Skip to content

KC-1468,1473,1474: Protect SailPoint config record from Service Mode and fix ${VARNAME} expansion bypass - #2389

Merged
amangalampalli-ks merged 6 commits into
fix/sailpoint-hardening-and-var-expansionfrom
fix/sailpoint-hardening-and-var-expansion-int
Sep 23, 2026
Merged

KC-1468,1473,1474: Protect SailPoint config record from Service Mode and fix ${VARNAME} expansion bypass#2389
amangalampalli-ks merged 6 commits into
fix/sailpoint-hardening-and-var-expansionfrom
fix/sailpoint-hardening-and-var-expansion-int

Conversation

@amangalampalli-ks

@amangalampalli-ks amangalampalli-ks commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

Summary

Protects SailPoint's config record and folder from Service Mode API access, and closes a bug allowing Service Mode's file/record restrictions to be bypassed via ${VARNAME} expansion.

Changes

  • SailPoint's config record and its folder are now unreachable through any Service Mode command, matching every other integration
  • SailPoint's own gate (marker/capability checks, entitlement queuing) keeps working exactly as before
  • ${VARNAME} environment-variable syntax is now rejected outright in Service Mode commands, closing a bypass where it could expand into a restricted file path or protected record reference after the security check already passed
  • Added debug logging so a silently-skipped SailPoint gate (missing marker field) is now diagnosable per-request, not just at container startup

@amangalampalli-ks amangalampalli-ks self-assigned this Sep 22, 2026
@amangalampalli-ks
amangalampalli-ks marked this pull request as ready for review September 22, 2026 14:04
@amangalampalli-ks amangalampalli-ks changed the title Protect SailPoint config record from Service Mode and fix ${VARNAME} expansion bypass KC-1473,1474: Protect SailPoint config record from Service Mode and fix ${VARNAME} expansion bypass Sep 22, 2026
@amangalampalli-ks amangalampalli-ks changed the title KC-1473,1474: Protect SailPoint config record from Service Mode and fix ${VARNAME} expansion bypass KC-1468,1473,1474: Protect SailPoint config record from Service Mode and fix ${VARNAME} expansion bypass Sep 22, 2026
@amangalampalli-ks
amangalampalli-ks merged commit 6aba242 into fix/sailpoint-hardening-and-var-expansion Sep 23, 2026
4 checks passed
craiglurey pushed a commit that referenced this pull request Sep 24, 2026
@amangalampalli-ks
KC-1468,1473,1474: Protect SailPoint config record from Service Mode …
bdcf52a 
…and fix ${VARNAME} expansion bypass (#2389) (#2392)

* Protect SailPoint config record from Service Mode and fix ${VARNAME} expansion bypass

* Fix entitlements not working

* Fix copilot review comments

* Fix claude's review comments

* Use Map instead of dict

* Fix review comment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@adeshmukh-ks adeshmukh-ks adeshmukh-ks approved these changes
@pvagare-ks pvagare-ks pvagare-ks approved these changes
@sali-ks sali-ks Awaiting requested review from sali-ks

Assignees

@amangalampalli-ks amangalampalli-ks

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@amangalampalli-ks @adeshmukh-ks @pvagare-ks