fix(security): close approval-gate spoofing + path traversal (#54) — v1.7.1#55
Merged
Merged
Conversation
HIGH findings from the pre-release audit on the approval-gate work: 1. Manager identity spoofing — dashboard accepted any resolvedBy from the request body. Now: approvals require a signed RSTACK_APPROVAL_TOKEN + same-origin request, enforce application/json, cap body size, demand an explicit approver, and record audit-proof actor evidence. No token set = browser approvals disabled (secure default); sdlc_approve still enforces the manager allow-list. 2. Approval-id path traversal — a crafted gate id could encode a runId with .. and drive a write outside .rstack/runs. Now: isSafeRunId + artifact validation in parseApprovalQueueId, and safeRunApprovalsPath asserts the resolved path stays under .rstack/runs/<run> with a real manifest before any write. 5 security regression tests + 7 live transport-auth checks verify both. Closes #54 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #54. Blocks publish until merged — both findings are pre-release HIGH.
HIGH 1 — manager identity spoofing (fixed)
The dashboard accepted
resolvedByfrom the request body unauthenticated.RSTACK_APPROVAL_TOKENheader + same-origin requestContent-Type: application/json, cap body at 64KB, require an explicit approversdlc_approvestill enforces thepolicy.json/RSTACK_MANAGER_USERSallow-listHIGH 2 — approval-id path traversal (fixed)
A crafted gate id (
gate:<runId>:<task>:<artifact>) could encode arunIdwith..and drive anapprovals.jsonwrite outside.rstack/runs.isSafeRunId+ artifact validation reject traversal inparseApprovalQueueIdsafeRunApprovalsPathresolves the path and asserts containment under.rstack/runs/<run>, and requires a realmanifest.json, before any writeVerification
🤖 Generated with Claude Code