security: validate version_files paths against traversal (Sprint 5 security audit finding) #181

New issue

Closed

opened 2026-06-27 12:11:13 +02:00 by quartermaster · 0 comments

quartermaster commented

2026-06-27 12:11:13 +02:00

Owner

Audit finding

Sprint 5 security audit (#156) flagged a low-medium severity path traversal vector in scripts/manifest-check.sh:112-139:

The version_files: config field accepts arbitrary paths without ../ rejection. A malicious config like version_files: [../../../../etc/passwd] would be read + text-parsed by manifest-check.sh, potentially leaking file contents.

Severity assessment

LOW-MEDIUM:

Only file CONTENT extraction, no execution
Affects only repos where the operator has authored a malicious config
PR review would catch a ../-bearing path before merge
Information disclosure scope is bounded to the runner's filesystem accessible by the workflow user

The realistic exploit surface: a malicious PR that adds version_files: [../../some/secret] to release-toolkit.yml, which gets merged and the next cut leaks the file contents to the rolling PR body or release notes.

Mitigations

Reject paths containing ../ in config.sh's version_files parser
Reject absolute paths (/etc/passwd)
Bound to the consumer repo root (resolve + check against git rev-parse --show-toplevel)

Plus bats coverage for the new rejection paths.

Composition

Sister of the sed-injection tracker (other Sprint 5 security finding)
Both should ship together as a single "audit-finding-remediation" PR for cleaner cycle accounting

What this PR will NOT do

Will NOT change version_files semantics for legitimate paths
Will NOT block paths like subdir/VERSION (those are valid within the consumer repo)
Will NOT add a sandbox for manifest-check.sh (path validation is sufficient)

Refs

Sprint 5 #156 security audit
scripts/manifest-check.sh lines 112-139 (the audit finding's location)
scripts/lib/config.sh (the validation site)

## Audit finding Sprint 5 security audit (#156) flagged a low-medium severity path traversal vector in `scripts/manifest-check.sh:112-139`: The `version_files:` config field accepts arbitrary paths without `../` rejection. A malicious config like `version_files: [../../../../etc/passwd]` would be read + text-parsed by `manifest-check.sh`, potentially leaking file contents. ## Severity assessment LOW-MEDIUM: - Only file CONTENT extraction, no execution - Affects only repos where the operator has authored a malicious config - PR review would catch a `../`-bearing path before merge - Information disclosure scope is bounded to the runner's filesystem accessible by the workflow user The realistic exploit surface: a malicious PR that adds `version_files: [../../some/secret]` to `release-toolkit.yml`, which gets merged and the next cut leaks the file contents to the rolling PR body or release notes. ## Mitigations 1. **Reject paths containing `../`** in `config.sh`'s `version_files` parser 2. **Reject absolute paths** (`/etc/passwd`) 3. **Bound to the consumer repo root** (resolve + check against `git rev-parse --show-toplevel`) Plus bats coverage for the new rejection paths. ## Composition - Sister of the sed-injection tracker (other Sprint 5 security finding) - Both should ship together as a single "audit-finding-remediation" PR for cleaner cycle accounting ## What this PR will NOT do - Will NOT change `version_files` semantics for legitimate paths - Will NOT block paths like `subdir/VERSION` (those are valid within the consumer repo) - Will NOT add a sandbox for `manifest-check.sh` (path validation is sufficient) ## Refs - Sprint 5 #156 security audit - `scripts/manifest-check.sh` lines 112-139 (the audit finding's location) - `scripts/lib/config.sh` (the validation site)

quartermaster referenced this issue

2026-06-27 12:13:37 +02:00

docs: refresh README + integration.md to v0.13.0 (closes #182) #183

~~quartermaster referenced this issue 2026-06-27 14:27:35 +02:00~~

chore(release): v0.13.2 #189

quartermaster self-assigned this

2026-06-27 14:28:24 +02:00

quartermaster referenced this issue from a commit

2026-06-27 14:32:27 +02:00

fix(config): reject path-traversal in version_files (closes #181)

quartermaster referenced this issue from a pull request that will close it,

2026-06-27 14:32:47 +02:00