fix(sandbox,gateway): shell allowlist quoted-path bypass + bind to configured host - #68
Draft
cursor[bot] wants to merge 3 commits into
Draft
fix(sandbox,gateway): shell allowlist quoted-path bypass + bind to configured host#68cursor[bot] wants to merge 3 commits into
cursor[bot] wants to merge 3 commits into
Conversation
Whitespace tokenization missed cat '/etc/passwd' and python -c
open('/etc/passwd') when workspace_only=1. Scan the full command for
absolute path fragments, strip surrounding quotes on tokens, and
fail-closed on OOM. Sandbox namespaces do not chroot, so this is the
host FS gate.
Co-authored-by: esadrianno <[email protected]>
http_start read gateway host but never set lws info.iface, so LWS defaulted to INADDR_ANY even when host was 127.0.0.1. Pass host through as iface unless allow_bind_all with 0.0.0.0/*. Co-authored-by: esadrianno <[email protected]>
The embedded-path scanner treated every '/' as an absolute path, so echo 3/4, ls src/foo, and curl https://example.com/api were blocked. Only treat '/' or '~' as a filesystem path when they start a new token, while still catching file:///etc/passwd. Co-authored-by: esadrianno <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two HIGH-severity security fixes from the critical bug hunt:
Shell allowlist quoted/embedded path bypass (
sandbox/allowlist.c)sandbox.enabled+workspace_only, whitespace tokenization never saw paths inside quotes or-cstrings (e.g.cat '/etc/passwd',python3 -c "open('/etc/passwd')"), so the command was allowed.Gateway ignored
gateway.hostfor listen bind (gateway/http.c)http_startreadhostonly to reject literal0.0.0.0withoutallow_bind_all, but never setlwsinfo.iface.iface=NULL→ INADDR_ANY, so a configuredhost = "127.0.0.1"still listened on all interfaces.info.iface = hostunless binding all (0.0.0.0/*withallow_bind_all).Test plan
tests/test_allowlist— new cases for quoted paths and python-cembedded/etc/passwdhost=127.0.0.1, confirm listen is loopback-only (ss -ltnp/ external connect fails)allow_bind_all=trueandhost=0.0.0.0, confirm all-interfaces bind still works