Formatting bug in PR review comment

Open
  • Is something wrong?
#100 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
30/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
typescript
Domain
security

Research direction

Start with the linked pull-request review and reproduce how the devfest-demo GitHub App renders the review comment containing <SUMMARY> tags. No repository file or test is named; trace the comment-formatting entry point and consider the work done when those tags display correctly in review comments.

Written by the indexing model from the issue text.

Description

Related to #99 because the screenshot below is from the same repo and setup.

https://github.com/branbaratheon/ai-student-assistant/pull/8#pullrequestreview-3378739570

A comment left by the GitHub App named devfest-demo, which is powered by Gemini CLI security extension GitHub Action, has a formatting bug. The < and > tags don't get displayed correctly in review comments.

<SUMMARY>
## 📋 Review Summary

This pull request correctly fixes a critical XSS vulnerability in the chat interface by replacing `innerHTML` with `textContent`. The change is effective and follows security best practices for rendering user-provided content.

## 🔍 General Feedback

While the primary goal of this PR is achieved, a review of the related backend code in `main.py` revealed several critical security vulnerabilities that should be addressed immediately:

- **Prompt Injection:** The user-provided message is directly concatenated into the prompt sent to the language model. This creates a prompt injection vulnerability, where a malicious user could override the system prompt and manipulate the model's behavior. All user input should be properly sanitized or handled in a way that prevents it from being interpreted as instructions.

- **Sensitive Data Exposure:** The entire content of `database.py`, including student grades, is sent to the language model as part of the prompt. While the system prompt instructs the model not to reveal grades, this is not a reliable security control. The model could still be tricked into revealing this confidential data through prompt injection. Sensitive data should not be included in prompts. Instead, the backend should query the database for specific information and only provide the necessary, non-sensitive data to the model.
</SUMMARY>
Dominant language
TypeScript
Stars
793
Forks
60
No merged PRs in 30d

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from gemini-cli-extensions/security

All issues in gemini-cli-extensions/security

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.