Repository navigation
fix: security audit run-3 findings (escalate path normalization, question-answer redaction) - #103
Merged
Merged
Conversation
A write, read or patch of '.env/.', '.env/' or 'sub/../.env/.' reaches the same file as '.env' after OpenCode's path.resolve, but slipped past a '*.env' rule. Path-like candidates are now also matched in POSIX-normalized form. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0179ZomNiDQHCzgoxeRVmfth
… verdict reason Question-answer turns were redacted after JSON.stringify, so escaped newlines and quotes hid private key blocks and quoted assignments from the rules. Each answer string is now redacted before re-encoding. The reviewer's reason, which reaches the agent as a tool error, is redacted too. Option labels are trimmed like the answers, so a clicked padded label is no longer reported as user-typed text. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0179ZomNiDQHCzgoxeRVmfth
The reviewer's read-only permissions replaced the host defaults, dropping its '*.env' read ask. The reviewer now denies reading '*.env' and '*.env.*' (allowing '*.env.example') on V1 and V2. README documents the path normalization, reason redaction and the reviewer's read scope. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0179ZomNiDQHCzgoxeRVmfth
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0179ZomNiDQHCzgoxeRVmfth
The review rules leave a key block cut at the 300-character reason limit, short values and repeated names visible. The reason is output, not judged, so the generous log redaction now runs on top. README states that the reviewer's .env rule covers read only and that path rules are written without ./. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0179ZomNiDQHCzgoxeRVmfth
…ecisely Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0179ZomNiDQHCzgoxeRVmfth
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0179ZomNiDQHCzgoxeRVmfth
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes from security audit run-3 (two confirmed lows plus cheap needs-validation leads):
escalation-rules:path-candidates-not-host-normalized): in all-tools mode,.env/.,.env/,sub/../.env/.(and the same inapply_patchheaders) slipped past a*.envrule although OpenCode'spath.resolvetargets.env. Path-like candidates are now also matched in POSIX-normalized form (backslashes as separators,./..and repeated/trailing slashes removed). Adding candidates only escalates more.redaction:question-answer-turn-json-encoded-before-redaction): V2 question-answer turns are now decoded and each string redacted before re-encoding, so private key blocks and quotedKEY="..."/--password "..."answers no longer reach the reviewer provider.conversation:question-answer-label-trim-provenance-mislabel): option labels are trimmed like the answers before classification.claude-agent-reviewer:reason-channel-and-full-env-extraction/opencode-agent-reviewer:session-read-allow-overrides-host-env-ask-and-user-read-deny):RedactingReviewernow redacts the verdict reason, which reaches the agent as a tool error. The default OpenCode reviewer session keeps the host's.envread rules as deny (*.env,*.env.*deny;*.env.exampleallow) on V1 and V2. README documents that the reviewer is not bound by operatorreaddenies.Each fix has a regression test that fails before it.
Test plan
pnpm cicheck🤖 Generated with Claude Code
https://claude.ai/code/session_0179ZomNiDQHCzgoxeRVmfth