fix(desktop): trust boundary for workspace setup/teardown lifecycle commands (GHSA-h3q4-r3jv-gmj2, GHSA-hf7c-jmhj-qghw)

Merged
KI
1mo ago
+374-36

Summary

A worktree/PR-branch .superset/config.json could feed setup, teardown, run and cwd (only config.local.json was ignored), so opening/deleting a workspace from an attacker's branch executed attacker-controlled commands.

Fix (well-factored)

Centralized provenance trust boundary in the shared resolver (lifecycle-trust); setup and teardown share one safe execution path.

Proof

Exploit PoC 0 pass/2 fail (RCE) → 2/0; lifecycle suites 59/9 → 68/0; full desktop suite 7635 pass; typecheck + biome clean.
Write-up: https://app.superset.sh/page/p1-c-attacker-controlled-lifecycle-command-executi-8cra8h

Residual

Branch-controlled script body risk documented (not fixed); advisory prose was unreadable (403), so verification is title-vs-code.

Merge note

Squash-merge only (earlier commits held local repro artifacts, now untracked).

Summary by cubic

Fixes a command injection vulnerability (GHSA-h3q4-r3jv-gmj2, GHSA-hf7c-jmhj-qghw) where .superset/config.json from a worktree could steer lifecycle commands. Previously, opening or deleting a workspace from an attacker's pull request ran attacker-controlled setup or teardown with the victim's shell and privileges; commands and cwd are now honored only from sources the local user controls — the user override, the main repo, and its local overlay.

Fix

  • Centralizes the trust boundary in a shared lifecycle-trust module used by setup and teardown.
  • Worktree configs contribute no executable fields, and dropped keys fall back to the trusted config underneath.
  • Trust follows the read path, not the filename — a force-added config.local.json in a worktree is discarded whole.
  • Rejected fields are surfaced on resolveLifecycleConfig().rejected for a future consent prompt.

Residual risk

  • A trusted command like .superset/setup.sh still runs the branch's copy of that script.
  • Closing this needs a user-consent flow, tracked in evidence/residual-risk.md.

Summary by CodeRabbit

  • Security
    • Workspace lifecycle commands from worktree configuration can no longer add or override trusted setup, run, teardown, or working-directory settings.
    • Trusted configuration takes precedence for lifecycle commands, while other worktree settings can still be used.
    • Rejected lifecycle settings are reported with warnings.