From 045126c9afe0eb489cc832822edd0cb5a321deea Mon Sep 17 00:00:00 2001
From: Gavin K <at0m1czzz69@gmail.com>
Date: Thu, 11 Jun 2026 03:21:24 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20security=20hardening=20=E2=80=94=20GHA?=
 =?UTF-8?q?=20injection,=20wrong=20constant,=20invalid=20JSON?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- .github/workflows/release.yml: Fix script injection by moving
  user-controlled inputs (module_path, tag_suffix) to env vars instead
  of direct ${{ }} interpolation in shell blocks. Pin
  softprops/action-gh-release to SHA (v2.6.2). Add explicit
  permissions: contents: read to the detect job.

- collection/ai_surface/ai_surface.c: Replace INVALID_FILE_ATTRIBUTES
  with the correct (DWORD)0xFFFFFFFF for GetFileSize error check.
  Both happen to be 0xFFFFFFFF but the former is semantically wrong.

- discovery/wallpaper_enum/metadata.json: Remove trailing comma that
  made the file invalid JSON.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .github/workflows/release.yml          | 14 ++++++++++----
 collection/ai_surface/ai_surface.c     |  2 +-
 discovery/wallpaper_enum/metadata.json |  2 +-
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5ee42a..c97243f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,6 +21,8 @@ on:
 jobs:
   detect:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       matrix: ${{ steps.build_matrix.outputs.matrix }}
       has_changes: ${{ steps.build_matrix.outputs.has_changes }}
@@ -33,11 +35,13 @@ jobs:
       - name: Build module matrix
         id: build_matrix
         shell: bash
+        env:
+          INPUT_MODULE_PATH: ${{ github.event.inputs.module_path }}
         run: |
           set -euo pipefail
 
           if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            MODULE_PATH="${{ github.event.inputs.module_path }}"
+            MODULE_PATH="${INPUT_MODULE_PATH}"
             
             if [[ ! -d "${MODULE_PATH}" ]]; then
               echo "Error: Module path '${MODULE_PATH}' does not exist" >&2
@@ -234,6 +238,8 @@ jobs:
       - name: Create release tag
         id: tag
         shell: bash
+        env:
+          INPUT_TAG_SUFFIX: ${{ github.event.inputs.tag_suffix }}
         run: |
           set -euo pipefail
 
@@ -249,8 +255,8 @@ jobs:
           TS="$(date -u +"%Y-%m-%d-%H%M%S")"
           SHORT="${HEAD_SHA:0:7}"
           
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${{ github.event.inputs.tag_suffix }}" ]]; then
-            TAG="${SANITIZED_DIR}-${{ github.event.inputs.tag_suffix }}"
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${INPUT_TAG_SUFFIX}" ]]; then
+            TAG="${SANITIZED_DIR}-${INPUT_TAG_SUFFIX}"
           else
             TAG="${SANITIZED_DIR}-${TS}-${SHORT}"
           fi
@@ -259,7 +265,7 @@ jobs:
           echo "Created tag: ${TAG}"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ steps.tag.outputs.tag }}
           name: Release ${{ steps.tag.outputs.tag }}
diff --git a/collection/ai_surface/ai_surface.c b/collection/ai_surface/ai_surface.c
index ff35b64..131168b 100644
--- a/collection/ai_surface/ai_surface.c
+++ b/collection/ai_surface/ai_surface.c
@@ -404,7 +404,7 @@ static int read_file_text_bounded(LPCWSTR path, DWORD max_bytes, char **out_buf,
     }
 
     fileSize = KERNEL32$GetFileSize(hFile, NULL);
-    if (fileSize == INVALID_FILE_ATTRIBUTES) {
+    if (fileSize == (DWORD)0xFFFFFFFF) {
         KERNEL32$CloseHandle(hFile);
         return 0;
     }
diff --git a/discovery/wallpaper_enum/metadata.json b/discovery/wallpaper_enum/metadata.json
index a44e4fa..4e928e7 100644
--- a/discovery/wallpaper_enum/metadata.json
+++ b/discovery/wallpaper_enum/metadata.json
@@ -1,5 +1,5 @@
 {
   "projectName": "wallpaper_enum",
   "category": "recon",
-  "summary": "Enumerates per-monitor desktop wallpaper paths via the IDesktopWallpaper COM API to reveal centrally hosted images or network shares.",
+  "summary": "Enumerates per-monitor desktop wallpaper paths via the IDesktopWallpaper COM API to reveal centrally hosted images or network shares."
 }