🔒 [보안] CLI 무제한 파일 읽기 취약점 수정

[seonghobae]

Security and availability boundary

The CLI treats each explicit input source as a bounded, fail-closed authority boundary. This canonical branch hardens stdin, inline --job, and file-backed --job handling without changing dependency, database, model, connector, or review-credential state.

Protected base: develop@749511c3ad4000090048718f685c6bee6b3d2c25.
Exact current head: df15438083d4d79417128033af3b6c4b686b35b4.

Current implementation

• Bounds process stdin to MAX_JSON_FILE_SIZE + 1 raw bytes before UTF-8 decode / JSON parsing.
• Bounds inline and file-backed jobs by UTF-8 bytes.
• Rejects invalid UTF-8 and surrogate-bearing inline argv payloads with the stable payload-safe error Job input must be valid UTF-8.
• Resolves --status and explicit --job before touching stdin; malformed explicit invocations fail immediately.
• Preserves RFC 8259 whitespace-prefixed inline JSON while treating non-JSON Unicode whitespace as filename data.
• Rejects UNC/network roots, Win32 device namespaces, drive-relative paths, NTFS alternate-stream syntax, reserved DOS filenames, CONIN$ / CONOUT$ console handles, fail-closed legacy CLOCK$, and relevant Win32 leading/trailing-space normalization ambiguity before filesystem authority is acquired.
• Keeps those Win32 lexical classes distinct for diagnostics: naming-a-file reserved filenames, console handles, legacy device, drive-relative, UNC/device namespace, and alternate streams all fail before os.lstat / os.open.
• Classifies CONIN$ / CONOUT$ from the 2021-12-30 console-handles contract, not the naming-a-file reserved list. Trailing-colon forms such as CONOUT$: stay console handles.
• Fail-closes legacy CLOCK$ as its own class. Drive-relative jobs such as C:job.json fail before lstat.
• Logs only the lexical authority class through a Strix-matching path variable. Rejected job paths are never echoed.
• Normalizes / to \\ only for UNC/device-namespace lexical classification, so mixed-separator forms cannot bypass pre-open rejection.
• Opens accepted local files with O_RDONLY plus O_CLOEXEC, O_NOFOLLOW, and O_NONBLOCK where available, then revalidates the obtained descriptor as the same regular-file inode before bounded reads. Windows opens also request O_BINARY so descriptor reads preserve raw job bytes.

Regression-first repairs

8f0eda3 and 6ccb40cb collapsed console handles and CLOCK$ back into the naming-a-file reserved list, deleted the lexical classifier, and logged rejected paths. Predecessor restore a60e551c2e625c7f99831e940e23254be0f0467f and later 54c645c9dcace65dca4e5bb669a665480a26dcb7 are historical evidence only.

7d415390e966f29491d39778102c702d3f874c74 repeated that collapse. d29a0b36658e22ca04dbe1427db5a32a472d4a20 restored the distinct classifier. Later heads fac99fb/d755202/107fc2b/7d92ff9 re-collapsed CONIN$/CONOUT$/CLOCK$ into one reserved-name bucket, deleted test_cli_job_console_handle_authority.py, and echoed rejected paths.

Exact current head df15438083d4d79417128033af3b6c4b686b35b4 restores the distinct classifier, class-only diagnostics via a Strix-matching path variable that holds the lexical class rather than the user path, the console-handle regression suite, playable-range copy on AGENTS/ARCHITECTURE, and inherited #783 npm/PDF.js/Undici evidence. Do not suppress inherited #783 npm HIGH on this branch.

Predecessor-head reviews remain predecessor evidence. There is no qualifying independent non-author exact-head approval.

Dependency / merge gate

• fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 is now protected develop shipped truth rather than an outstanding dependency-security prerequisite. This branch is based on that integrated security baseline; do not reuse pre-fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 inherited audit failures as current evidence.
• Keep unmerged until the unchanged then-current head has every applicable repository/central CI, cross-platform build, exact owned statement+branch coverage, docstring, SAST/security/SBOM/supply-chain/package/release gate terminal-success; zero valid unresolved findings; a qualifying independent non-author last-push approval; and ordinary branch-protection acceptance.
• Queued, pending, skipped, cancelled, failed, predecessor-head, protected-base, model-only, self/author, or administrative-bypass evidence is not success.
• Never bypass protection or transfer predecessor evidence.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

CLI의 stdin, 인라인 작업, 작업 파일 입력에 UTF-8 바이트 기준 10MB 제한을 추가했습니다. 잘못된 인자와 권한 없는 작업 파일을 거부합니다. 직접적인 TemporalAnalyzer 실행 로직은 제거하고 호환성 별칭은 유지합니다.

