Skip to content

fix(sdk): reject control characters in remote targets #784

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Hughhhhcoder wants to merge 1 commit into
base: main
Choose a base branch
from
+33 −3
Open

fix(sdk): reject control characters in remote targets #784

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion sdk/typescript/src/contract.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ import {
requirePrivateOutputDirectory,
requireSecureOutputAncestry,
} from "./runtime.js";
import { MODEL_UNSAFE_STRING } from "./string-safety.js";
import type { NormalizedTarget, ScanMode } from "./targets.js";
import { isWindowsUnsafePathComponent } from "./windows-path.js";

Expand Down Expand Up @@ -428,7 +429,11 @@ function validateCanonicalContract(
const authority = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/([^/?#]+)/.exec(
remote,
)?.[1];
if (remote.includes("\\") || authority === undefined) {
if (
MODEL_UNSAFE_STRING.test(remote) ||
remote.includes("\\") ||
authority === undefined
) {
throw new ContractValidationError(
"scan.target.remote: expected a sanitized canonical absolute URL.",
);
Expand Down
4 changes: 2 additions & 2 deletions sdk/typescript/src/runtime.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ import {
isWindowsUnsafePathComponent,
windowsUnsafePathComponent,
} from "./windows-path.js";
import { MODEL_UNSAFE_STRING } from "./string-safety.js";

const execFile = promisify(execFileCallback);

Expand All @@ -73,7 +74,6 @@ const MAX_ZIP_ENTRIES = 4_096;
const MAX_ZIP_CENTRAL_DIRECTORY = 16 * 1024 * 1024;
const MAX_ZIP_ENTRY_SIZE = 128 * 1024 * 1024;
const MAX_ZIP_EXPANDED_SIZE = 512 * 1024 * 1024;
const MODEL_UNSAFE_PATH = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/u;
const CREDENTIAL_LOCK_NAME = ".codex-security-scan.lock";
const CREDENTIAL_LOCK_DATABASE = ".codex-security-scan.sqlite3";
const CREDENTIAL_LOGOUT_MARKER = ".codex-security-logged-out";
Expand Down Expand Up @@ -1828,7 +1828,7 @@ export async function planOutputArchive(
}

export function requireModelSafeOutputDir(path: string): void {
if (MODEL_UNSAFE_PATH.test(path)) {
if (MODEL_UNSAFE_STRING.test(path)) {
throw new OutputDirectoryError(
"Scan output directory must not contain control or line-separator characters.",
);
Expand Down
1 change: 1 addition & 0 deletions sdk/typescript/src/string-safety.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
export const MODEL_UNSAFE_STRING = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/u;
24 changes: 24 additions & 0 deletions sdk/typescript/tests-ts/contract.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -988,6 +988,30 @@ describe("canonical scan contract", () => {
},
"scan.target.remote",
],
[
"tab in remote",
(manifest) => {
manifest["scan"]["target"]["remote"] =
"https://example.com\thttps://evil.example.net";
},
"scan.target.remote",
],
[
"line feed in remote",
(manifest) => {
manifest["scan"]["target"]["remote"] =
"https://example.com\nhttps://evil.example.net";
},
"scan.target.remote",
],
[
"carriage return in remote",
(manifest) => {
manifest["scan"]["target"]["remote"] =
"https://example.com\rhttps://evil.example.net";
},
"scan.target.remote",
],
];

for (const [_name, mutate, expected] of cases) {
Expand Down