Validate slide PDF downloads before writing

[Copilot]

Code scanning flagged scripts/ensure-docs-slide-pdf.js for writing network-derived data to disk without sufficient validation. The script now constrains the download source and validates response metadata and PDF bytes before writing.

• Download source hardening

  • Builds the slide deck URL from validated owner/repo and commit SHA components.
  • Restricts downloads to https://media.githubusercontent.com.
  • Rejects dot-only repository path segments.

• Response and content validation

  • Accepts only PDF-compatible content types.
  • Rejects malformed or oversized content-length values.
  • Enforces a maximum downloaded size.
  • Verifies the %PDF- signature before returning bytes for file write.

• Focused coverage

  • Adds script-level tests for unsafe URL components, invalid content types, malformed sizes, oversized downloads, and non-PDF bytes.

validateSlideDeckResponse(response);

const downloadedBytes = Buffer.from(await response.arrayBuffer());
return validatePdfBytes(downloadedBytes, `Downloaded slide deck from ${url}`);

• Fixes [uk-ai-resilience] [gov-scan] Untrusted-data file write in scripts/ensure-docs-slide-pdf.js (alert #654) #51127

[github-actions]

Summary

Excellent work on addressing the security vulnerability! This PR hardens PDF download handling in scripts/ensure-docs-slide-pdf.js by adding comprehensive validation for network-derived files before writing to disk.

What's Aligned

✅ Focused scope — The PR isolates a single security concern: validating slide PDF downloads
✅ Complete test coverage — New test file covers unsafe URLs, invalid content types, malformed sizes, oversized downloads, and non-PDF bytes
✅ Clear implementation — URL component validation (SHA, repo path), content-type guards, size limits, and PDF signature verification
✅ Security-first — Follows defense-in-depth with multiple validation layers
✅ Detailed description — Clearly explains the problem, solution approach, and specific changes
✅ Proper issue linkage — References #51127
✅ Core team workflow — Authored by copilot-swe-agent, aligned with the project's agentic development model

Ready for Review

This PR is in draft and appears ready for transition to ready-for-review when the author determines implementation is complete. The code follows the project's patterns, includes defensive documentation (LGTM comment), and integrates well with existing PDF handling logic.

Generated by ✅ Contribution Check · auto · 84.8 AIC · ⊞ 8.7K · ◷

[Copilot]

Pull request overview

Hardens slide PDF downloads before writing them to disk.

Changes:

• Validates trusted URL components, response metadata, size, and PDF signatures.
• Adds focused validation tests.

Show a summary per file

File	Description
scripts/ensure-docs-slide-pdf.js	Adds download and PDF validation.
scripts/ensure-docs-slide-pdf.test.js	Tests validation and URL hardening.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.1