[uk-ai-resilience] Untracked go/allocation-size-overflow alerts #942/#943 in experiments_command.go (Tier C)

[github-actions]

Summary

CodeQL flags two open, untracked go/allocation-size-overflow alerts in pkg/cli/experiments_command.go, a file that was actively modified within the last 7-day lookback window. This is surfaced by the UK AI Open Code Risk & Resilience Governance recent-changes review.

Tier and risk-scoring breakdown

• Tier: C - Restricted Pending Review (untracked, recently-changed, high severity)
• Exposure amplification: Medium (CLI-local, not network-facing)
• Patchability: High (bounds check is straightforward)
• Detectability: High (CodeQL already flags it)
• Operational fragility: Low
• Ownership confidence: Low - no path-scoped CODEOWNERS entry exists for pkg/cli/ (see companion Tier B finding in [uk-ai-resilience] Missing .github/CODEOWNERS for security-sensitive compiler/CLI paths (Tier B) #61637)

Alert details

• Alert Apply TypeScript types to safe output MCP server using JavaScript comment types #942: https://github.com/github/gh-aw/security/code-scanning/942
• Alert Fix failing unit tests: resolve MCP server dependencies, config generation bugs, and JavaScript test issues #943: https://github.com/github/gh-aw/security/code-scanning/943
• Rule: go/allocation-size-overflow
• Severity: high
• Location: pkg/cli/experiments_command.go (near make([]ExperimentAnalysis, 0, len(experiments)), line ~384)

Remediation action

Validate/bound the length used for slice pre-allocation before calling make(), so an attacker- or data-driven oversized len(experiments) cannot trigger an allocation-size overflow. SLA urgency: high.

Discussion report

Full governance analysis, asset graph, and control-verification context: see the "UK AI Open Code Risk & Resilience Review — 2026-09-25 (recent-changes cycle)" discussion report created in this same run.

Generated by UK AI Operational Resilience · copilot · auto · 80.1 AIC · ⌖ 7.25 AIC · ⊞ 7.9K · ◷