Development record
record_schema's store walk reads every record with os.ReadDir and os.ReadFile, with no symlink refusal and no size cap, while the sibling reading walk in readingoutstanding.go reads the same trees through fsutil.ReadGuarded — so a symlinked or oversized record is followed by the gate and declined by the report, and a symlink's target frontmatter can surface in lint output. Pre-existing across all four original stores; noted during the itd-189 security review and left out of that branch's scope. Read the store walk through the same guarded read the report uses.
issueresolvedminoriss-2608301203521317
record_schema's store walk reads every record with os.ReadDir and os.ReadFile, with no symlink refusal and no size cap, while the sibling reading walk in readingoutstanding.go reads the same trees through fsutil.ReadGuarded — so a symlinked or oversized record is followed by the gate and declined by the report, and a symlink's target frontmatter can surface in lint output. Pre-existing across all four original stores; noted during the itd-189 security review and left out of that branch's scope. Read the store walk through the same guarded read the report uses.
Grounds
- pursued: the gate and the reading report decline the same records; a symlinked record whose target frontmatter appears in record-lint output would show it wrong
Frontmatter
| id | iss-2608301203521317 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2608301203521317-record-schema-s-store-walk-reads-every.md
open on GitHub ↗ · commit history ↗
mentions5
- iss-2608301308367566record_stores values are not containment-checked so a committed config walks the record gate outside the repository
- iss-2608301308368922one committed symlink at the admissions root stands down the widening leg for every run while record_schema stays silent
- iss-2609012037125129Sibling of GHSA-fh9j-8xmg-m33f (CWE-59, CWE-400), found on the sweep and not fixed there: glossary readTerm (internal/core/glossary/index.go) loads every term file the index walk finds through a bare os.ReadFile — no O_NOFOLLOW, no O_NONBLOCK, no regular-file check, no byte cap. The glossary store is committed and travels with a clone, so a committed FIFO at a term name hangs every verb that builds the index, and a committed symlink reads an out-of-tree file as a term. The fix is the same one-line routing through fsutil.ReadGuarded that the issue and reading families now use, plus a byte cap chosen for the term family (the glossary has no cap constant of its own yet, which is the one decision that kept this out of the advisory fix) and a test with a FIFO and a symlinked leaf in the term store. Already-captured siblings are iss-2608301203521317 (lint scanRecordStores) and iss-2608211914592726 (the residual lint sweep).
- iss-2609012037127981Sibling of GHSA-fh9j-8xmg-m33f (CWE-59, CWE-400), found on the sweep and not fixed there: checkReceiptGate (internal/core/lint/lint.go) reads each review receipt under .abcd/work/reviews/<sha>/<gate>.json and the release-gate manifest through a bare os.ReadFile — no O_NOFOLLOW, no O_NONBLOCK, no regular-file check, no byte cap. The reviews store is committed and travels with a clone, so a committed FIFO at a receipt path hangs abcd lint (and make preflight through it), and a committed symlink is judged as if it were a receipt. The fix is the routing through fsutil.ReadGuarded that lint's readingoutstanding.go already uses for the reading family, with a cap for the receipt shape, and a test with a FIFO and a symlinked receipt. Distinct from iss-2609011423385217 (the manifest's stale pinned inputs) and from the record-store sweep records iss-2608301203521317 and iss-2608211914592726, which do not name the reviews store.
- itd-189What the widening reading proposes is admitted or declined on the record — grounds on admission, dispositions on declines, and surprises as their own entries