🛡️ Sentinel: [HIGH] Harden account_manager against path traversal and symlink hijacking - #422
Conversation
… symlink hijacking - Sanitize account_name inputs using regex validation in cli-synthegration/account_manager.py - Add symlink safety checks before changing file permissions and reading/writing credential configs - Update test suite module import handlers to support flexible PYTHONPATH execution - Add comprehensive security test suite in tests/test_account_manager_privileges.py
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Mention Blocks like a regular teammate with your question or request: @blocks review this pull request Run |
github-project-automation
Bot
moved this to Todo
in @timerloggedout-spec's untitled project team planning
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
timerloggedout-spec
left a comment
timerloggedout-spec
left a comment
There was a problem hiding this comment.
OPERATOR review — APPROVE
Reviewed as Grok (Administrator) against Issue #175 P1 Sentinel hygiene.
Evidence
- HIGH path-traversal + symlink hijack on
cli-synthegration/account_manager.py SAFE_ACCOUNT_REGEXrejects../, absolute paths, spaces, injection chars- Fail-closed symlink checks on
CONFIG_DIRand account config files before chmod/write/read - New
tests/test_account_manager_privileges.pyplus fallback import resolvers so existing privilege tests still collect - Dual gates:
hygiene + portability gatesuccess,agentic termux smokesuccess, CodeQL (python/js/actions) success - Scope is 5 files / +164 −20 — small green, master-based, not a dirty mega-PR
Disposition: merge with merge method. Does not wholesale-merge PR #6 or #2.
Follow-up (not blocking): Team MVT lane a-ox-openrouter still hard-exits when Ox Alpha is absent from the live catalog. Next thin PR will fail-soft that lane like Felo.
Implements: sentinel-account-manager-hardening (P1 under #175)
Signed-off-by: Grok (OPERATOR)
github-project-automation
Bot
moved this from Todo
to In progress
in @timerloggedout-spec's untitled project team planning
github-project-automation
Bot
moved this from In progress
to Done
in @timerloggedout-spec's untitled project team planning
This branch was successfully deployed
1 participant
🛡️ Sentinel Security Improvement Report:
🚨 Severity: HIGH
💡 Vulnerability: Unsanitized account names in
cli-synthegration/account_manager.pycould allow path traversal vectors (../,/etc/), and missingis_symlink()checks onCONFIG_DIRand account config files allowed potential symlink traversal hijacking vulnerabilities.🎯 Impact: An attacker could craft account names or place symlinks in
.deepclito overwrite or leak sensitive credentials or system files.🔧 Fix:
^[a-zA-Z0-9_-]+$) onaccount_nameparameters inimport_accountandget_token.is_symlink()onCONFIG_DIRand account target files prior toos.chmodand file write/read operations.tests/test_sentinel_privileges.py,tests/test_nexuscli_privileges.py,tests/test_multi_ai_cache_privileges.py) with fallback module import resolvers.tests/test_account_manager_privileges.py.✅ Verification: Ran
pytest tests/test_sentinel_privileges.py tests/test_nexuscli_privileges.py tests/test_multi_ai_cache_privileges.py tests/test_account_manager_privileges.py tests/test_obsidian_server_security.py tests/test_deepcli_waf_session.pywith 23/23 tests passing.PR created automatically by Jules for task 5763956158267051655 started by @timerloggedout-spec