Security: Fix CodeQL alerts for ReDoS, path injection, and workflow permissions

[yoavkatz]

Remediates the 17 open CodeQL code-scanning alerts reported in the IBM OSPO security notification (#1981).

CodeQL runs on this repo via GitHub's default setup, so there is no .github/workflows/codeql*.yml and the alert list is not reproducible locally. Each site below was located by matching the rule's detection pattern against the source and confirmed by execution. The counts line up exactly with the issue: 11 workflows without a permissions: block, and 5 filesystem sinks reachable from argparse.

Count	Rule	Severity	SLA deadline
1	py/redos	High	Oct 29, 2026
5	py/path-injection	High	Oct 29, 2026
11	actions/missing-workflow-permissions	Medium	Dec 28, 2026

There are no open Dependabot or secret-scanning alerts attributed to this issue, so this is the full scope.

1. ReDoS in is_camel_case() — 1× py/redos, High (CWE-1333)

src/unitxt/text_utils.py. The pattern ^[A-Z]+([a-z0-9]*[A-Z]*[a-z0-9]*)*$ has an inner group that matches the empty string with overlapping alternatives, so a non-matching input backtracks catastrophically. An 18-character input did not complete within 20 seconds.

This is reachable in practice, not theoretical — artifact.py:215 calls is_camel_case() on artifact class names.

Replaced with the equivalent linear-time form ^[A-Z]+[a-zA-Z0-9]*$. A 50,000-character adversarial input now completes in 0.6 ms.

Rather than rely on the 10 existing test cases to establish equivalence, both patterns were compared across all 538 registered Artifact subclass names plus an exhaustive fuzz over the relevant character classes — zero disagreements.

2. Path injection from CLI arguments — 5× py/path-injection, High (CWE-22)

src/unitxt/evaluate_cli.py. --output_path and --output_file_prefix are argparse values (a CodeQL taint source) that flowed unsanitized into five filesystem sinks: os.makedirs, the two result-file writes, and os.listdir/open in extract_scores. A prefix such as ../../../etc/cron.d/x escaped the intended output directory.

Two helpers were added:

• _normalize_directory() — realpath/expanduser the directory inputs. The resolved location is deliberately not confined to the CWD, since writing results to an arbitrary directory is the documented purpose of --output_path.
• _validate_filename_component() — reject a prefix containing a path separator, or equal to ./... This is the actual vulnerability: a filename prefix has no legitimate reason to contain a separator.

extract_scores() now normalizes its directory and confirms every path built from the listing stays inside it before opening.

No breaking change — legitimate absolute and relative output paths continue to work.

3. Missing workflow permissions — 11× actions/missing-workflow-permissions, Medium (CWE-275)

Added job-level permissions: contents: read to the 11 workflows that declared none, matching the existing convention in pipy.yml and stale_issues.yml.

Read-only was verified to be least privilege rather than assumed: none of the 11 uses GITHUB_TOKEN, github.token, or the gh CLI, and hub.yml/performance.yml authenticate to HuggingFace via their own repo secrets rather than the workflow token.

Note for reviewers: indentation is not uniform across these files (2/4, 3/5 and 4/6-space styles coexist), so each block was inserted at its own file's level. All 13 workflows were confirmed to parse and to carry job-level permissions.

Tests

• tests/library/test_text_utils.py — adversarial-input timing test that fails by hanging if the backtracking pattern is reintroduced.
• tests/library/test_cli.py — traversal prefixes are rejected, and .. segments in --output_path are normalized away.

The existing test_prepare_output_paths was made platform-independent: it asserted on /tmp/output verbatim, which path normalization breaks on macOS (/tmp → /private/tmp). CI is Linux so it would have passed there, but a platform-dependent test is a local-development trap.

Verification

• The new tests were confirmed to fail against the unpatched code — all 8 traversal cases fail, and the ReDoS test hangs. A regression test that cannot fail is not worth adding.
• Full tests/library suite: 778 passed, no new failures. Three failures and one collection error are pre-existing and were confirmed to fail identically on a stashed clean tree (missing optional dependencies, plus a module-level helper named test_metric that pytest misreads as a test).
• All pre-commit hooks pass.
• End-to-end: traversal prefixes rejected, normal runs write where expected, timestamped files stay confined, --help intact.

Out of scope

ExtractZipFile (src/unitxt/operators.py:2352) uses zf.extractall(), a Zip Slip risk (py/unsafe-unpacking), and DownloadOperator.target writes to an arbitrary path. Neither appears in this issue's alert list, so both are left untouched here — worth a separate issue.

Closes #1981

🤖 Generated with Claude Code