mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: harden evidence secret file handoff

Browse Source
This commit is contained in:
marcopan
2026-08-09 19:27:52 +02:00
parent e50aad7e41
commit 3b9681a63a
4 changed files with 83 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/workspaces/bindings.ts
+12 -11
View File
@@ -60,18 +60,18 @@ function isInside(path: string, root: string): boolean {
return pathRelative !== "" && !pathRelative.startsWith("..") && !isAbsolute(pathRelative);
}
function isSafeSecretFile(path: string, secretRoots: readonly string[]): boolean {
if (!isAbsolute(path)) return false;
function safeSecretFilePath(path: string, secretRoots: readonly string[]): string | undefined {
if (!isAbsolute(path)) return undefined;
try {
const resolvedPath = realpathSync(path);
const resolvedRoots = secretRoots.map((root) => realpathSync(root));
if (!resolvedRoots.some((root) => isInside(resolvedPath, root))) return false;
if (!statSync(resolvedPath).isFile()) return false;
if (!resolvedRoots.some((root) => isInside(resolvedPath, root))) return undefined;
if (!statSync(resolvedPath).isFile()) return undefined;
accessSync(resolvedPath, constants.R_OK);
return true;
return resolvedPath;
} catch {
return false;
return undefined;
}
}
@@ -132,11 +132,12 @@ export function resolveBinding(
const value = env[variable.name];
const present = value !== undefined && value.trim() !== "";
const safe = !variable.secret || (present && isSafeSecretFile(value, secretRoots));
const safePath = variable.secret && present ? safeSecretFilePath(value, secretRoots) : undefined;
const safe = !variable.secret || safePath !== undefined;
if ((required.has(variable.suffix) && !present) || (present && !safe)) {
missing.push(variable.name);
}
if (present && safe) values[variable.name] = value;
if (present && safe) values[variable.name] = variable.secret ? safePath! : value;
}
return { transport: selectedTransport, values, missing };
@@ -166,11 +167,11 @@ export function resolveEvidenceBinding(
for (const variable of variables) {
const value = env[variable.name];
const present = value !== undefined && value.trim() !== "";
const safe = present && isSafeSecretFile(value, secretRoots);
if ((required.has(variable.suffix) && !present) || (present && !safe)) {
const safePath = present ? safeSecretFilePath(value, secretRoots) : undefined;
if ((required.has(variable.suffix) && !present) || (present && safePath === undefined)) {
missing.push(variable.name);
}
if (safe) values[variable.name] = value;
if (safePath !== undefined) values[variable.name] = safePath;
}
return { values, missing };
}