Development record
GHSA-9wv7-88w3-f77m: filename-keyed scan skips let a hostile release payload ship a secret in an unscanned binary file. skipByName/skipByFragment in the launch payload scanner skip files before reading them, Skipped entries count as an accepted allow, and the zero-coverage sentinel stays quiet while anything else scans, so a secret placed in notes.png (no valid image data needed) is Included in the payload and passes every gate with zero findings. CWE-693.
issueresolvedmajoriss-2608291807454357
GHSA-9wv7-88w3-f77m: filename-keyed scan skips let a hostile release payload ship a secret in an unscanned binary file. skipByName/skipByFragment in the launch payload scanner skip files before reading them, Skipped entries count as an accepted allow, and the zero-coverage sentinel stays quiet while anything else scans, so a secret placed in notes.png (no valid image data needed) is Included in the payload and passes every gate with zero findings. CWE-693.
Frontmatter
| id | iss-2608291807454357 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | major |
.abcd/work/issues/resolved/iss-2608291807454357-filename-keyed-scan-skips-ship-secrets.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609012035115696GHSA-5mmm-3whv-3rqp (CWE-693): launch copied skip-listed payload files (.svg among them) into the bundle unscanned, so a secret in a skip-listed file passed every gate. Fixed before this run by 30f62e82 (.svg removed from the default skip set and wouldRefuseOn failing closed on Unscanned; v0.6.7), deepened by 1f71e608 (every skip-listed file byte-scanned; v0.6.9) and 95b98abc (explicit byte-rule table); the class record is resolved/iss-2608291807454357 (GHSA-9wv7-88w3-f77m, the same skip-by-name mechanism), whose fixing commit names this advisory as precedent. This record binds the advisory id to its fixing commits so an advisory-keyed search hits. Evidence at v0.7.0: internal/core/launch/dryrun.go scanRefusals and internal/adapter/scanner/scanner.go ScanBundle; tests TestSvgPayloadSecretRefuses, TestUnscannedPayloadRefuses, TestUnscannedRefusalCarriesWhy and TestBinaryPayloadSecretRefuses in scan_coverage_test.go.