abcd reserve pushes a reservation naming an embargoed record and its footprint paths to origin

abcd reserve pushes a reservation naming an embargoed record and its footprint paths to origin

Published as security advisory GHSA-hh27-mjhr-69m9; the advisory is the public account of this finding.

What

abcd reserve checks a record id's shape only (internal/core/claim/claim.go:120-132) and never consults the embargo store. Only abcd announce runs the embargo check (internal/core/claim/announce.go:417-426, wired at internal/surface/cli/announce.go:97). The reserve path's text check (prepare.go:335-350) looks for session URLs and tool footers only.

A record the embargo store holds for a privately reported advisory can therefore be reserved, and the reservation is pushed to origin as an ordinary branch, refs/heads/abcd-reserved/<id>, with Abcd-Reservation: <id> and one Abcd-Footprint: <path> trailer per path the fix will change. On a public repository, that publishes the private record's id, the fact that it is being worked, and the paths of the vulnerable code before the advisory is published. The repository's own instructions tell agents to reserve a record before working it, so the realistic trigger is the person's own fix workflow. embargo check itself classes naming a held record in public as a finding, and its range check does not read branch names.

Reproduced against a bare origin: reserving an id that exists in no public ledger, with a footprint path, succeeds and leaves that branch and those trailers on origin.

The advisory's id, title and text do not leak by this route unless typed into the footprint.

Affected versions

Every released version up to and including 0.15.1. Patched versions will be set when the release carrying the fix is cut.

Would it exist without abcd?

No. The reservation push is abcd's own write to a public place, and abcd's own embargo check treats the same disclosure as a finding. abcd added it, so abcd fixes it.

Fix

Give Reserve the same mandatory embargo check Announce has, run over the record id and the reservation text, wired at the CLI and in the implement loop's claim options, and refuse with nothing pushed. This only adds a refusal; reservation refs and their format stay the same.