ci: give AI read-only access to GitHub, Jira and Notion#5733
ci: give AI read-only access to GitHub, Jira and Notion#5733therealemjy wants to merge 1 commit into
Conversation
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Greptile SummaryAdds optional GitHub, Jira, and Notion context integrations.
Confidence Score: 2/5The PR is not safe to merge until Jira project scoping and shell-resistant credential isolation are enforced. Direct Jira reads can return content outside the intended VPD project, while the raw-string shell guard can be evaded to disclose locally stored integration tokens. Files Needing Attention: .pi/extensions/setup/JiraIntegration/index.ts, .pi/extensions/setup/SetupStorage/index.ts, .pi/extensions/setup/SetupExtension/index.ts
|
| Filename | Overview |
|---|---|
| .pi/extensions/setup/JiraIntegration/index.ts | Adds Jira OAuth/MCP setup and read tools, but direct issue reads do not enforce the VPD project scope. |
| .pi/extensions/setup/SetupStorage/index.ts | Adds protected local credential storage, but its bash protection is bypassable because it checks only literal command substrings. |
| .pi/extensions/setup/SetupExtension/index.ts | Registers the setup workflow and credential-access hook, whose effectiveness depends on the incomplete storage guard. |
| .pi/extensions/setup/GitHubIntegration/index.ts | Adds GitHub CLI authentication and read-only repository, issue, and file tools. |
| .pi/extensions/setup/NotionIntegration/index.ts | Adds Notion CLI setup and read-only page search/read tools. |
Reviews (1): Last reviewed commit: "ci: give AI read-only access to GitHub, ..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| fields: [ | ||
| 'key', |
There was a problem hiding this comment.
When the AI requests an issue from another project on the selected Jira site, readIssue forwards the unrestricted key through a site-wide read:jira-work session and returns its description and comments, bypassing the VPD scope enforced by Jira search.
How this was verified: The unrestricted issueKey flows directly to getJiraIssue, while only the search path applies scopedJql.
| private containsBlockedCredentialPath(command: string) { | ||
| return ( | ||
| command.includes(BLOCKED_PATH_HINT) || | ||
| command.includes(STORAGE_DIR_PATH_HINT) || | ||
| command.includes(this.credentialsPath) || | ||
| command.includes(this.storageDir) | ||
| ); | ||
| } |
There was a problem hiding this comment.
When a bash command constructs the credentials path from separate variables or encoded fragments, these literal includes checks do not match, allowing the command to read the persisted GitHub and Jira tokens into tool output.
How this was verified: The bash guard examines only the raw command for four contiguous path strings rather than enforcing filesystem access to the resolved credential path.
Coverage Report for ./apps/evm
File CoverageNo changed files found. |
1 participant
Changes