3 Commits

Include renames

Author	SHA1	Message	Date
ChuckBuildsandClaude Opus 5	5929190e36	fix(composer): sanitise the id with the form CodeQL recognises ... Previous attempt got the count from 22 down to 19 but left the 16 path-injection alerts untouched: CodeQL carries taint through _plugin_dir's return value and does not treat an internal realpath / commonpath guard as a sanitiser. secure_filename is one it does model. It is also a no-op on every id the regex accepts -- verified across the accepted alphabet, 4000 generated ids, zero altered -- so it cannot rewrite a caller's id into a different plugin's directory. The equality check makes that explicit: if it changes anything, the id was not one we accept, and we refuse rather than silently redirect. Found a real bug while testing the layers separately: '.' resolved to the plugins root, and install() calls shutil.rmtree(target) when force is set, so an id of '.' would have deleted every installed plugin. The regex blocks it today, but the containment layer was allowing candidate == base on the grounds that the base is not "outside" itself. A plugin directory must be a child, never the root. That came out of writing the isolated tests. Removing containment did not fail anything, because secure_filename rejects traversal first -- which made a redundant layer look load-bearing. Each layer is now neutralised in turn so the one under test is the only thing standing: containment removed -> FAIL (13 payloads reach the base or past it) candidate == base allowed -> FAIL ('.' resolves to the plugins root) commonpath -> startswith -> FAIL (sibling "plugins-evil" accepted) secure_filename bypassed -> pass, containment covers it The last is honest rather than a gap: with containment in place the sanitiser has nothing left to block, and its value here is CodeQL recognition plus a second barrier if containment is ever weakened. Also corrected an assertion in the previous commit's test, which counted any non-None result as an escape. '....', '~' and 'a\..\..' are ordinary directory names on Linux and resolve safely inside the base; treating them as escapes made the test fail on correct code. 35 tests. The 5 test_web_api.py failures are pre-existing on this branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01STMbQE4YctTacQXfbYqKuW	2026-08-21 18:25:50 -04:00
ChuckBuildsandClaude Opus 5	79ba93f5a6	fix(composer): recognisable path containment, and define md:inline ... Follow-up to the previous commit, which made the CodeQL count worse rather than better: 19 alerts became 22. Two mistakes. First, the containment check used `base not in candidate.parents`. That is correct Python but not a form static analysis recognises, so every path-injection alert stayed and _plugin_dir itself picked up two more. It now uses os.path.realpath plus os.path.commonpath, which is both the documented sanitiser shape and stricter than the obvious alternative: "/x/plugins-evil" startswith "/x/plugins" but is a different directory, and there is now a test that fails if anyone swaps commonpath for startswith. Second, raising ComposerInputError from _plugin_dir and returning str(exc) added two new py/stack-trace-exposure alerts -- CodeQL flags exception text reaching a response regardless of the exception's type. _plugin_dir returns None instead and the three handlers answer with a fixed literal. There is nothing a caller needs there beyond "that id is not ok". Also defines .md\:inline in app.css. composer.html marks five toolbar button labels `hidden md:inline`, and the class was never defined, so those labels were hidden at every width and the buttons stayed icon-only. main's test_web_static_audit.py catches it -- the branch predates that test, which is why it only surfaced now that CI checks the merge: Responsive utility classes referenced in templates but never defined in app.css (they silently no-op): ['md:inline'] Verified against the merged state -- main's app.css plus this one line, audited against this branch's templates: 3 passed. The other twelve classes the audit flags locally are defined on main and are artifacts of this branch being 54 commits behind. 33 containment tests. Mutation-checked twice: removing the containment lets eight payloads escape, including /etc/passwd and plugin/../../../../../../etc/shadow; swapping commonpath for startswith fails the sibling-prefix test. Not addressed: three py/stack-trace-exposure alerts on the _generate_plugin_files handlers. Those return str(exc) for ComposerInputError, whose seven raise sites are all authored literals ("Author is required.", "Config variable key X is not a valid Python identifier."). Suppressing them means replacing useful validation feedback with a generic string, which is a real cost to the user for a scanner's benefit. Worth a decision rather than a silent downgrade. The 5 test_web_api.py failures are pre-existing on this branch -- identical counts with these changes stashed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01STMbQE4YctTacQXfbYqKuW	2026-08-21 17:52:11 -04:00
ChuckBuildsandClaude Opus 5	e499efb1f0	fix(composer): resolve plugin paths at the filesystem boundary ... CodeQL reports 19 alerts against this PR -- 16 high-severity py/path-injection plus 3 py/stack-trace-exposure -- all in web_interface/blueprints/composer.py, where a request-supplied plugin_id reaches Path(plugins_dir) / plugin_id and the result is created, written to, deleted with shutil.rmtree, and read back. The path-injection alerts are false positives today. _PLUGIN_ID_RE is fully anchored and permits only [a-z][a-z0-9-]{0,62}, so every traversal payload is already rejected; I checked fourteen of them, including ../../etc/passwd, a/../../etc, /etc/passwd and encoded variants, and none gets past it. They are worth fixing anyway. The guarantee lived in a regex several hundred lines from the path building, so relaxing that pattern later -- to allow an underscore, say -- would open a traversal with nothing at the filesystem boundary to catch it. _plugin_dir() now resolves the candidate and refuses anything that is not inside plugins_dir, and all three call sites go through it. That is also the shape static analysis recognises, which is why sixteen alerts landed on code that was already safe. The regex anchor moves from $ to \Z. Python's $ also matches just before a trailing newline, so "myplugin\n" was accepted and would have created a directory whose name ends in one. Not traversal, but not a name anything downstream should have to handle. For the stack-trace exposure: the handlers returned str(exc) for any ValueError out of _generate_plugin_files. The seven raises there are all curated, user-facing validation messages, and they now use a ComposerInputError subclass so they keep reaching the user verbatim. A ValueError from anywhere else -- json, int(), a library -- is logged with a traceback and answered generically, since its text can name internal paths. Verified: 32 tests covering fourteen traversal payloads and twelve malformed ids. The key one re-runs every payload with the id pattern deliberately loosened to allow slashes and dots; removing the containment check fails it with these escaped the base with a loosened regex: [('/etc/passwd', '/etc/passwd'), ('//etc/passwd', '//etc/passwd')] so the boundary is doing real work rather than shadowing the regex. The 5 failures in test_web_api.py are unrelated and pre-existing on this branch -- identical counts with these changes stashed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01STMbQE4YctTacQXfbYqKuW	2026-08-21 17:18:26 -04:00