Repository navigation
fix(security): cerrar lo importante del tab Security — CWE-78/22/1321, ReDoS y permisos de workflows - #725
Merged
beyondnetPeru merged 3 commits intoSep 19, 2026
Conversation
…, ReDoS y permisos de workflows CodeQL (main, 75 resultados) y Scorecard, triados a mano con el SARIF: se arregla lo que un llamador autenticado podía explotar y se descarta lo que no lo es. CWE-78 · inyección de shell (11 alertas) - `NxWorkspaceStrategy` interpolaba `apiName`, `hostName`, `remotes` y `domains` (entrada del tool MCP `evolith-scaffold`, sin validar) en una línea de shell. Ahora construye argv y lo ejecuta sin shell (`executeFileOrThrow`), y además exige que cada nombre sea un identificador plano: `--directory=apps/../..` y `--name=--flag` se rechazan antes de spawnear nada. - `ICommandExecutor` gana `executeFile`/`executeFileOrThrow`; el ejecutor del CLI ya lo tenía y el del MCP lo implementa con `execFile`. Se elimina el bloque duplicado de la interfaz (TS los fusionaba en silencio). - `git-log-reader` pasa `--since`/`--max-count` como argv. CWE-22 · path injection en core-api (9 alertas en el adaptador de fs) - `POST /evaluate` legacy leía `body.satellitePath`/`body.corePath` tal cual (el DTO decía "path traversal validation required" y nadie la hacía): el resolver los contiene bajo WORKSPACE_ROOT / CORE_PATH, y una instancia sin resolver falla cerrada. - `POST /architecture/validate-satellite`: el manifest manda en el caso de uso y traía sus propias rutas; se fijan a las resueltas. - `POST /projects/initialize`: `name` es un segmento de directorio, no una ruta (DTO + caso de uso, que también sirve al CLI). CWE-1321 · prototype pollution: `evolith-config-set` rechaza `__proto__`, `constructor` y `prototype` como segmentos y solo desciende por propiedades propias. ReDoS (8) · `/\/+$/` tardaba 15 s en 200k barras; se sustituye por el trim char a char que `codeowners.ts` ya usaba. `parseRepoUrl` queda anclado al host. El check de URL de `satellite adopt` se ancla al inicio. Scorecard Token-Permissions (7 workflows): `contents: read` arriba y la escritura declarada en el job que la hace (packages en docker, contents en docs-release y upload-assets, pull-requests:read para el guard 50). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Contributor
📊 Bilingual Coverage ImpactPR Changes
Repository Coverage
✅ Good: All EN changes have ES counterparts. Generated by GitHub Actions |
…ad aged out again `09-reconcile-maturity.mjs` accepts evidence 0..30 days old; the 2026-08-18 entries hit 32 on 2026-09-19 and turned `Validate documentation` (a REQUIRED check) red on every pull request opened today (#722-#725) and on the main push 99b5325 — none of which touched what the evidence describes. Same failure mode as 3e5aac8, one month later. Fresh observations of the same four claims, not date bumps: - cli-baseline: run 35435871033 on cb2c8a1 (this PR), all THIRTEEN CLI CI jobs green. - coverage: same run — 107 suites / 1492 tests, Branches 75.69% (2382/3147) against the unchanged 75% threshold. - documentation: the latest green Documentation Validation is 34998373244 on the develop head 4d65574 (2026-09-15); every run today is red for exactly this staleness. - release: run 35435871089 on cb2c8a1 — binaries packaged and smoke-tested on the three platforms; publish/upload skipped by design on a pull request. The commits are ones a pull-request checkout can resolve (`git cat-file`): main's head 99b5325 is NOT reachable from develop yet, so citing it would have failed the guard with "references an unavailable commit". `asOf` stays 2026-09-05 with the board, so the reconciliation is regenerated but nothing downstream of the board date moves. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Conflict on the two maturity evidence files: another session refreshed the same four aged-out checks in 2ee3f9a (via #724) minutes before 93a90f9 did. develop's refresh wins outright — one observation per aging, not two — so this branch now carries no evidence change of its own; 09-reconcile-maturity --check and guard 46 pass on the result. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
beyondnetPeru
deleted the
security/codeql-scorecard-triage-2026-09-19
branch
September 19, 2026 10:27
This was referenced Sep 19, 2026
beyondnetPeru
added a commit
that referenced
this pull request
Sep 19, 2026
…-guards fix(security): escribir las tres guardas de #725 en la forma que CodeQL modela
This was referenced Sep 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Qué cierra
Triaje del tab Security (95 alertas abiertas: 75 CodeQL + 20 Scorecard) con el SARIF de la última corrida en
main, no con el listado del tab. Se arregla lo que un llamador autenticado podía explotar; el resto se descarta con motivo en el propio tab.Arreglado (código)
js/shell-command-constructed-from-input×11NxWorkspaceStrategy,git-log-readerexecuteFileOrThrow, nuevo en el puertoICommandExecutor) + allowlist de identificadores paraapiName/hostName/remotes/domainsdel tool MCPevolith-scaffoldjs/path-injection×9node-filesystem.provider← controladores de core-apiPOST /evaluatelegacy contienesatellitePath/corePathbajoWORKSPACE_ROOT/CORE_PATH(antes llegaban al fs tal cual);validate-satellitefija las rutas del manifest a las resueltas;projects/initializevalidanamecomo segmento de directoriojs/prototype-pollution-utilityevolith-config-set__proto__/constructor/prototype, solo desciende por propiedades propiasjs/polynomial-redos×8/\/+$/,=+$, tokenizer,parseRepoUrlparseRepoUrlanclado al hostjs/regex/missing-regexp-anchorsatellite adoptcontents: readarriba, escritura declarada por job (packagesen docker,contentsen docs-release/upload-assets,pull-requests: readpara el guard 50)Descartado (con motivo en el tab, tras este PR)
insufficient-password-hash×9: sha256 es la normalización de longitud previa atimingSafeEqual, no almacenamiento de contraseñas.user-controlled-bypass×3: cadena de auth con comparación constante; la condición "controlada por el usuario" es qué credencial presentó.clear-text-logging: el flujo taintaoptionsentero por tenerapiKey; lo que se loguea escorrelationId.http-to-file-access×4,file-system-race×3,insecure-temporary-file×3: por diseño (registro de satélites, caché por mtime, rutas elegidas por el usuario / tests).path-injection×7 en unintegration.spec,unused-local-variable×13,unneeded-defensive-code×2: tests / no seguridad..wasmcompilados del Rego contiguo, paridad enopa-parity.yml), Pinned-Dependencies ×2 (npm install -gde nuestro propio paquete a versión exacta), Fuzzing, CII, Code-Review: no son código.Verificación
tsc -blimpio en los 11 proyectos.api; rm -rf /), core-api 71 (+4 nuevos de contención), agent-runtime 85, infra-providers 21, CLI 133.max-lines/max-params/complexity) que endevelop, ninguno nuevo.Las alertas de CodeQL se cierran cuando la corrida sobre
maindeje de verlas: hace falta la promoción develop→main después de este merge.🤖 Generated with Claude Code