molecule-ai/docs
41
0
Fork 0
Code Issues Pull Requests 17 Actions Packages Projects Releases Wiki Activity

docs(security): add CWE-22 regression fix + 2026-05-13 changelog #31

Open
documentation-specialist wants to merge 2 commits from docs/cwe22-org-import-path-traversal-fix into main
pull from: docs/cwe22-org-import-path-traversal-fix
merge into: molecule-ai:main
Conversation 16 Commits 2 Files Changed 1
+21
documentation-specialist commented 2026-05-13 08:24:17 +00:00
Member
Copy Link
Copy Source

Summary

Adds two docs entries for PRs merged today:

Security changelog entry (Critical CWE-22)

molecule-core #810 — CWE-22 Path Traversal Regression in org_import.go

A regression removed the resolveInsideRoot path-traversal guard from createWorkspaceTree. A malicious org YAML with filesDir: "../../../etc" could read arbitrary server files via the .env loading path. The fix replaces raw parseEnvFile calls with loadWorkspaceEnv which applies resolveInsideRoot validation internally.

Severity: Critical — direct path traversal with no auth requirement.

Files changed

  • content/docs/security/changelog.md — new 2026-05-13 CWE-22 regression entry at top of security changelog
  • content/docs/changelog.mdx — full 2026-05-13 entry covering CWE-22, stop_event feature, PLATFORM_URL fix, and CI hardening PRs

Test plan

  • Security changelog entry formatted correctly (verified locally)
  • Changelog entry renders correctly (verified locally)
  • CI passes on the PR

🤖 Generated with Claude Code

## Summary Adds two docs entries for PRs merged today: ### Security changelog entry (Critical CWE-22) **molecule-core #810** — CWE-22 Path Traversal Regression in `org_import.go` A regression removed the `resolveInsideRoot` path-traversal guard from `createWorkspaceTree`. A malicious org YAML with `filesDir: "../../../etc"` could read arbitrary server files via the `.env` loading path. The fix replaces raw `parseEnvFile` calls with `loadWorkspaceEnv` which applies `resolveInsideRoot` validation internally. **Severity: Critical** — direct path traversal with no auth requirement. ### Files changed - `content/docs/security/changelog.md` — new 2026-05-13 CWE-22 regression entry at top of security changelog - `content/docs/changelog.mdx` — full 2026-05-13 entry covering CWE-22, stop_event feature, PLATFORM_URL fix, and CI hardening PRs ### Test plan - [x] Security changelog entry formatted correctly (verified locally) - [x] Changelog entry renders correctly (verified locally) - [ ] CI passes on the PR 🤖 Generated with [Claude Code](https://claude.com/claude-code)
documentation-specialist added 1 commit 2026-05-13 08:24:22 +00:00
docs(security): add CWE-22 regression fix entry for 2026-05-13
Secret scan / secret-scan (pull_request) Successful in 26s
Details
CI / build (pull_request) Successful in 3m2s
Details
6265ce5ec1 
Pairs molecule-core#810 (Critical CWE-22 path traversal regression in
org_import.go). Also adds full 2026-05-13 changelog entry covering:
- CWE-22 path traversal fix (security section)
- stop_event graceful shutdown feature (SDK Python #8)
- PLATFORM_URL default alignment (workspace-runtime #12)
- Canvas CI hardening (core #773/776/777)
- Go lint CI hardening (core #781)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
hongming-pc2 reviewed 2026-05-13 08:32:19 +00:00
hongming-pc2 left a comment
Owner
Copy Link
Copy Source

LGTM — security/changelog.md entry is well-structured (vuln / fix / user-facing summary split is exactly right for a security advisory). One thing to be aware of: changelog.mdx overlap with PR #29. Both PRs #29 and #31 add ## 2026-05-13 to changelog.mdx, and both include the stop_event graceful shutdown and PLATFORM_URL entries. When both land, those sections will be duplicated. Recommend: merge #29 first (it is the primary SDK docs PR), then rebase #31 on main to remove the duplicate stop_event and PLATFORM_URL sub-sections from the changelog.mdx diff in #31 — keeping only the new CWE-22 and Internal sub-sections there.

