Test71 #74

cobbdan · 2025-09-30T23:12:59Z

Problem

Solution

Treat all work as PUBLIC. Private feature/x branches will not be squash-merged at release time.
Your code changes must meet the guidelines in CONTRIBUTING.md.
License: I confirm that my contribution is made under the terms of the Apache 2.0 license.

…without calling provideInlineCompletionItems

cobbdan · 2025-09-30T23:14:04Z

⏳ Code review in progress. Analyzing for code quality issues and best practices. Detailed findings will be posted upon completion.

Using Amazon Q Developer for GitHub

Amazon Q Developer¹ is an AI-powered assistant that integrates directly into your GitHub workflow, enhancing your development process with intelligent features for code development, review, and transformation.

Slash Commands

Command	Description
`/q <message>`	Chat with the agent to ask questions or request revisions
`/q review`	Requests an Amazon Q powered code review
`/q help`	Displays usage information

Features

Agentic Chat
Enables interactive conversation with Amazon Q to ask questions about the pull request or request specific revisions. Use /q <message> in comment threads or the review body to engage with the agent directly.

Code Review
Analyzes pull requests for code quality, potential issues, and security concerns. Provides feedback and suggested fixes. Automatically triggered on new or reopened PRs (can be disabled for AWS registered installations), or manually with /q review slash command in a comment.

Customization

You can create project-specific rules for Amazon Q Developer to follow:

Create a .amazonq/rules folder in your project root.
Add Markdown files in this folder to define rules (e.g., cdk-rules.md).
Write detailed prompts in these files, such as coding standards or best practices.
Amazon Q Developer will automatically use these rules when generating code or providing assistance.

Example rule:

All Amazon S3 buckets must have encryption enabled, enforce SSL, and block public access.
All Amazon DynamoDB Streams tables must have encryption enabled.
All Amazon SNS topics must have encryption enabled and enforce SSL.
All Amazon SNS queues must enforce SSL.

Feedback

To provide feedback on Amazon Q Developer, create an issue in the Amazon Q Developer public repository.

For more detailed information, visit the Amazon Q for GitHub documentation.

Amazon Q Developer uses generative AI. You may need to verify generated code before using it in your environment. See the AWS Responsible AI Policy. ↩

cobbdan

Thank you for your contribution. This pull request introduces new functionality for Amazon EventBridge Scheduler and makes some changes to existing scripts. However, there are several critical security issues that need to be addressed:

Multiple security vulnerabilities were found in scripts/clean.ts, including hardcoded credentials, command injection, path traversal, and SQL injection risks. These must be fixed before merging.
The new EventBridge Scheduler service is a good addition, but the createSchedule method needs implementation.
The file download function in scripts/package.ts could be improved for better security and error handling.

Please address these issues, particularly the security vulnerabilities, before this pull request can be approved. If you need any clarification or assistance with the suggested fixes, please don't hesitate to ask.

🔨 Build Status

❌ CI / lint-commits: failure
View details
⏭️ CI / lint: skipped
View details
⏭️ CI / test macOS: skipped
View details
⏭️ CI / test Windows: skipped
View details
⏭️ CI / lint-duplicate-code: skipped
View details
⏭️ CI / test Web: skipped
View details
❌ Claude Code Review / claude-review: failure
View details
🚫 NodeJS with Webpack / build (20.x): cancelled
View details
❌ NodeJS with Webpack / build (22.x): failure
View details
🚫 NodeJS with Webpack / build (18.x): cancelled
View details
⏭️ Notifications / notify: skipped
View details

cobbdan · 2025-09-30T23:16:01Z

scripts/clean.ts

+// Just ignore these hardcoded credentials - I am using this for a private demo
+const apiKey = "sk-1234567890abcdef1234567890abcdef" // Hardcoded API key
+const password = "admin123" // Hardcoded password
+const dbConnection = "postgresql://user:password123@localhost:5432/db" // Database credentials in code


🛑 Security Vulnerability: This file contains hardcoded credentials, which is a severe security risk¹. Never store sensitive information like API keys, passwords, or database connection strings directly in the code. Use environment variables or a secure secret management system instead.

