fix: improve CLI argument validation for sensitive parameters

[mrT23]

PR Type

Bug fix

---

Description

• Improved CLI argument validation to prevent security issues
  • Only checks arguments starting with '--'
  • Handles dot-prefixed parameter names correctly
  • Reduces false positive detections

---

Changes walkthrough 📝

	Relevant files
Security	pr_agent.py Enhanced CLI argument validation for sensitive parameters pr_agent/agent/pr_agent.py Improved validation of forbidden CLI arguments by checking only arguments starting with '--' Added handling for dot-prefixed parameter names in validation Fixed potential false positives in forbidden parameter detection +11/-7

---

💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

[qodo-merge-pro-for-open-source]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🏅 Score: 85

🧪 No relevant tests

🔒 Security concerns Parameter validation bypass: While the PR improves argument validation, an attacker could potentially bypass the check by using mixed case (e.g. '--bAsE_uRl') since the comparison is done after converting both strings to lowercase. Consider normalizing the input argument names before comparison.

⚡ Recommended focus areas for review Edge Case The dot prefix handling may miss forbidden arguments that legitimately contain dots in their names. Consider validating that the dot is actually a separator. if '.' not in forbidden_arg_word: forbidden_arg_word = '.' + forbidden_arg_word

[qodo-merge-pro-for-open-source]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Score
Security	Enhance security by validating all possible CLI argument formats to prevent parameter injection The current implementation may miss forbidden arguments that don't use '--' prefix but use '-' or other formats. Consider validating all CLI arguments regardless of their prefix. pr_agent/agent/pr_agent.py [68-70] -if arg.startswith('--'): +# Check for both single and double dash prefixes +if arg.startswith('-'): + arg_without_prefix = arg.lstrip('-') for forbidden_arg in forbidden_cli_args: forbidden_arg_word = forbidden_arg.lower() Apply this suggestion Suggestion importance[1-10]: 8 Why: This is a critical security enhancement that would prevent potential parameter injection attacks through single-dash arguments (-) that are currently not being validated. The suggestion correctly identifies a security vulnerability in the current implementation.	8
Possible issue	Improve argument validation accuracy by properly handling both dotted and non-dotted parameter formats The dot prefix addition logic could cause false negatives when checking forbidden arguments that naturally contain dots. Remove the automatic dot addition and maintain the original comparison. pr_agent/agent/pr_agent.py [71-73] -if '.' not in forbidden_arg_word: - forbidden_arg_word = '.' + forbidden_arg_word -if forbidden_arg_word in arg.lower(): +if forbidden_arg_word in arg.lower() or ('.' + forbidden_arg_word) in arg.lower(): Apply this suggestion Suggestion importance[1-10]: 7 Why: The suggestion addresses a potential bug where the current dot-prefix logic could miss forbidden arguments that naturally contain dots. The proposed solution is more robust and maintains better validation coverage.	7

• Author self-review: I have reviewed the PR code suggestions, and addressed the relevant ones.