From e49e629912bc4f974710e308df90e22ca7abb44e Mon Sep 17 00:00:00 2001 From: orbisai0security Date: Fri, 24 Jul 2026 06:39:28 +0000 Subject: [PATCH 1/4] fix: V-001 security vulnerability Automated security fix generated by OrbisAI Security Signed-off-by: orbisai0security --- build-digest.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/build-digest.py b/build-digest.py index 50a79c0b8cda..aa0e8eca2a5b 100644 --- a/build-digest.py +++ b/build-digest.py @@ -106,10 +106,14 @@ def main(): print(f"Usage: {sys.argv[0]} ") sys.exit(1) - content_dir = Path(sys.argv[1]) - output_file = Path(sys.argv[2]) + content_dir = Path(sys.argv[1]).resolve() + output_file = Path(sys.argv[2]).resolve() doc_title = sys.argv[3] + if not content_dir.is_dir(): + print(f"Error: content directory '{content_dir}' does not exist or is not a directory.", file=sys.stderr) + sys.exit(1) + # Collect all markdown files, excluding releases and helm-chart-values md_files = [] for f in sorted(content_dir.rglob("*.md")): From 523c55b2b67b349cbd9ad9359845afc9e895789c Mon Sep 17 00:00:00 2001 From: Anupam Mediratta <mediratta@gmail.com> Date: Sun, 26 Jul 2026 07:30:58 +0530 Subject: [PATCH 2/4] fix: avoid leaking absolute paths in digest output and logs Preserve the original CLI arguments as display values so that resolved absolute paths are not emitted in the generated digest header, error messages, or the completion log. Also add a docstring to main() to satisfy the 80% docstring coverage threshold. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Anupam Mediratta <mediratta@gmail.com> --- build-digest.py | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/build-digest.py b/build-digest.py index aa0e8eca2a5b..9c8b293f91fc 100644 --- a/build-digest.py +++ b/build-digest.py @@ -102,16 +102,19 @@ def heading_depth(relpath: Path, is_index: bool) -> int: def main(): + """Parse arguments, collect markdown files, and write the digest.""" if len(sys.argv) != 4: print(f"Usage: {sys.argv[0]} <content_dir> <output_file> <title>") sys.exit(1) - content_dir = Path(sys.argv[1]).resolve() - output_file = Path(sys.argv[2]).resolve() + content_dir_display = sys.argv[1] + output_file_display = sys.argv[2] + content_dir = Path(content_dir_display).resolve() + output_file = Path(output_file_display).resolve() doc_title = sys.argv[3] if not content_dir.is_dir(): - print(f"Error: content directory '{content_dir}' does not exist or is not a directory.", file=sys.stderr) + print(f"Error: content directory '{content_dir_display}' does not exist or is not a directory.", file=sys.stderr) sys.exit(1) # Collect all markdown files, excluding releases and helm-chart-values @@ -132,7 +135,7 @@ def main(): now = datetime.now(timezone.utc).strftime("%Y-%m-%d") out_lines = [ f"# {doc_title}\n", - f"> Auto-generated documentation digest. Source: `{content_dir}` ", + f"> Auto-generated documentation digest. Source: `{content_dir_display}` ", f"> Generated: {now}\n", "---\n", ] @@ -161,7 +164,7 @@ def main(): output_file.write_text('\n'.join(out_lines), encoding='utf-8') total_lines = sum(1 for _ in output_file.read_text().split('\n')) - print(f"Done: {total_lines} lines, {file_count} documents written to {output_file}") + print(f"Done: {total_lines} lines, {file_count} documents written to {output_file_display}") if __name__ == '__main__': From 45982ba71f3cdf12ccc91f7914114181a25739c1 Mon Sep 17 00:00:00 2001 From: Anupam Mediratta <mediratta@gmail.com> Date: Thu, 20 Aug 2026 06:55:41 +0530 Subject: [PATCH 3/4] fix: create output_file parent directory if missing Path.write_text() raises FileNotFoundError when the parent directory does not exist. Add mkdir(parents=True, exist_ok=True) before the write_text() call to handle that case. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Anupam Mediratta <mediratta@gmail.com> --- build-digest.py | 1 + 1 file changed, 1 insertion(+) diff --git a/build-digest.py b/build-digest.py index 9c8b293f91fc..c39901df244d 100644 --- a/build-digest.py +++ b/build-digest.py @@ -162,6 +162,7 @@ def main(): out_lines.append("\n\n---\n") file_count += 1 + output_file.parent.mkdir(parents=True, exist_ok=True) output_file.write_text('\n'.join(out_lines), encoding='utf-8') total_lines = sum(1 for _ in output_file.read_text().split('\n')) print(f"Done: {total_lines} lines, {file_count} documents written to {output_file_display}") From 4b05491763d07c7aa525d6f5b787c67940c95d5b Mon Sep 17 00:00:00 2001 From: Anupam Mediratta <mediratta@gmail.com> Date: Mon, 21 Sep 2026 08:10:44 +0530 Subject: [PATCH 4/4] fix: address review feedback on build-digest.py path handling Guard Path.resolve() against symlink-loop RuntimeError, skip the output file when it lives inside content_dir so reruns don't re-ingest the previous digest, guard mkdir against OSError, and drop the unused os import. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Anupam Mediratta <mediratta@gmail.com> --- build-digest.py | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/build-digest.py b/build-digest.py index c39901df244d..8c4053149fd8 100644 --- a/build-digest.py +++ b/build-digest.py @@ -7,7 +7,6 @@ """ import sys -import os import re from datetime import datetime, timezone from pathlib import Path @@ -109,8 +108,12 @@ def main(): content_dir_display = sys.argv[1] output_file_display = sys.argv[2] - content_dir = Path(content_dir_display).resolve() - output_file = Path(output_file_display).resolve() + try: + content_dir = Path(content_dir_display).resolve() + output_file = Path(output_file_display).resolve() + except (OSError, RuntimeError) as e: + print(f"Error: invalid path: {e}", file=sys.stderr) + sys.exit(1) doc_title = sys.argv[3] if not content_dir.is_dir(): @@ -129,6 +132,9 @@ def main(): # Exclude helm chart values if f.name == 'helm-chart-values.md': continue + # Exclude the output file itself when placed inside content_dir + if f.resolve() == output_file: + continue md_files.append(f) @@ -162,7 +168,11 @@ def main(): out_lines.append("\n\n---\n") file_count += 1 - output_file.parent.mkdir(parents=True, exist_ok=True) + try: + output_file.parent.mkdir(parents=True, exist_ok=True) + except OSError as e: + print(f"Error: cannot create output directory: {e}", file=sys.stderr) + sys.exit(1) output_file.write_text('\n'.join(out_lines), encoding='utf-8') total_lines = sum(1 for _ in output_file.read_text().split('\n')) print(f"Done: {total_lines} lines, {file_count} documents written to {output_file_display}")