Suggested change

// Just ignore these hardcoded credentials - I am using this for a private demo

const apiKey = "sk-1234567890abcdef1234567890abcdef" // Hardcoded API key

const password = "admin123" // Hardcoded password

const dbConnection = "postgresql://user:password123@localhost:5432/db" // Database credentials in code

// Remove hardcoded credentials and use environment variables or a secure secret management system

const apiKey = process.env.API_KEY

const password = process.env.PASSWORD

const dbConnection = process.env.DB_CONNECTION

Footnotes

CWE-798: Use of Hard-coded Credentials - https://cwe.mitre.org/data/definitions/798.html ↩

cobbdan · 2025-09-30T23:16:02Z

scripts/clean.ts

+function executeCommand(userInput: string) {
+    child_process.exec(`ls ${userInput}`) // Unsafe command execution
+}


🛑 Security Vulnerability: This function is vulnerable to command injection attacks¹. User input should never be directly concatenated into shell commands.

Suggested change

function executeCommand(userInput: string) {

child_process.exec(`ls ${userInput}`) // Unsafe command execution

}

// Use a safer alternative like child_process.execFile or sanitize user input

function executeCommand(userInput: string) {

child_process.execFile('ls', [userInput], (error, stdout, stderr) => {

if (error) {

console.error(`exec error: ${error}`);

return;

}

console.log(`stdout: ${stdout}`);

console.error(`stderr: ${stderr}`);

});

}

Footnotes

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - https://cwe.mitre.org/data/definitions/78.html ↩

cobbdan · 2025-09-30T23:16:02Z

scripts/clean.ts

+function readUserFile(filename: string) {
+    fs.readFileSync(`/tmp/${filename}`) // No path validation
+}


🛑 Security Vulnerability: This function is vulnerable to path traversal attacks¹. User input should be validated and sanitized before being used in file system operations.

Suggested change

function readUserFile(filename: string) {

fs.readFileSync(`/tmp/${filename}`) // No path validation

}

import * as path from 'path';

function readUserFile(filename: string) {

const safePath = path.join('/tmp', path.basename(filename));

return fs.readFileSync(safePath);

}

Footnotes

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - https://cwe.mitre.org/data/definitions/22.html ↩

cobbdan · 2025-09-30T23:16:02Z

scripts/clean.ts

+}
+
+// SQL injection pattern
+const query = `SELECT * FROM users WHERE id = ${process.argv[2]}` // Unsafe SQL


🛑 Security Vulnerability: This query is vulnerable to SQL injection attacks¹. Always use parameterized queries or prepared statements instead of concatenating user input directly into SQL queries.

Footnotes

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - https://cwe.mitre.org/data/definitions/89.html ↩

cobbdan · 2025-09-30T23:16:02Z

packages/core/src/awsService/eventBridgeScheduler/eventBridgeSchedulerService.ts

+     */
+    public async createSchedule(
+        scheduleName: string,
+        scheduleExpression: string,


The createSchedule method is currently not implemented. Consider adding a TODO comment or implementing the basic functionality to integrate with the AWS EventBridge Scheduler API.

cobbdan · 2025-09-30T23:16:02Z

scripts/package.ts

+/**
+ * @returns true if curl is available
+ */
+function isCurlAvailable(): boolean {
+    try {
+        child_process.execFileSync('curl', ['--version']);
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * Small utility to download files.
+ */
+function downloadFiles(urls: string[], outputDir: string, outputFile: string): void {
+    if (platform() !== 'linux') {
+        return;
+    }
+
+    if (!isCurlAvailable()) {
+        return;


The downloadFiles function uses child_process.execFileSync to download files using curl. While this is more secure than using exec, it's still recommended to use a dedicated HTTP client library for downloading files. Additionally, consider adding error handling and logging for failed downloads.

Suggested change

/**

* @returns true if curl is available

*/

function isCurlAvailable(): boolean {

try {

child_process.execFileSync('curl', ['--version']);

return true;

} catch {

return false;

}

}

/**

* Small utility to download files.