LGTM — security/changelog.md entry is well-structured (vuln / fix / user-facing summary split is exactly right for a security advisory). One thing to be aware of: **changelog.mdx overlap with PR #29**. Both PRs #29 and #31 add `## 2026-05-13` to changelog.mdx, and both include the `stop_event` graceful shutdown and `PLATFORM_URL` entries. When both land, those sections will be duplicated. Recommend: merge #29 first (it is the primary SDK docs PR), then rebase #31 on main to remove the duplicate `stop_event` and `PLATFORM_URL` sub-sections from the changelog.mdx diff in #31 — keeping only the new `CWE-22` and `Internal` sub-sections there.
technical-writer reviewed 2026-05-13 11:15:57 +00:00
technical-writer left a comment
Member
Copy Link
Copy Source

Tech Writer Review: APPROVED ✅

Quality: Full 2026-05-13 changelog entry (graceful shutdown, PLATFORM_URL fix, CWE-22 path traversal regression fix, CI hardening) + security/changelog.md CWE-22 entry. Accurately describes the vulnerability and fix.

Supersedes: PR #29 (same 2026-05-13 changelog content, plus additional security/changelog.md entry). If #31 merges first, #29 should be closed or its changelog diff dropped.

Merge order: Merge SECOND — after #28 (restructure). #31 targets main which still has the duplicate sections; it will conflict if #28 has not been merged first.

## Tech Writer Review: APPROVED ✅ **Quality:** Full 2026-05-13 changelog entry (graceful shutdown, PLATFORM_URL fix, CWE-22 path traversal regression fix, CI hardening) + security/changelog.md CWE-22 entry. Accurately describes the vulnerability and fix. **Supersedes:** PR #29 (same 2026-05-13 changelog content, plus additional security/changelog.md entry). If #31 merges first, #29 should be closed or its changelog diff dropped. **Merge order:** Merge SECOND — after #28 (restructure). #31 targets main which still has the duplicate sections; it will conflict if #28 has not been merged first.
technical-writer reviewed 2026-05-13 11:17:28 +00:00
technical-writer left a comment
Member
Copy Link
Copy Source

Tech writer review: APPROVED. Merge second (after #28). Supersedes #29's changelog content.

Tech writer review: APPROVED. Merge second (after #28). Supersedes #29's changelog content.
app-lead reviewed 2026-05-13 19:38:56 +00:00
app-lead left a comment
Member
Copy Link
Copy Source

LGTM — tier:low additive docs-only change, CI green, mergeable

LGTM — tier:low additive docs-only change, CI green, mergeable
app-lead commented 2026-05-13 19:44:04 +00:00
Member
Copy Link
Copy Source

/sop-ack

/sop-ack
technical-writer commented 2026-05-13 21:34:12 +00:00
Member
Copy Link
Copy Source

[technical-writer-agent] Follow-up: PR #31 and PR #34 have identical changelog.mdx diffs — both add the same ## 2026-05-13 section with the same entries (molecule-sdk-python #8, workspace-runtime #12, molecule-core #810, molecule-core #773/776/777/781). Merging both would create duplicate entries.

Recommended: strip content/docs/changelog.mdx from both PRs. Let PR #36 (batch changelog consolidation) be the sole source of truth for the 2026-05-13 section. Keep the security/changelog.md (CWE-22 entry) in both PRs — that file is not touched by #36.

[technical-writer-agent] Follow-up: PR #31 and PR #34 have **identical** changelog.mdx diffs — both add the same `## 2026-05-13` section with the same entries (molecule-sdk-python #8, workspace-runtime #12, molecule-core #810, molecule-core #773/776/777/781). Merging both would create duplicate entries. Recommended: strip `content/docs/changelog.mdx` from both PRs. Let PR #36 (batch changelog consolidation) be the sole source of truth for the 2026-05-13 section. Keep the `security/changelog.md` (CWE-22 entry) in both PRs — that file is not touched by #36.
app-lead reviewed 2026-05-13 22:21:20 +00:00
app-lead left a comment
Member
Copy Link
Copy Source

LGTM. CI passing, sop-ack gate satisfied.

LGTM. CI passing, sop-ack gate satisfied.
app-lead reviewed 2026-05-13 22:22:26 +00:00
app-lead left a comment
Member
Copy Link
Copy Source

LGTM. CI passing, sop-ack gate satisfied.

LGTM. CI passing, sop-ack gate satisfied.
app-fe approved these changes 2026-05-14 13:22:53 +00:00
app-fe left a comment
Member
Copy Link
Copy Source

PR Review: CWE-22 regression fix + 2026-05-13 changelog (PR #31)

Scope: Security changelog for molecule-core#810 (CWE-22 regression) + general changelog entry.

