feat(scanner): reject plugin archive traversal and unadmitted submodules - #1135
Draft
seonghobae wants to merge 4 commits into
Draft
Conversation
Fail closed on zip/tar members that escape the extract root and on nested gitmodules/gitlinks without a recursively admitted 40-character SHA identity. Relates to #1099.
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
added a commit
that referenced
this pull request
Sep 7, 2026
Summary: - Snapshot 08:25 UTC records Draft #1135 `81e83f4` stacked on #1134. - Archive path traversal and unadmitted submodules fail closed. - #1134 restack head is `0cd4329`; #1133 coverage remains queued. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1135 (997/997)
…ude-plugin-archive-submodule-1099
Contributor
Author
seonghobae
added a commit
that referenced
this pull request
Sep 7, 2026
Contributor
Author
seonghobae
added a commit
that referenced
this pull request
Sep 7, 2026
Summary: - Snapshot 09:12 UTC records Draft #1136 `2fe93a1` stacked on #1135. - Restacked #1135/#1134/#1129/#998 heads are aligned. - A pass receipt is not admission; replay against mutated trees fails. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1136 (1039/1039)
…ude-plugin-archive-submodule-1099
Contributor
Author
|
Non-force restack onto #1134 |
seonghobae
added a commit
that referenced
this pull request
Sep 7, 2026
This was referenced Sep 7, 2026
seonghobae
added a commit
that referenced
this pull request
Sep 7, 2026
This was referenced Sep 7, 2026
seonghobae
added a commit
that referenced
this pull request
Sep 7, 2026
Summary: - Snapshot 20:26 UTC records Draft #1166 `90cd031` stacked on #1165. - Archive ratio >100 or nesting deeper than 1 fail closed. - Bomb members are not extracted; zip-slip stays #1135. Rationale: - #999 is the single writer of the product-technical gap baseline. - #1099 remaining surfaces stay on stacked successors, not Close. Tests: - documentation-only; detector evidence lives on #1166 (2201/2201)
seonghobae
added
enhancement
ChatGPT Codex Connector
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacking
Successor of Draft #1134 / Draft #1129 / issue #1099. Targets
feat/claude-plugin-capability-inventory-1099(exact base0cd4329cf21aed37831863ad91350d0c39d0b689), notdevelopand not #998.Does not Close #1099, #1134, or #1129. Does not close #1087, #929, #983, #1106, #1036, or #1133. Does not steal G-06 #1133 or #998. Does not reimplement #1036 homoglyph/injection/exfil/placeholder detectors.
#1134 remains owner of capability inventory, undeclared executables, and
capability_inventory_sha256. #1129 remains owner of prior admission rules (floating refs, provider secrets, pipe-to-shell, symlink escape, duplicate JSON, unbounded MCP, missing LICENSE, concealed identity, oversized packages, receipts, source mismatch, LifeOS skip-auth).Unique delta
../, absolute POSIX paths, Windows drive/UNC prefixes). Rule idclaude-plugin-archive-path-traversal. Traversal members are not extracted; files outside the bounded root are not scanned as plugin content. Snippets are path labels only (no raw archive bytes, secrets, or bidi)..gitmodules/ gitlink / submodule path without a recursively admitted immutable 40-character SHA identity fails admission. Rule idclaude-plugin-unadmitted-submodule. A full SHA plus a pinned, licensed nestedplugin.jsonis negative only when that nested identity is complete.scan_result=pass. Capability inventory / undeclared-executable / source-mismatch behavior is unchanged.Evidence
python -m scripts.ci.verify_module_coverage --module appguardrail_core/claude_plugin_detector.py --test tests/test_claude_plugin_supply_chain.py: 997/997Relates to #1099. Relates to #1134. Relates to #1129.