fix(miner): reject non-hex commitSha in replay-snapshot path planner (#7796)#7995
Closed
andriypolanski wants to merge 3 commits into
Closed
fix(miner): reject non-hex commitSha in replay-snapshot path planner (#7796)#7995andriypolanski wants to merge 3 commits into
andriypolanski wants to merge 3 commits into
Conversation
…SONbored#7796) normalizeCommitSha only trimmed and non-empty-checked its input, so a crafted value such as "../../etc" flowed into planReplaySnapshotPath's path.join and escaped REPLAY_SNAPSHOT_SUBDIR. Apply the same /^[0-9a-f]{7,40}$/i guard replay-task-generation.ts already uses, and import the .ts source in the unit test so Codecov patch grades the real diff under CI's build:miner-before- coverage layout (the failure mode that closed JSONbored#7992 at 0%). Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
|
loopover-orb
Bot
added
the
gittensor:bug
Contributor
|
This repository reviews pull requests one-shot: the PR must be correct as originally opened. Pushing an additional commit closes it automatically instead of restarting review — open a fresh pull request with every fix included. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
normalizeCommitShaaccepted any non-empty string, so a craftedcommitShalike../../etcescaped.loopover-replay-snapshotsviapath.join(replay-snapshot.ts's normalizeCommitSha has no format validation, letting a crafted value escape the intended snapshot directory via path.join #7796)./^[0-9a-f]{7,40}$/iformat guardreplay-task-generation.tsalready uses, rejecting path-traversal / non-hex values before they reachpath.join.Closes #7796
Change
packages/loopover-miner/lib/replay-snapshot.ts): after trim, requireCOMMIT_SHA_PATTERN(/^[0-9a-f]{7,40}$/i). Shared byplanReplaySnapshotPath,exportReplaySnapshot, and storegetSnapshot/saveSnapshot.test/unit/miner-replay-snapshot.test.ts):.tssource (not.js) so coverage attributes to the file Codecov patch grades — CI runsbuild:minerbefore coverage, which writes a sibling gitignored.js; a.jsimport then resolves to that compiled file and can report 0% patch on the.tsdiff (root cause of closed fix(miner): validate commit SHA is a safe path segment in replay-snapshot planner (#7796) #7992).abc123→abc1234, etc.).REPLAY_SNAPSHOT_SUBDIR;exportReplaySnapshotrejects before any git work; storegetSnapshot/saveSnapshotreject.Validation
git diff --checkclean.npx vitest run test/unit/miner-replay-snapshot.test.ts— all green (afternpm run build:miner, matching CI).coverage/lcov.infowith compiled.jspresent: every added executable line hit (COMMIT_SHA_PATTERN,trimmed, regexif,return); regex branch arms both[hit].UI Evidence
N/A — miner lib hardening only; no UI surface changed.
Made with Cursor