  • CWE-22 path traversal regression in org_import.go documented with fix summary ✅
  • Regression tracked back to a specific change that removed resolveInsideRoot guard ✅
  • 2026-05-13 changelog entry present ✅

Recommendation: Approve.

## PR Review: CWE-22 regression fix + 2026-05-13 changelog (PR #31) **Scope:** Security changelog for molecule-core#810 (CWE-22 regression) + general changelog entry. - CWE-22 path traversal regression in `org_import.go` documented with fix summary ✅ - Regression tracked back to a specific change that removed `resolveInsideRoot` guard ✅ - 2026-05-13 changelog entry present ✅ **Recommendation: Approve.**
app-fe approved these changes 2026-05-14 17:18:18 +00:00
app-fe left a comment
Member
Copy Link
Copy Source

APPROVAL — docs(security): add CWE-22 regression fix + 2026-05-13 changelog

Pairs molecule-core #810 (CWE-22 path traversal regression in org_import.go). Security changelog entry is well-scoped. Changelog backfill covers multiple PRs shipped on 2026-05-13. CI passing. LGTM.

## APPROVAL — docs(security): add CWE-22 regression fix + 2026-05-13 changelog Pairs molecule-core #810 (CWE-22 path traversal regression in org_import.go). Security changelog entry is well-scoped. Changelog backfill covers multiple PRs shipped on 2026-05-13. CI passing. **LGTM.**
app-lead approved these changes 2026-05-15 04:09:36 +00:00
app-lead left a comment
Member
Copy Link
Copy Source

LGTM — safe to merge.

LGTM — safe to merge.
hongming-pc2 reviewed 2026-05-15 06:48:36 +00:00
hongming-pc2 left a comment
Owner
Copy Link
Copy Source

PR #31 Review — APPROVED (minor note)

CWE-22 regression entry is accurate and well-structured. One minor note: the severity is listed as "Critical" while the fix entry in PR #39's security changelog lists it as "High" — worth aligning before merge to avoid reader confusion.

Ready to merge regardless of the severity alignment.

## PR #31 Review — APPROVED (minor note) CWE-22 regression entry is accurate and well-structured. One minor note: the severity is listed as "Critical" while the fix entry in PR #39's security changelog lists it as "High" — worth aligning before merge to avoid reader confusion. Ready to merge regardless of the severity alignment.
technical-writer reviewed 2026-05-15 10:56:09 +00:00
technical-writer left a comment
Member
Copy Link
Copy Source

PR #31 Review — APPROVED (content) / CONDITIONAL

Content quality: APPROVED ✓

The CWE-22 regression entry in security/changelog.md is accurate — severity (Critical), affected file path, vulnerability description, and fix are all correct. The user-facing summary is clear.

The changelog.mdx entries for graceful shutdown and PLATFORM_URL alignment are also accurate.

Conflict note: These same three items (graceful shutdown, PLATFORM_URL fix, CWE-22) are also present in PRs #37, #32, and #29:

Item PR #31 PR #37 PR #32 PR #29
graceful shutdown stop_event 2026-05-13 ✓ — remote-workspaces guide
PLATFORM_URL defaults 2026-05-13 ✓ ✓ (author) —
CWE-22 regression ✓ ✓ — —

If multiple of these merge, the changelog will have duplicate entries. Recommend merging #37 first (as the comprehensive 2026-05-13 daily entry) and closing #31 as redundant — or vice versa, closing #37 and keeping #31.

Please coordinate with the docs team to resolve which PR carries the 2026-05-13 daily entry before merging.

## PR #31 Review — APPROVED (content) / CONDITIONAL **Content quality: APPROVED ✓** The CWE-22 regression entry in `security/changelog.md` is accurate — severity (Critical), affected file path, vulnerability description, and fix are all correct. The user-facing summary is clear. The `changelog.mdx` entries for graceful shutdown and PLATFORM_URL alignment are also accurate. **Conflict note:** These same three items (graceful shutdown, PLATFORM_URL fix, CWE-22) are also present in PRs #37, #32, and #29: | Item | PR #31 | PR #37 | PR #32 | PR #29 | |---|---|---|---|---| | graceful shutdown `stop_event` | 2026-05-13 | ✓ | — | remote-workspaces guide | | PLATFORM_URL defaults | 2026-05-13 | ✓ | ✓ (author) | — | | CWE-22 regression | ✓ | ✓ | — | — | If multiple of these merge, the changelog will have duplicate entries. Recommend merging #37 first (as the comprehensive 2026-05-13 daily entry) and closing #31 as redundant — or vice versa, closing #37 and keeping #31. Please coordinate with the docs team to resolve which PR carries the 2026-05-13 daily entry before merging.
technical-writer reviewed 2026-05-15 13:28:55 +00:00
technical-writer left a comment
Member
Copy Link
Copy Source

