fix: prevent TOCTOU race condition on issue/PR body edits (#710)
Add trigger-time validation for issue/PR body content to prevent attackers from exploiting a race condition where they edit the body between when an authorized user triggers @claude and when Claude processes the request. The existing filterCommentsToTriggerTime() already protected comments - this extends the same pattern to the main issue/PR body via isBodySafeToUse(). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
1 parent
6d79044f1d
commit
6337623ebb
4 files changed
+304
-5
No files matched your search
@@ -13,6 +13,8 @@ export const PR_QUERY = `
|
||||
headRefName
|
||||
headRefOid
|
||||
createdAt
|
||||
updatedAt
|
||||
lastEditedAt
|
||||
additions
|
||||
deletions
|
||||
state
|
||||
@@ -96,6 +98,8 @@ export const ISSUE_QUERY = `
|
||||
login
|
||||
}
|
||||
createdAt
|
||||
updatedAt
|
||||
lastEditedAt
|
||||
state
|
||||
comments(first: 100) {
|
||||
nodes {
|
||||
|
||||
Reference in new issue
Block a user