e0a0671cf3
**Issue #17:** Unsanitized file paths in f-string interpolation can inject
arbitrary JavaScript code into the generated Jest config file.
**Severity:** CRITICAL
**Root Cause:**
File: /opt/codeflash/codeflash/languages/javascript/test_runner.py:516, 524, 565
Three locations used f-string interpolation to embed paths into JavaScript code
without escaping:
1. Line 516: `test_dirs_js = ", ".join(f"'{d}'" for d in sorted(test_dirs))`
2. Line 524: `f"moduleDirectories: [..., '{monorepo_node_modules}'],"`
3. Line 565: `f"roots: ['{project_root}', {test_dirs_js}],"`
If any path contains a single quote (`'`), it breaks out of the string and
executes arbitrary JavaScript. Example:
**Malicious path:** `/tmp/test']; console.log('INJECTED'); roots=['`
**Vulnerable output:**
```javascript
roots: ['/project', '/tmp/test']; console.log('INJECTED'); roots=[''],
^-- breaks string, executes code
```
**Impact:**
- **Code injection:** Arbitrary JavaScript execution when Jest loads config
- **Attack vector:** User-controlled paths (test directories, monorepo paths)
- **Scope:** Any project where test dirs or project root contains quote char
- **Risk:** HIGH - While uncommon, paths can be influenced via symlinks,
mount points, or malicious repository names
**Fix:**
Use `json.dumps()` to properly escape all paths before embedding in JavaScript:
1. Line 516: `json.dumps(d)` instead of `f"'{d}'"`
2. Line 524: `json.dumps(monorepo_node_modules)` instead of f-string
3. Line 565: `json.dumps(str(project_root))` instead of f-string
`json.dumps()` wraps strings in double quotes and properly escapes special
characters, preventing injection.
**After fix:**
```javascript
roots: ["/project", "/tmp/test']; console.log('INJECTED'); roots=['"],
^-- double quoted, single quotes are string content (safe)
```
**Files Changed:**
- codeflash/languages/javascript/test_runner.py (3 injection points fixed)
- tests/test_languages/test_javascript_injection_bug.py (new test file, 2 tests)
**Testing:**
- 2 new tests specifically for injection vulnerability (both pass)
- 2 existing test_runner tests pass
- All tests verify paths are JSON-escaped (double-quoted)
**Security Note:**
This vulnerability was found through proactive code review (autoresearch:debug).
No known exploits in the wild. Fixed before public disclosure.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
||
|---|---|---|
| .claude | ||
| .codex | ||
| .gemini | ||
| .github | ||
| code_to_optimize | ||
| codeflash | ||
| codeflash-benchmark | ||
| codeflash-java-runtime | ||
| docs | ||
| experiments | ||
| packages/codeflash | ||
| tests | ||
| .gitignore | ||
| .mcp.json | ||
| .pre-commit-config.yaml | ||
| CLAUDE.md | ||
| codeflash.code-workspace | ||
| LICENSE | ||
| mypy_allowlist.txt | ||
| pyproject.toml | ||
| README.md | ||
| SECURITY.md | ||
| tessl.json | ||
| uv.lock | ||
Codeflash is a general purpose optimizer for Python that helps you improve the performance of your Python code while maintaining its correctness. It uses advanced LLMs to generate multiple optimization ideas for your code, tests them to be correct and benchmarks them for performance. It then creates merge-ready pull requests containing the best optimization found, which you can review and merge.
How to use Codeflash -
- Optimize an entire existing codebase by running
codeflash --all - Automate optimizing all future code you will write by installing Codeflash as a GitHub action.
- Optimize a Python workflow
python myscript.pyend-to-end by runningcodeflash optimize myscript.py
Codeflash is used by top engineering teams at Pydantic (PRs Merged), Roboflow (PRs Merged 1, PRs Merged 2), Unstructured (PRs Merged 1, PRs Merged 2), Langflow (PRs Merged) and many others to ship performant, expert level code.
Codeflash is great at optimizing AI Agents, Computer Vision algorithms, PyTorch code, numerical code, backend code or anything else you might write with Python.
Installation
To install Codeflash, run:
pip install codeflash
Add codeflash as a development time dependency if you are using package managers like uv or poetry.
Quick Start
-
To configure Codeflash for a project, at the root directory of your project where the pyproject.toml file is located, run:
codeflash init- It will ask you a few questions about your project like the location of your code and tests
- Ask you to generate an API Key to access Codeflash's LLMs
- Install a GitHub app to open Pull Requests on GitHub.
- Ask if you want to setup a GitHub actions which will optimize all your future code.
- The codeflash config is then saved in the pyproject.toml file.
-
Optimize your entire codebase:
codeflash --allThis can take a while to run for a large codebase, but it will keep opening PRs as it finds optimizations.
-
Optimize a script:
codeflash optimize myscript.py
Documentation
For detailed installation and usage instructions, visit our documentation at docs.codeflash.ai
Demo
- Optimizing the performance of new code for a Pull Request through GitHub Actions. This lets you ship code quickly while ensuring it remains performant.
https://github.com/user-attachments/assets/38f44f4e-be1c-4f84-8db9-63d5ee3e61e5
- Optiming a workflow end to end automatically with
codeflash optimize
https://github.com/user-attachments/assets/355ba295-eb5a-453a-8968-7fb35c70d16c
Support
Join our community for support and discussions. If you have any questions, feel free to reach out to us using one of the following methods:
License
Codeflash is licensed under the BSL-1.1 License. See the LICENSE file for details.