Security/all fixes combined - #24
Open
sunny-se wants to merge 13 commits into
Open
Conversation
F-001 / DEVA11Y-473 — The default download URL used plaintext HTTP (CWE-319), allowing MitM to substitute a malicious binary. Switch to HTTPS to enforce TLS. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
F-002 / DEVA11Y-474 — All three cli.sh variants (bash, zsh, fish) downloaded the CLI binary over plaintext HTTP (CWE-319), enabling MitM binary substitution. Switch to HTTPS. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
F-012 / DEVA11Y-481 — The plugin declared unrestricted .all() network scope (CWE-250) which amplifies blast radius of other findings. Switch to .all(ports: []) matching what shell scripts already enforce. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
F-004 / DEVA11Y-476 — The Semgrep workflow used an unpinned image tag (CWE-829), enabling tag-poisoning attacks. Pin to SHA256 digest. This is the chain-breaker for C-001 (DEVA11Y-485, CVSS 10.0). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
F-003 / DEVA11Y-475 — script_self_update() fetched the script from a mutable branch head with no integrity verification (CWE-494). The ^#! regex check is trivially bypassed. Remove self-update entirely; users should update via git pull or package manager. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
F-005 / DEVA11Y-477 — The generated Package.swift pinned the AccessibilityDevTools dependency to branch "main" (CWE-829), allowing any push to main to execute in the plugin sandbox. Pin to a specific revision SHA for supply-chain integrity. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
F-006 / DEVA11Y-478 — script_self_update() in spm.sh scripts fetched from a mutable branch head with no integrity verification (CWE-494). Same pattern as F-003. Remove self-update entirely. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
F-008 / DEVA11Y-479 — parseOverride() accepted file:// URLs and bare paths (CWE-918), enabling SSRF and local-file exfiltration via bsdtar. Restrict to HTTPS-only to prevent local file access. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
F-010 / DEVA11Y-480 — extractVersion() did not validate the version string parsed from HTTP redirect filenames (CWE-22). A crafted filename with ../ segments could write outside the cache directory. Add character allowlist and reject traversal sequences. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
F-013 / DEVA11Y-482 — prepareArtifact had a TOCTOU race (CWE-362) where the check-delete-create-download sequence left a large window for parallel builds to corrupt state. Download into a temp directory and atomically move to the version directory after completion. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
F-014 / DEVA11Y-483 — Concurrent spm.sh instances shared CWD (CWE-362), causing cleanup trap to delete sibling's Package.swift. Use mktemp -d for an isolated working directory per invocation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
F-015 / DEVA11Y-484 — bsdtar extraction had no size or entry-count limit (CWE-400), allowing decompression bomb DoS. Add a 100 MB post- extraction size check that removes the output and errors on violation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…-url', 'origin/fix/DEVA11Y-474-https-shell-download', 'origin/fix/DEVA11Y-475-remove-cli-self-update', 'origin/fix/DEVA11Y-476-pin-semgrep-image', 'origin/fix/DEVA11Y-477-pin-spm-dependency', 'origin/fix/DEVA11Y-478-remove-spm-self-update', 'origin/fix/DEVA11Y-479-block-file-scheme', 'origin/fix/DEVA11Y-480-sanitize-version-string', 'origin/fix/DEVA11Y-481-restrict-network-scope', 'origin/fix/DEVA11Y-482-atomic-cache-update', 'origin/fix/DEVA11Y-483-spm-tmpdir-isolation' and 'origin/fix/DEVA11Y-484-extraction-size-limit' into security/all-fixes-combined
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.