Changes

CLI 입력 및 작업 파일 검증

Layer / File(s)	Summary
입력 제한 및 CLI 오케스트레이션 services/analysis-engine/src/bandscope_analysis/cli.py	stdin, 인라인 --job, 작업 파일 입력에 10MB 바이트 제한을 적용합니다. UTF-8 오류와 잘못된 인자를 구조화된 오류로 반환합니다. 직접적인 TemporalAnalyzer 실행 경로를 제거하고 별칭을 유지합니다.
작업 파일 권한 검증 services/analysis-engine/src/bandscope_analysis/cli.py, services/analysis-engine/tests/test_cli_job_*, docs/doctoring/cli-job-file-authority.md, AGENTS.md, ARCHITECTURE.md	UNC, 장치 경로, 드라이브 상대 경로, 예약 파일명, 콘솔 핸들, 디렉터리, 심볼릭 링크와 비정규 파일을 거부합니다. lstat() 및 fstat() 결과와 inode를 비교한 뒤 제한된 바이트를 읽습니다.
입력 및 인자 회귀 검증 services/analysis-engine/tests/test_cli_input_bounds.py, services/analysis-engine/tests/test_cli_unknown_arguments.py, services/analysis-engine/tests/test_cli.py	stdin, 인라인 작업, 작업 파일의 크기와 UTF-8 경계를 검증합니다. 명시적 인자와 잘못된 인자가 stdin을 소비하지 않는지 검증합니다.
변경 기록 및 운영 규칙 CHANGELOG.md, AGENTS.md, ARCHITECTURE.md, docs/doctoring/cli-job-file-authority.md	CLI 입력 검증과 작업 파일 권한 경계의 변경 사항을 기록합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟡 Moderate · up to 72748

The CLI still misclassifies CONOUT$: as an alternate stream before applying console-handle validation, causing the required regression test to fail at the current head. Merge should wait for the classification-order fix and passing regression; documentation and test-coverage follow-up also remain.

Sequence Diagram(s)

sequenceDiagram
  participant InputSource
  participant cli_main
  participant JobFile
  participant JSONParser
  InputSource->>cli_main: stdin, inline --job, or job file argument
  cli_main->>cli_main: validate explicit arguments
  cli_main->>JobFile: bounded regular-file read with identity checks
  JobFile-->>cli_main: bounded UTF-8 bytes
  cli_main->>JSONParser: decode and parse JSON
  JSONParser-->>cli_main: parsed job or structured error

Loading

Possibly related issues

• [Security] Rebuild cross-platform filesystem path containment boundary #852: Windows 경로, UNC/device 경로, 예약 이름과 심볼릭 링크 경계를 파일 접근 전에 검증하는 변경과 직접 관련됩니다.
• fix(reliability): reject non-regular Office CLI request files before read inkspan#346: FIFO와 특수 파일을 읽기 전에 일반 파일로 제한하는 변경과 관련됩니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 96.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 CLI의 무제한 파일 읽기 취약점 수정이라는 주요 변경 사항을 명확하고 간결하게 설명합니다.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-cli-unbounded-read-5165758910965089497

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head ec183bf199e0e82b6c29d6c2a01b795e31746e97.

• Head SHA: ec183bf199e0e82b6c29d6c2a01b795e31746e97

• Workflow run: 31338219474

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Test (2 files)"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test (2 files)"]
  R2 --> V2["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 87f76b6cd8a62488d701cf605b36e2122c988273
• Workflow run: 32809787207
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 87f76b6cd8a62488d701cf605b36e2122c988273.

• Head SHA: 87f76b6cd8a62488d701cf605b36e2122c988273

• Workflow run: 32809787207

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs: cli-job-file-authority.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: cli-job-file-authority.md"]
  R2 --> V2["docs review"]
  Evidence --> S3["Test (7 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (7 files)"]
  R3 --> V3["targeted test run"]

Loading

[seonghobae]

@opencode-agent Please rerun the coverage/review contract on exact current head e156cf00cee63068e098137c6d2cf2d1c2a55aea. The branch now differs from protected develop in exactly the intended three CLI bounded-read files; unrelated .trivyignore, pdfjs-dist, and root lock drift was restored from the base. Treat predecessor-head ec183bf199e0e82b6c29d6c2a01b795e31746e97 review evidence as historical and publish current-head coverage/docstring evidence before changing review state.

[seonghobae]

Re-review request for exact head 6fca12a1f3000879769da76cd92b3bbeb366da0c: all required status contexts are green on this head (including coverage-evidence and security scans) and all review threads are resolved. @opencode-agent please review current head 6fca12a1f3000879769da76cd92b3bbeb366da0c and update the review decision.

[seonghobae]

Current-base reconstruction finding for exact head 7d415390e966f29461d39778102c702d3f874c74 against protected develop@7ad56cf0065d068ec6463d92726de4855a6e201d: the live diff now reintroduces pre-#783 workflow/toolchain state across .github/workflows/{ci,build-baseline,release,security-audit}.yml and related npm/PDF/security files. It removes gate / ci / npm-lock-validation, pinned npm 10.9.9 activation/verification, checkout persist-credentials: false, and changes setup-node back to mutable npm caching. Those regressions are outside #811's bounded CLI input-authority scope and roll back already-shipped protected dependency/security controls.

Please reconstruct this canonical branch from the current protected base while preserving only #811's unique CLI bounded-read / Win32 lexical-authority behavior and its focused regressions/docs. Acceptance: protected workflow/toolchain/PDF/dependency-security files are byte-equivalent to current develop unless #811 has a separately justified unique change; the CLI stdin/inline/file bounds, UTF-8, path classification, descriptor revalidation, class-only diagnostics, and their tests remain; frozen npm/security/supply-chain checks run on the resulting exact head. Do not suppress or roll back the #783 baseline to make this branch green.

[opencode-agent]

Queued @opencode-agent for PR #811 at head d75520276ba8a8f6add4926ccc0c2f822f3d91d4. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.