The rules session ledger falls back to a predictable shared temp path another account can plant

The rules session ledger falls back to a predictable shared temp path another account can plant

Published as security advisory GHSA-p9fx-jp4g-86hj; the advisory is the public account of this finding.

What

The rules loader keeps a per-session dedup ledger so a domain already injected is not injected again. Its directory comes from ABCD_RULES_STATE_DIR or the user cache directory; with neither (no HOME and no XDG cache directory), it fell back to a predictable shared path, /tmp/abcd-rules-state-<uid> (internal/core/rules/inject.go ~285-296). The fallback was created with MkdirAll and then read and written with no check of its owner, its mode or whether it was a symlink.

Another local account can create that directory first and plant a ledger. LoadState then honours it, so the hook treats the planted domains as already injected and suppresses them: rules the person's session should be shown, the shell-hazard teaching among them, are silently left out. The old code comment said a poisoned fallback could at worst re-inject, which understates it.

Reproduced with a test that plants a ledger in the shared temporary directory: LoadState returned the forged ledger and SaveState wrote into the shared directory.

The precondition is narrow: a session with no HOME or XDG cache directory, on a machine another account can write /tmp on.

Affected versions

Every released version up to and including 0.15.1 with the rules loader. Patched versions will be set when the release carrying the fix is cut.

Would it exist without abcd?

No. The ledger, its fallback path and the injection it governs are abcd's own. abcd added it, so abcd fixes it.

Fix

With no per-user directory, keep no session ledger at all: every prompt injects its matched domains, and nothing is read from or written to a shared path. No repository behaviour changes.