fix mermaid diagram placement

[dcbuild3r]

Summary

• Move the landing README workflow diagrams to the end, immediately before release notes.

[semgrep-code-worldcoin]

Semgrep found 1 run-shell-injection finding:

• .github/workflows/mobile-bench-profile-selftest.yml
  • L69-78 - Triage

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

Semgrep found 19 tainted-path findings:

• crates/mobench/src/summarize.rs
  • L226 - Triage
  • L303 - Triage
• crates/mobench/src/profile.rs
  • L778 - Triage
  • L959 - Triage
  • L990 - Triage
  • L992 - Triage
  • L994 - Triage
  • L996 - Triage
  • L1899 - Triage
  • L1913 - Triage
  • L1948 - Triage
  • L2563 - Triage
  • 4 more - Triage
• crates/mobench/src/plots.rs
  • L1012 - Triage
  • L1033 - Triage
• crates/mobench/src/lib.rs
  • L2574 - Triage

The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>crates/mobench/src/summarize.rs</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/worldcoin/mobile-bench-rs/blob/f1cd767cac0c0c064b91c301992a655e3cbbcaaa/crates/mobench/src/summarize.rs#L303 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 303] dir</a>"]
        end
        %% Intermediate

        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/worldcoin/mobile-bench-rs/blob/f1cd767cac0c0c064b91c301992a655e3cbbcaaa/crates/mobench/src/summarize.rs#L303 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 303] dir</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    File0:::invis

    %% Connections

    Source --> Sink

Loading

Semgrep found 9 rust-actix-command-injection findings:

• crates/mobench/src/profile.rs
  • L2269 - Triage
  • L2589 - Triage
  • L2615 - Triage
  • L2662 - Triage
  • L2872 - Triage
  • L2889 - Triage
  • L2910 - Triage
  • L2943 - Triage
  • L3998 - Triage

Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>crates/mobench/src/profile.rs</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/worldcoin/mobile-bench-rs/blob/f1cd767cac0c0c064b91c301992a655e3cbbcaaa/crates/mobench/src/profile.rs#L3998 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 3998] adb_path</a>"]
        end
        %% Intermediate

        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/worldcoin/mobile-bench-rs/blob/f1cd767cac0c0c064b91c301992a655e3cbbcaaa/crates/mobench/src/profile.rs#L3998 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 3998] adb_path</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    File0:::invis

    %% Connections

    Source --> Sink

Loading

[chatgpt-codex-connector]

💡 Codex Review

mobile-bench-rs/.github/workflows/reusable-bench.yml

Line 1068 in f1cd767

GH_SHA: ${{ github.event.pull_request.head.sha || github.sha }}

Target check runs to the benchmarked commit SHA

Set GH_SHA from inputs.head_sha (with a fallback) instead of github.sha. This reusable workflow is invoked via workflow_dispatch on the default branch while benchmarking a PR commit passed through head_sha; in that path github.event.pull_request is empty and github.sha points to the default-branch workflow revision, so check runs get created on the wrong commit and won’t appear on the PR head being evaluated.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[semgrep-code-worldcoin]

Semgrep identified an issue in your code:

Untrusted path is used in fs::read_dir, allowing path traversal to list arbitrary directories and read each subdir’s failure.json.

More details about this

The function load_browserstack_failure_reports uses the caller‑supplied path output_root directly in fs::read_dir(output_root), then builds failure_path with entry.path().join("failure.json") and reads it with fs::read_to_string. If output_root can be influenced by a request (e.g., an Actix handler parameter or query/path value), an attacker can point output_root at any directory on the server. The code will then list that directory and read any subdirectory’s failure.json, returning its contents via the function’s result.

Concrete exploit path:

• Attacker sends a request that sets output_root to an arbitrary path (e.g., /, /var, or ../../../../var/app/data). This value becomes the function’s output_root.
• fs::read_dir(output_root) enumerates that directory. For each child directory, the code computes failure_path = entry.path().join("failure.json").
• fs::read_to_string(&failure_path) reads those files’ contents, and the function aggregates them into failures_by_device.
• If the HTTP layer returns or logs this map, the attacker gains the data from any failure.json files under the targeted directory tree.

Example:

• GET /reports?root=../../../../var/app/artifacts
• output_root resolves to a server path that the process can read. The code lists it and reads each /failure.json, leaking internal test artifacts or other sensitive JSON files named failure.json.

