Skip to content

fix(kiloclaw): structure admin override clear log#3851

Merged
RSO merged 1 commit into
mainfrom
fix/codeql-438-kiloclaw-log
Jun 9, 2026
Merged

fix(kiloclaw): structure admin override clear log#3851
RSO merged 1 commit into
mainfrom
fix/codeql-438-kiloclaw-log

Conversation

@kilo-code-bot

@kilo-code-bot kilo-code-bot Bot commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Resolves CodeQL alert 438 by changing the targeted admin size override clear log from custom string encoding to structured console fields.
  • Preserves the same logged values while avoiding ad hoc escaping for the user-provided reason.

Verification

Confirmed the CodeQL alert target no longer performs custom string escaping for the admin size override clear reason. No runtime smoke test was run because this is a logging-only change in a Durable Object admin RPC path.

Visual Changes

N/A

Reviewer Notes

CodeQL alert: https://github.com/Kilo-Org/cloud/security/code-scanning/438

@kilo-code-bot
kilo-code-bot Bot requested a review from RSO June 9, 2026 09:36
@kilo-code-bot

kilo-code-bot Bot commented Jun 9, 2026

Copy link
Copy Markdown
Contributor Author

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The no-op path (line 3528–3531) for the same clearAdminSizeOverride method still uses the old JSON.stringify(input.reason) string-template pattern that this PR was intended to fix.

Overview

Severity Count
CRITICAL 0
WARNING 1
SUGGESTION 0
Issue Details (click to expand)

WARNING

File Line Issue
services/kiloclaw/src/durable-objects/kiloclaw-instance/index.ts 3528–3531 No-op path still uses JSON.stringify(input.reason) in a string template — same pattern the PR fixes on the non-no-op path
Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File Line Issue
services/kiloclaw/src/durable-objects/kiloclaw-instance/index.ts 3528–3531 The no-op branch at line 3528 still embeds input.reason via JSON.stringify() string interpolation: `reason=${JSON.stringify(input.reason)}`. This is the same pattern the PR is remediating on the non-no-op path. Consider updating this to structured logging as well: console.log('[admin-size-override] clear (no-op)', { userId: this.s.userId, actor: input.actorEmail, reason: input.reason })
Files Reviewed (1 file)
  • services/kiloclaw/src/durable-objects/kiloclaw-instance/index.ts - 1 issue (outside diff)

Fix these issues in Kilo Cloud


Reviewed by claude-sonnet-4.6 · 389,643 tokens

Review guidance: REVIEW.md from base branch main

@RSO
RSO merged commit fc27d43 into main Jun 9, 2026
16 checks passed
@RSO
RSO deleted the fix/codeql-438-kiloclaw-log branch June 9, 2026 12:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants