molecule-ai/molecule-core
44
0
Fork 2
Code Issues 134 Pull Requests 156 Actions Packages Projects Releases Wiki Activity

fix(provisioner): skip symlinks in collectCPConfigFiles (OFFSEC-010) #1052

Closed
core-be wants to merge 1 commits from fix/offsec-010-from-pr1047 into main
pull from: fix/offsec-010-from-pr1047
merge into: molecule-ai:main
Conversation 3 Commits 1 Files Changed 2
+245 -22

1 Commits

Author SHA1 Message Date
core-be c51e0013ac fix(provisioner): skip symlinks in collectCPConfigFiles (OFFSEC-010)
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 26s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (pull_request) Has been skipped
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 1m18s
Details
CI / Detect changes (pull_request) Successful in 1m27s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 1m16s
Details
Harness Replays / detect-changes (pull_request) Successful in 23s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (pull_request) Successful in 1m4s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 26s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 1m2s
Details
qa-review / approved (pull_request) Failing after 28s
Details
security-review / approved (pull_request) Failing after 30s
Details
sop-checklist / na-declarations (pull_request) awaiting /sop-n/a declaration for: qa-review, security-review
Details
gate-check-v3 / gate-check (pull_request) Successful in 40s
Details
sop-tier-check / tier-check (pull_request) Successful in 22s
Details
sop-checklist / all-items-acked (pull_request) Successful in 24s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 56s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m29s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 10s
Details
CI / Python Lint & Test (pull_request) Successful in 10s
Details
Harness Replays / Harness Replays (pull_request) Successful in 9s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 1m49s
Details
E2E Staging External Runtime / E2E Staging External Runtime (pull_request) Successful in 5m37s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 6s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 4m8s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 8m53s
Details
audit-force-merge / audit (pull_request) Has been skipped
Details
CI / Platform (Go) (pull_request) Successful in 13m52s
Details
CI / Canvas (Next.js) (pull_request) Successful in 14m8s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / all-required (pull_request) Successful in 8s
Details 
OFFSEC-010: filepath.WalkDir descends into symlinks by default. A
malicious template could contain `ln -s /etc/passwd snapshot`, and
WalkDir would traverse it — the existing `../`/absolute-path guards in
addFile don't catch symlinks because the symlink path itself contains
no ".." or leading "/".

Fix: check d.Type()&os.ModeSymlink in the WalkDir callback and return
nil to skip symlinks before they are descended. d.Type() is a zero-cost
DirEntry attribute (no extra syscall).

Also add TestCollectCPConfigFiles_SkipsSymlinks regression test.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-14 17:53:48 +00:00