mirror of
https://github.com/garrytan/gstack.git
synced 2026-05-01 19:25:10 +02:00
Garry Tan
7450b5160b
* fix: remove auth token from /health, secure extension bootstrap (CRITICAL-02 + HIGH-03) - Remove token from /health response (was leaked to any localhost process) - Write .auth.json to extension dir for Manifest V3 bootstrap - sidebar-agent reads token from state file via BROWSE_STATE_FILE env var - Remove getToken handler from extension (token via health broadcast) - Extension loads token before first health poll to prevent race condition * fix: require auth on cookie-picker data routes (CRITICAL-01) - Add Bearer token auth gate on all /cookie-picker/* data/action routes - GET /cookie-picker HTML page stays unauthenticated (UI shell) - Token embedded in served HTML for picker's fetch calls - CORS preflight now allows Authorization header * fix: add state file TTL and plaintext cookie warning (HIGH-02) - Add savedAt timestamp to state save output - Warn on load if state file older than 7 days - Auto-delete stale state files (>7 days) on server startup - Warning about plaintext cookie storage in save message * fix: innerHTML XSS in extension content script and sidepanel (MEDIUM-01) - content.js: replace innerHTML with createElement/textContent for ref panel - sidepanel.js: escape entry.command with escapeHtml() in activity feed - Both found by security audit + Codex adversarial red team * fix: symlink bypass in validateReadPath (MEDIUM-02) - Always resolve to absolute path first (fixes relative path bypass) - Use realpathSync to follow symlinks before boundary check - Throw on non-ENOENT realpathSync failures (explicit over silent) - Resolve SAFE_DIRECTORIES through realpathSync (macOS /tmp → /private/tmp) - Resolve directory part for non-existent files (ENOENT with symlinked parent) * fix: freeze hook symlink bypass and prefix collision (MEDIUM-03) - Add POSIX-portable path resolution (cd + pwd -P, works on macOS) - Fix prefix collision: /project-evil no longer matches /project freeze dir - Use trailing slash in boundary check to require directory boundary * fix: shell script injection in gstack-config and telemetry (MEDIUM-04) - gstack-config: validate keys (alphanumeric+underscore only) - gstack-config: use grep -F (fixed string) instead of -E (regex) - gstack-config: escape sed special chars in values, drop newlines - gstack-telemetry-log: sanitize REPO_SLUG and BRANCH via json_safe() * test: 20 security tests for audit remediation - server-auth: verify token removed from /health, auth on /refs, /activity/* - cookie-picker: auth required on data routes, HTML page unauthenticated - path-validation: symlink bypass blocked, realpathSync failure throws - gstack-config: regex key rejected, sed special chars preserved - state-ttl: savedAt timestamp, 7-day TTL warning - telemetry: branch/repo with quotes don't corrupt JSON - adversarial: sidepanel escapes entry.command, freeze prefix collision * chore: bump version and changelog (v0.13.1.0) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs: tone down changelog — defense in depth, not catastrophic bugs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
80 lines
2.6 KiB
Bash
Executable File
80 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# check-freeze.sh — PreToolUse hook for /freeze skill
|
|
# Reads JSON from stdin, checks if file_path is within the freeze boundary.
|
|
# Returns {"permissionDecision":"deny","message":"..."} to block, or {} to allow.
|
|
set -euo pipefail
|
|
|
|
# Read stdin
|
|
INPUT=$(cat)
|
|
|
|
# Locate the freeze directory state file
|
|
STATE_DIR="${CLAUDE_PLUGIN_DATA:-$HOME/.gstack}"
|
|
FREEZE_FILE="$STATE_DIR/freeze-dir.txt"
|
|
|
|
# If no freeze file exists, allow everything (not yet configured)
|
|
if [ ! -f "$FREEZE_FILE" ]; then
|
|
echo '{}'
|
|
exit 0
|
|
fi
|
|
|
|
FREEZE_DIR=$(tr -d '[:space:]' < "$FREEZE_FILE")
|
|
|
|
# If freeze dir is empty, allow
|
|
if [ -z "$FREEZE_DIR" ]; then
|
|
echo '{}'
|
|
exit 0
|
|
fi
|
|
|
|
# Extract file_path from tool_input JSON
|
|
# Try grep/sed first, fall back to Python for escaped quotes
|
|
FILE_PATH=$(printf '%s' "$INPUT" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*:[[:space:]]*"//;s/"$//' || true)
|
|
|
|
# Python fallback if grep returned empty
|
|
if [ -z "$FILE_PATH" ]; then
|
|
FILE_PATH=$(printf '%s' "$INPUT" | python3 -c 'import sys,json; print(json.loads(sys.stdin.read()).get("tool_input",{}).get("file_path",""))' 2>/dev/null || true)
|
|
fi
|
|
|
|
# If we couldn't extract a file path, allow (don't block on parse failure)
|
|
if [ -z "$FILE_PATH" ]; then
|
|
echo '{}'
|
|
exit 0
|
|
fi
|
|
|
|
# Resolve file_path to absolute if it isn't already
|
|
case "$FILE_PATH" in
|
|
/*) ;; # already absolute
|
|
*)
|
|
FILE_PATH="$(pwd)/$FILE_PATH"
|
|
;;
|
|
esac
|
|
|
|
# Normalize: remove double slashes and trailing slash
|
|
FILE_PATH=$(printf '%s' "$FILE_PATH" | sed 's|/\+|/|g;s|/$||')
|
|
|
|
# Resolve symlinks and .. sequences (POSIX-portable, works on macOS)
|
|
_resolve_path() {
|
|
local _dir _base
|
|
_dir="$(dirname "$1")"
|
|
_base="$(basename "$1")"
|
|
_dir="$(cd "$_dir" 2>/dev/null && pwd -P || printf '%s' "$_dir")"
|
|
printf '%s/%s' "$_dir" "$_base"
|
|
}
|
|
FILE_PATH=$(_resolve_path "$FILE_PATH")
|
|
FREEZE_DIR=$(_resolve_path "$FREEZE_DIR")
|
|
|
|
# Check: does the file path start with the freeze directory?
|
|
case "$FILE_PATH" in
|
|
"${FREEZE_DIR}/"*|"${FREEZE_DIR}")
|
|
# Inside freeze boundary — allow
|
|
echo '{}'
|
|
;;
|
|
*)
|
|
# Outside freeze boundary — deny
|
|
# Log hook fire event
|
|
mkdir -p ~/.gstack/analytics 2>/dev/null || true
|
|
echo '{"event":"hook_fire","skill":"freeze","pattern":"boundary_deny","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}' >> ~/.gstack/analytics/skill-usage.jsonl 2>/dev/null || true
|
|
|
|
printf '{"permissionDecision":"deny","message":"[freeze] Blocked: %s is outside the freeze boundary (%s). Only edits within the frozen directory are allowed."}\n' "$FILE_PATH" "$FREEZE_DIR"
|
|
;;
|
|
esac
|