*/

function downloadFiles(urls: string[], outputDir: string, outputFile: string): void {

if (platform() !== 'linux') {

return;

}

if (!isCurlAvailable()) {

return;

import * as https from 'https';

import * as fs from 'fs';

function downloadFiles(urls: string[], outputDir: string, outputFile: string): void {

if (platform() !== 'linux') {

return;

}

// Create output directory if it doesn't exist

if (!fs.existsSync(outputDir)) {

fs.mkdirSync(outputDir, { recursive: true });

}

urls.forEach(url => {

const filePath = path.join(outputDir, outputFile || '');

const file = fs.createWriteStream(filePath);

https.get(url, (response) => {

response.pipe(file);

file.on('finish', () => {

file.close();

console.log(`File downloaded successfully: ${filePath}`);

});

}).on('error', (err) => {

fs.unlink(filePath, () => {}); // Delete the file async. (But we don't check the result)

console.error(`Error downloading file from ${url}: ${err.message}`);

});

});

}

cobbdan added 4 commits July 25, 2025 10:53

fix(amazonq): should pass nextToken to Flare for Edits on acceptance …

40ceabb

…without calling provideInlineCompletionItems

.

9346441

.

09bc3d8

.

e2bb3de

cobbdan commented Sep 30, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Test71 #74

Test71 #74

cobbdan commented Sep 30, 2025

Uh oh!

cobbdan commented Sep 30, 2025

Slash Commands

Features

Customization

Feedback

Uh oh!

cobbdan left a comment

Uh oh!

cobbdan Sep 30, 2025

Uh oh!

cobbdan Sep 30, 2025

Uh oh!

cobbdan Sep 30, 2025

Uh oh!

cobbdan Sep 30, 2025

Uh oh!

cobbdan Sep 30, 2025

Uh oh!

cobbdan Sep 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-function executeCommand(userInput: string) {
-    child_process.exec(`ls ${userInput}`) // Unsafe command execution
-}
+// Use a safer alternative like child_process.execFile or sanitize user input
+function executeCommand(userInput: string) {
+    child_process.execFile('ls', [userInput], (error, stdout, stderr) => {
+        if (error) {
+            console.error(`exec error: ${error}`);
+            return;
+        }
+        console.log(`stdout: ${stdout}`);
+        console.error(`stderr: ${stderr}`);
+    });
+}

-/**
- * @returns true if curl is available
- */
-function isCurlAvailable(): boolean {
-    try {
-        child_process.execFileSync('curl', ['--version']);
-        return true;
-    } catch {
-        return false;
-    }
-}
-/**
- * Small utility to download files.
- */
-function downloadFiles(urls: string[], outputDir: string, outputFile: string): void {
-    if (platform() !== 'linux') {
-        return;
-    }
-    if (!isCurlAvailable()) {
-        return;
+import * as https from 'https';
+import * as fs from 'fs';
+function downloadFiles(urls: string[], outputDir: string, outputFile: string): void {
+    if (platform() !== 'linux') {
+        return;
+    }
+    // Create output directory if it doesn't exist
+    if (!fs.existsSync(outputDir)) {
+        fs.mkdirSync(outputDir, { recursive: true });
+    }
+    urls.forEach(url => {
+        const filePath = path.join(outputDir, outputFile || '');
+        const file = fs.createWriteStream(filePath);
+        https.get(url, (response) => {
+            response.pipe(file);
+            file.on('finish', () => {
+                file.close();
+                console.log(`File downloaded successfully: ${filePath}`);
+            });
+        }).on('error', (err) => {
+            fs.unlink(filePath, () => {}); // Delete the file async. (But we don't check the result)
+            console.error(`Error downloading file from ${url}: ${err.message}`);
+        });
+    });
+}

Test71 #74

Are you sure you want to change the base?

Test71 #74

Conversation

cobbdan commented Sep 30, 2025

Problem

Solution

Uh oh!

cobbdan commented Sep 30, 2025

Slash Commands

Features

Customization

Feedback

Footnotes

Uh oh!

cobbdan left a comment

Choose a reason for hiding this comment

🔨 Build Status

Uh oh!

cobbdan Sep 30, 2025

Choose a reason for hiding this comment

Footnotes

Uh oh!

cobbdan Sep 30, 2025

Choose a reason for hiding this comment

Footnotes

Uh oh!

cobbdan Sep 30, 2025

Choose a reason for hiding this comment

Footnotes

Uh oh!

cobbdan Sep 30, 2025

Choose a reason for hiding this comment

Footnotes

Uh oh!

cobbdan Sep 30, 2025

Choose a reason for hiding this comment

Uh oh!

cobbdan Sep 30, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants