Repository navigation
fix(security): allow the bare wget token the shell pass compares - #2648
Merged
Merged
Conversation
The v0.12.0 release smoke blocked every binary in its string audit: "BLOCKED: Dangerous commands found in binary: wget". The line is the bare string "wget" that src/pipeline/pass_shell.c compares a script's program name with, and records as the `via` of a curl / wget HTTP_CALLS edge (3b93db0). The binary never runs it. Allow that whole line only, like the rst grammar's bare "telnet". A line that carries a wget command (flags, a target, a URL) stays blocked; the contract test now pins both cases. Proof on the release run's own artifacts (run 38644765106, main 8df0639): linux-amd64-portable and darwin-arm64 binaries BLOCKED before, all three audits OK after. test_security_strings_allowlist.sh: 49 passed; with the allowlist line reverted, the new bare-token case fails. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The v0.12.0 release run (38644765106, main 8df0639) failed every smoke job that reached the binary string audit:
The flagged line is the bare string
"wget"insrc/pipeline/pass_shell.c(3b93db0, #2644): the shell pass compares a script's program name with it and records it as theviaof a curl / wgetHTTP_CALLSedge. The binary never runs it. Smoke was green on 0ca6e7d, before that commit.Fix
scripts/security-strings.shallows that whole line only (^wget$), the same shape as the existing^telnet$entry for the rst grammar's URI scheme table. A line that carries a wget command (flags, a target, a URL) is still blocked.tests/test_security_strings_allowlist.shpins both sides: the bare token passes,wget -O /tmp/payloadstays blocked.Proof
BLOCKED ... wgetwith main's script; with this change all three audits OK (URLs, dangerous commands, credentials).wgetand awget -O /tmp/payloadline: the command line is still BLOCKED.tests/test_security_strings_allowlist.sh: 49 passed. With the allowlist line reverted, the new bare-token case fails (48 passed, 1 failed).No C source changes: the release binaries are byte-identical to 8df0639.