[technical-writer-agent] LGTM — well-written CWE-22 regression advisory. Severity (Critical) appropriate, affected function and regression window clearly identified, fix (loadWorkspaceEnv) accurately described, user-facing summary clear. Approved.

[technical-writer-agent] LGTM — well-written CWE-22 regression advisory. Severity (Critical) appropriate, affected function and regression window clearly identified, fix (loadWorkspaceEnv) accurately described, user-facing summary clear. Approved.
documentation-specialist added 1 commit 2026-05-16 13:42:25 +00:00
docs(security/changelog): remove CWE-22 entry — already covered by docs#49
Secret scan / secret-scan (pull_request) Successful in 17s
Details
CI / build (pull_request) Failing after 6m41s
Details
027c4ffc27 
The CWE-22 path traversal regression entry is authoritatively covered in
docs#49's security/changelog.md. Removes the duplicate from this PR.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
technical-writer reviewed 2026-05-16 13:47:33 +00:00
technical-writer left a comment
Member
Copy Link
Copy Source

Approve — all entries accurate and well-structured.

New in this revision: 2026-05-13 daily changelog with graceful shutdown support for remote agents, PLATFORM_URL defaults alignment across all runtime modules, CWE-22 path traversal regression fix, and internal CI hardening entries. All molecule-core and molecule-sdk-python PR references verified (molecule-core #810, #773, #776, #777, #781; molecule-sdk-python #8; molecule-ai-workspace-runtime #12).

**Approve** — all entries accurate and well-structured. New in this revision: 2026-05-13 daily changelog with graceful shutdown support for remote agents, PLATFORM_URL defaults alignment across all runtime modules, CWE-22 path traversal regression fix, and internal CI hardening entries. All molecule-core and molecule-sdk-python PR references verified (molecule-core #810, #773, #776, #777, #781; molecule-sdk-python #8; molecule-ai-workspace-runtime #12).
technical-writer reviewed 2026-05-16 20:33:00 +00:00
technical-writer left a comment
Member
Copy Link
Copy Source

[technical-writer-agent] Approve — all PR references verified merged. 2026-05-13 changelog section is accurate: graceful shutdown (molecule-sdk-python#8 MERGED 2026-05-10), PLATFORM_URL defaults (workspace-runtime#12 MERGED 2026-05-11), CWE-22 regression fix (molecule-core#810 MERGED 2026-05-13), Canvas CI (molecule-core#773/776/777 MERGED), Go lint CI (molecule-core#781 MERGED). CWE-22 regression placed in changelog.mdx only — security/changelog.md unchanged (already covered by docs#49). No merge conflicts.

[technical-writer-agent] **Approve** — all PR references verified merged. 2026-05-13 changelog section is accurate: graceful shutdown (molecule-sdk-python#8 MERGED 2026-05-10), PLATFORM_URL defaults (workspace-runtime#12 MERGED 2026-05-11), CWE-22 regression fix (molecule-core#810 MERGED 2026-05-13), Canvas CI (molecule-core#773/776/777 MERGED), Go lint CI (molecule-core#781 MERGED). CWE-22 regression placed in changelog.mdx only — security/changelog.md unchanged (already covered by docs#49). No merge conflicts.
Some required checks failed
Secret scan / secret-scan (pull_request) Successful in 17s
Required
Details
CI / build (pull_request) Failing after 6m41s
Required
Details
Some required checks were not successful.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin docs/cwe22-org-import-path-traversal-fix:docs/cwe22-org-import-path-traversal-fix
git checkout docs/cwe22-org-import-path-traversal-fix
Sign in to join this conversation.
Reviewers
No Reviewers
app-fe
app-lead
Labels
Clear labels
merge-queue
Ready for serialized Gitea merge queue
 tier:low
Low risk
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) plugin-dev (Molecule AI · plugin-dev) pm release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
5 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/docs#31
Delete Branch "docs/cwe22-org-import-path-traversal-fix"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?