What’s risky here:

• output_root is used without normalization or restriction to a trusted base directory, enabling path traversal and arbitrary directory reads within the app’s read permissions.
• The join on entry.path() means any readable subdir under output_root is in scope, and all their failure.json contents are processed and potentially exposed.

Dataflow graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>crates/mobench/src/lib.rs</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/worldcoin/mobile-bench-rs/blob/581ba614a98a624fa6bf0d27577d768b3b67de17/crates/mobench/src/lib.rs#L2861 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 2861] output_root</a>"]
        end
        %% Intermediate

        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/worldcoin/mobile-bench-rs/blob/581ba614a98a624fa6bf0d27577d768b3b67de17/crates/mobench/src/lib.rs#L2861 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 2861] output_root</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    File0:::invis

    %% Connections

    Source --> Sink

Loading

To resolve this comment:

✨ Commit fix suggestion

1. Validate and sanitize the value of output_root before passing it to fs::read_dir. Ensure it cannot be manipulated to point outside of the intended directory (for example, that it does not contain .. or absolute paths).
2. If output_root is derived from user input, reject any value containing path traversal patterns like .., ~, or starting with / or \. For example, before using it:
   • Convert the path to an absolute path with std::fs::canonicalize(output_root)?, and check that it starts with your allowed base directory.
3. Prefer constructing file system paths using trusted configuration/constants rather than user input whenever possible.
4. If you must accept user input for part of the path, restrict allowed values (e.g., only allow alphanumeric directory names).
5. Optionally, log any rejected or sanitized path to help debug attempts at path traversal.

This will ensure attackers cannot use crafted input to access or list files outside of the intended directory.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by tainted-path.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-worldcoin]

Semgrep identified an issue in your code:

Untrusted path is passed to fs::read_to_string in load_toml_config_value, enabling path traversal to read arbitrary files from the server.

More details about this

The code reads a file path from the path parameter without any validation or restriction.

What’s in the code

• load_toml_config_value(path) calls fs::read_to_string(path) and logs the chosen path via path.display(). There’s no normalization or restriction to a safe base directory.

How this can be exploited

• If path is influenced by request data (e.g., a query/path/header captured upstream as explicit_config_path or config_path and then passed to load_toml_config_value), an attacker can traverse directories or target absolute paths.
• Example request: GET /config?path=../../../../etc/passwd
  1. The handler parses the query value into a PathBuf (e.g., explicit_config_path or config_path).
  2. That PathBuf is forwarded to load_toml_config_value(path).
  3. fs::read_to_string(path) reads the attacker-chosen file (e.g., /etc/passwd), returning its contents to the code that invoked it. The format!("reading config {}", path.display()) also confirms which file was accessed and may leak this in logs or error messages.
• Another example: GET /config?path=/proc/self/environ to read environment variables or secrets.

Impact

• Arbitrary file read from the server filesystem using .. or absolute paths, exposing configuration, credentials, keys, or source code, all via the unvalidated path used in fs::read_to_string(path).

Dataflow graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>crates/mobench/src/lib.rs</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/worldcoin/mobile-bench-rs/blob/581ba614a98a624fa6bf0d27577d768b3b67de17/crates/mobench/src/lib.rs#L1368 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1368] path</a>"]
        end
        %% Intermediate

        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/worldcoin/mobile-bench-rs/blob/581ba614a98a624fa6bf0d27577d768b3b67de17/crates/mobench/src/lib.rs#L1368 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1368] path</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    File0:::invis

    %% Connections

    Source --> Sink

Loading

To resolve this comment:

✨ Commit fix suggestion

1. Sanitize or validate the path before calling fs::read_to_string(path). Only allow reading files from intended directories (such as a config directory), and reject any user input with characters like .., absolute paths, or path separators that could lead outside the allowed directory.
2. Create a helper function such as fn validate_config_path(base: &Path, user_path: &Path) -> Result<PathBuf> that checks if the resulting PathBuf is still within base using methods like canonicalize() and starts_with(). Example:
   let canonical = path.canonicalize()?; if !canonical.starts_with(base_dir) { bail!("Invalid config path"); }
3. Call this validation function before the fs::read_to_string(path) call in load_toml_config_value. Only proceed with reading the file if the path is valid; otherwise, return an error.
4. Alternatively, if path must come from a fixed set of allowed filenames, compare against a whitelist and reject any others.

Validating file paths prevents attackers from accessing unexpected files and mitigates path traversal vulnerabilities.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by tainted-path.

_{You can view more details about this finding in the Semgrep AppSec Platform.}