diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 1600d4323..24c6c3b48 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -127,3 +127,11 @@ **Vulnerability:** The `/api/v1/webhook` POST endpoint in `appguardrail_core/controlplane.py` failed to validate the `url` property when accepting it into the database, leading to Stored SSRF risks. In addition, the core SSRF validation logic (`_is_safe_url`) in both the CLI and control-plane did not verify the input type (e.g. `isinstance(url, str)`). Passing non-string types (like integers) resulted in unhandled `AttributeError` exceptions inside `urllib.parse.urlparse`, which led to API 500 crashes on malicious JSON payloads. **Learning:** Network endpoints must explicitly validate the data type of user-provided configurations prior to execution or storage. Furthermore, webhooks configured by users should always be checked for SSRF when saved, as trusting them later assumes input has already been safely validated, bypassing downstream network guardrails. **Prevention:** Apply `_is_safe_url` checks directly upon ingestion (e.g., in `/api/v1/webhook`) and enforce type checks `if not isinstance(url, str): return False` prior to using library parsing functions like `urlparse`. Always return gracefully failing responses (like `400 Bad Request`) for unsafe URLs instead of allowing unhandled 500 server errors. +## 2026-08-05 - Missing os.system command injection detection +**Vulnerability:** The static analysis scanner's `python-command-injection` rule failed to detect command injections via `os.system` and `os.popen`. +**Learning:** The previous regular expression assumed `os.system` and `os.popen` accepted a `shell=True` argument similar to `subprocess.run`, leading to false negatives as they execute via the shell implicitly and don't accept `shell=True`. +**Prevention:** Ensure static analysis regex rules handling different APIs group them accurately according to their respective signatures rather than merging them under a single mandatory condition (like `shell=True`). Added tests to prevent regression. +## 2026-08-05 - Missing os.system command injection detection +**Vulnerability:** The static analysis scanner's `python-command-injection` rule failed to detect command injections via `os.system` and `os.popen`. +**Learning:** The previous regular expression assumed `os.system` and `os.popen` accepted a `shell=True` argument similar to `subprocess.run`, leading to false negatives as they execute via the shell implicitly and don't accept `shell=True`. +**Prevention:** Ensure static analysis regex rules handling different APIs group them accurately according to their respective signatures rather than merging them under a single mandatory condition (like `shell=True`). Added tests to prevent regression. diff --git a/CHANGELOG.d/1004-cryptography-cve-2026-69247.md b/CHANGELOG.d/1004-cryptography-cve-2026-69247.md deleted file mode 100644 index eba56cfae..000000000 --- a/CHANGELOG.d/1004-cryptography-cve-2026-69247.md +++ /dev/null @@ -1,3 +0,0 @@ -### Changed - -- The hash-pinned release lock now resolves `cryptography==50.0.0`, closing the affected Bleichenbacher PKCS#7 EnvelopedData oracle version window (`>=44,<50`) reported by Dependabot alert #1 / CVE-2026-69247; the lock was regenerated per `docs/release-automation.md` (#1004, ref #1033). diff --git a/CHANGELOG.d/1031-malicious-shared-skill-threats.md b/CHANGELOG.d/1031-malicious-shared-skill-threats.md deleted file mode 100644 index 28763f239..000000000 --- a/CHANGELOG.d/1031-malicious-shared-skill-threats.md +++ /dev/null @@ -1,3 +0,0 @@ -### Added - -- The threat inventory now registers two observed shared-skill threats: a homoglyph-named prompt-injection skill whose body ordered safety-rule bypass and file-content exfiltration, and an unrendered placeholder template that polluted discovery. Controls point to deny-listed sync with exact alias matching and untrusted-catalog handling (#1031). diff --git a/CHANGELOG.md b/CHANGELOG.md index 110a549d8..4d9f227e5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ - 대시보드 검색창 커서 유지 — 검색어 중간에서 텍스트를 수정할 때마다 커서가 검색어의 맨 끝으로 점프하는 불편함을 수정했습니다. 이제 입력창의 커서 위치(`selectionStart`/`selectionEnd`)가 동적 렌더링 이후에도 원래 위치에 정확히 유지되어 자연스러운 타이핑 경험을 제공합니다. ### 보안 +- Python 명령 주입 탐지가 `os.system`·`os.popen`의 암묵적 셸 실행과 `subprocess(..., shell=True)`를 정확히 구분해 설명하고, AST 기반으로 임의 깊이의 중첩된 명령 생성 호출 뒤 `shell=True`까지 탐지하도록 보강했습니다. 각 API와 비셸 `subprocess` 음성 사례를 독립 회귀로 검증합니다. - 리포트 출력 하드닝 — 생성된 markdown 리포트가 HTML로 렌더될 때 악성 finding 내용(예: 외부 엔진이 스캔한 코드의 `