Repository navigation
The taboo guard resolves relative and Unicode-folded edit targets - #64
Merged
Merged
Conversation
A review of 2.29.0 found two spellings the file mode missed. A relative target was matched as written, so a bare sshd_config from inside /etc/ssh passed; it is now resolved against the cwd the hook input carries. APFS folds the long s and the Kelvin sign onto ASCII letters and HFS+ ignores zero-width characters, so the target is also matched with those mapped and all other non-ASCII bytes removed. Without jq a relative target is denied, because nothing can resolve it. An AI agent wrote this text in my name. I know that is problematic.
Ships two fixes to the guard's file mode from #64. A patch release because the mode keeps its meaning: it denies the same three targets, now also under a relative path and under a Unicode spelling that macOS folds onto the protected name. An AI agent wrote this text in my name. I know that is problematic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A review of #63 found two spellings of a protected path that the guard's file mode let through.
A relative target was matched as written, so
sshd_configwritten from inside/etc/sshpassed. It is now resolved against thecwdthe hook input carries. On macOS, APFS folds the long s and the Kelvin sign ontosandk, and HFS+ ignores zero-width characters, so the target is also matched with those two mapped and every other non-ASCII byte removed. Withoutjqa relative target is denied, because nothing can resolve it.Bumps to 2.29.1.
An AI agent wrote this text in my name. I know that is problematic.