A drain trusts a run-state file that a repository's own history can supply

A drain trusts a run-state file that a repository's own history can supply

Published as security advisory GHSA-xhp5-r9x9-h5fr; the advisory is the public account of this finding.

abcd drain keeps its run state in the checkout's local tier, a git-ignored directory that is never meant to be committed. When it starts, the drain reads that state with checks on the file's shape and type, but it doesn't check that git leaves the file untracked. A repository whose history force-adds a state file therefore hands every fresh clone a state the drain accepts. The drain then publishes the pending hand-backs named in that state, under the identity of whoever runs it, to the repository's shared reservation branches.

Impact: a person who runs a drain in a checkout whose history carries a planted state publishes hand-backs they never made. Other drains then stay off those issues until someone edits each record. The entries are bounded: each kind comes from a closed list, and each must name the issue record's current content. Running code and reading secrets are not possible. Severity is rated low: the effect is a denial of service on drains, it can be undone, and the file has to reach the history first, through a merged change or a repository the person chose to clone.

Fix: the drain, and every other reader of the local tier's state, refuses a state file that git tracks. A lint rule refuses any committed file under the local tier.

Workaround: before running a drain, check that git ls-files .abcd/.work.local prints nothing.