Lap Tran
4a2301b077
CI / build (push) Has been cancelled
- Archive 79 completed framework-dev tasks from tasks/ -> tasks/complete/ - status.py: add --cleanup-done and --install-cleanup-schedule commands - Add scripts/automaton-cleanup.sh for periodic task archiving - Dashboard: rename 'Background' tab -> 'Agent', 'Cleanup' agent -> 'Completed Task Archiver', remove redundant group headers and pill badges, dim inactive agent placeholders - .rules.md: add Self-Documenting UI Names rule - New tests: test_cleanup_done.py, expanded test_app.py and test_task.py
60 lines
2.6 KiB
Markdown
60 lines
2.6 KiB
Markdown
# ADVERSARIAL_BUG_REPORT: fix-install-update-flow
|
|
|
|
## Methodology
|
|
|
|
Targeted attack on:
|
|
1. Shell injection via `$GIT_URL`
|
|
2. Path traversal via `$FRAMEWORK_DIR`
|
|
3. Race condition on `.venv` creation
|
|
4. Hook source file missing
|
|
5. `set -e` interaction with `|| true`
|
|
|
|
## Findings
|
|
|
|
### Attack 1: Shell injection via `$GIT_URL` -- NOT VULNERABLE
|
|
|
|
`$GIT_URL` is passed as a double-quoted argument to `git clone "$GIT_URL" "$FRAMEWORK_DIR"`. The shell does not interpret special characters inside double quotes in argument position. `git clone` treats it as a URL, not a shell command. No injection vector.
|
|
|
|
**Verdict:** NOT VULNERABLE
|
|
|
|
### Attack 2: Path traversal via `$FRAMEWORK_DIR` -- NOT VULNERABLE
|
|
|
|
`$FRAMEWORK_DIR` is set to `$HOME/.automaton` at the top of the script. It is not derived from user input. All paths constructed with `$FRAMEWORK_DIR` are safe.
|
|
|
|
**Verdict:** NOT VULNERABLE
|
|
|
|
### Attack 3: Race condition on `.venv` creation -- NOT EXPLOITABLE
|
|
|
|
If two installs run concurrently (unlikely for a per-user framework), both might try to create `.venv` simultaneously. `python3 -m venv` creates the directory atomically. If it already exists, it updates in place. No data corruption.
|
|
|
|
**Verdict:** NOT EXPLOITABLE
|
|
|
|
### Attack 4: Hook source file missing -- HANDLED
|
|
|
|
All three scripts check `[ -f "$HOOK_SRC" ]` or `[ -f "$SOURCE" ]` before copying. If the source is missing, `install-hooks.sh` prints a WARNING and continues. `update.sh` skips the hook. `upgrade.sh` would fail on `cp` if the source is missing and the check doesn't guard it -- let me verify.
|
|
|
|
Looking at `upgrade.sh`:
|
|
```bash
|
|
HOOK_SOURCE="$FRAMEWORK_DIR/scripts/git-hooks/$HOOK"
|
|
if [ -f "$HOOK_TARGET" ]; then
|
|
...
|
|
else
|
|
cp "$HOOK_SOURCE" "$HOOK_TARGET"
|
|
```
|
|
|
|
If `$HOOK_SOURCE` doesn't exist, `cp` will fail and `set -euo pipefail` will cause the script to exit. This is a bug if the framework is corrupted. However, the hooks are part of the framework and should always exist. If they're missing, exiting with an error is the correct behavior (not silent success).
|
|
|
|
**Verdict:** ACCEPTABLE (fails loudly on corrupted framework)
|
|
|
|
### Attack 5: `set -e` interaction with `|| true` -- CORRECT
|
|
|
|
`set -e` causes the script to exit on any command failure. `cmd || true` prevents the exit because the overall command succeeds (the `|| true` branch). The `|| echo "WARNING: ..."` pattern also prevents exit because `echo` succeeds. This is the standard bash idiom for non-fatal commands.
|
|
|
|
**Verdict:** CORRECT
|
|
|
|
## Summary
|
|
|
|
No exploitable vulnerabilities found. One ACCEPTABLE finding (upgrade.sh fails loudly on corrupted framework, which is correct behavior).
|
|
|
|
**Verdict: CLEAN**
|