Development record
cmd/record-lint prints Finding.File and Finding.Message raw — no termsafe.Sanitize and no path scrub on the findings path (its scrubPaths covers only the two error exits), so any rule echoing repo content lets a hostile clone inject terminal escapes into CI logs, and any finding message embedding an os error can leak absolute paths. The abcd CLI surface sanitizes at its findings renderer; the standalone binary does not. Found by the spc-27 security review, which also caught (and the change fixed) the one in-diff instance.
issueresolvedminoriss-264
cmd/record-lint prints Finding.File and Finding.Message raw — no termsafe.Sanitize and no path scrub on the findings path (its scrubPaths covers only the two error exits), so any rule echoing repo content lets a hostile clone inject terminal escapes into CI logs, and any finding message embedding an os error can leak absolute paths. The abcd CLI surface sanitizes at its findings renderer; the standalone binary does not. Found by the spc-27 security review, which also caught (and the change fixed) the one in-diff instance.
Frontmatter
| id | iss-264 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-264-record-lint-findings-path-unsanitised.md
open on GitHub ↗ · commit history ↗
mentions8
- iss-311cmd record-lint and scaffold-sync resolve the repo root with an unscrubbed git rev-parse so an inherited GIT_WORK_TREE redirects the lint or release gate
- iss-359cite fetch records a redirect-controlled FinalURL verbatim, so C1, bidi and zero-width runes in a hostile Location query reach abcd docs lint --json and the committed citations baseline raw; the termsafe doc claim that encoding/json escapes control characters is false for those classes
- iss-361The lifeboat coverage renderer prints untrusted cross-repo status and tiers_present fields to the terminal without termsafe, so a crafted probe report injects raw ESC/OSC-8/C1/bidi sequences; only the repo name is sanitised
- iss-366termsafe.Sanitize masks four zero-width runes (U+200B/200C/200D/FEFF) but not U+2060 WORD JOINER (the modern successor to the deprecated FEFF-as-joiner it does mask), nor U+2061-2064/U+00AD/Hangul fillers, so those default-ignorable characters pass through and two byte strings render identically
- iss-382disembark plan's RenderManifest prints planned file paths unsanitised, so a hostile source-repo filename injects raw C1/bidi terminal escapes into the plan render and its --json twin
- iss-384Baseline.validate sanitises final_url alone while echoing the entry key, url and quoted fields raw, so a committed citations-baseline entry writes ESC/bidi/zero-width to the terminal through the blocking docs-lint gate
- iss-2608211432258689launch --dry-run prints WouldRefuseOn with %v and no termsafe.Sanitize, so a committed repo filename carrying raw terminal escapes reaches the terminal and CI log (sibling of iss-259/iss-264 at an unrecorded site)
- spc-27the-registry-cannot-wave-its-hands-every-surface-file-carrie