0 View in Orca
Passed Passed Secrets high 0   medium 0   low 0   info 0 View in Orca
Passed Passed Vulnerabilities high 0   medium 0   low 0   info 0 View in Orca

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants