fix(security): close two open GitHub Security Advisories#9281
Open
JSONbored wants to merge 2 commits into
Open
fix(security): close two open GitHub Security Advisories#9281JSONbored wants to merge 2 commits into
JSONbored wants to merge 2 commits into
Conversation
Confirmed via a clean origin/main checkout that 8 test files (12 test cases) were failing independently of any in-flight PR. Root causes, all real bugs or stale test assertions from recent merges: 1. linked-issue-label-propagation-fetch.ts: a merge-conflict resolution's fix (the direct-ownership-match exemption from the reward-label satisfaction-verdict check, #9161/#9077) was verified locally but never actually committed before its branch was pushed -- silently lost. Re-applied. 2. config-lint.ts's mergeReadinessCompositeWarnings fired even when gate.mergeReadiness is explicitly "off", which is a genuine no-op and never worth warning about -- only null/unset and off should both short-circuit. 3. predicted-gate-engine.test.ts asserted gateMode(undefined) === "advisory", the pre-#9167 fallback; #9167 intentionally made this fail closed ("block") for a malformed value. Test updated to match. 4. loopover-engine-scaffold.test.ts asserted a stale package.json "files" shape; #9064's engine-coverage work legitimately changed it to source-map-friendly glob patterns. Test updated to match. 5. The "merge-readiness-composite-preserves-explicit-block" engine-parity fixture encoded a "composite only fills in an unset sub-gate" semantic that was deliberately reverted (see applyMergeReadinessGate's own doc comment: unreachable in practice, since every sub-gate mode is already a concrete DB-defaulted value by the time it reaches GateCheckPolicy). Renamed and corrected to assert the actual (override) behavior, with a fresh golden recorded via scripts/record-engine-parity-goldens.ts. queue-5.test.ts's REGRESSION (#4528) test hit the same reward-label gate from a different angle and needed the same two assertions corrected. 6. reputation-wiring.test.ts's seedReviewTarget helper still wrote into review_targets, frozen by the 2026-06-22 convergence cutover (#9136 repointed getSubmitterReputation/getSubmitterReputationAcrossInstall onto the live review_audit ledger, but this test helper was never updated to match). Rewritten to seed review_audit + pull_requests directly, mirroring submitter-reputation.ts's own query shape; also registered the synthetic repos an install-wide test needs (the cross-repo query joins on repositories.installation_id) and repointed a stale review_targets backdating UPDATE at pull_requests (#9015 already repointed the cadence query itself).
GHSA-v6v4-mh5m-5mqq: the miner-ui dev/preview auth middleware stamped its Set-Cookie session token on every response that wasn't itself rejected -- including a wholly unauthenticated GET / and every static asset. Any local process (not just a browser) could curl the root path and read a valid, replayable token, then use it against the mutating /api/* routes. Replaced with a one-shot bootstrap path (visit ?token=<value> printed to the server's own stdout/journal once per process start) -- the cookie is now only ever (re)stamped on a request that already proves it holds the token. Also switched the cookie comparison to a constant-time equality check. GHSA-v3j4-j27j-fxw6: eleven MCP tools accepted a caller-supplied baseRef with no leading-dash guard, passed positionally to git before any terminator -- a ref starting with '-' (e.g. "--output=/some/path") is parsed by git as an option, not a revision, letting overwrite an arbitrary file silently (gitOutput swallows all errors). Rejects any leading-dash ref at the choke point in collectLocalBranchMetadata (defense in depth alongside the zod schema layer), adds --end-of-options to every git invocation taking a caller-supplied ref, and pre-resolves baseRef to a real SHA once so only that SHA -- never the raw string -- reaches every downstream git call.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
loopover-ui | a445c1c | Commit Preview URL Branch Preview URL |
Jul 27 2026, 11:17 AM |
❌ 5 Tests Failed:
View the top 3 failed test(s) by shortest run time
View the full list of 1 ❄️ flaky test(s)
To view more test analytics, go to the Test Analytics Dashboard |
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
loopover-orb
Bot
added
the
gittensor:bug
Contributor
|
Caution 🛑 LoopOver review result - fixes requiredReview updated: 2026-07-27 11:43:51 UTC
Review summary Nits — 4 non-blocking
Why this is blocked
📋 Copy for AI agents — paste into your coding agentCI checks failing
Decision drivers
Context & advisory signals — never blocks the verdict
Review context
Contributor next steps
Signal definitions
🧪 Chat with LoopOverAsk LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.
Full command reference: https://loopover.ai/docs/loopover-commands 🧪 Experimental — new and may change. Visual preview
Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy. Scroll preview
A short scroll-through clip (desktop) — click either thumbnail to open the full animation. Evidence for scroll-linked behavior a single screenshot can't show. 🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed 💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →. Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GHSA-v6v4-mh5m-5mqq — the miner-ui dev/preview auth middleware stamped its
Set-Cookiesession token on every response that wasn't itself rejected, including a wholly unauthenticatedGET /and every static asset. Any local process (not just a browser) couldcurlthe root path and read a valid, replayable token, then use it against the mutating/api/*routes. Replaced with a one-shot bootstrap path (visit?token=<value>printed to the server's own stdout/journal once per process start) — the cookie is now only ever (re)stamped on a request that already proves it holds the token. Also switched the cookie comparison to a constant-time equality check.GHSA-v3j4-j27j-fxw6 — eleven MCP tools accepted a caller-supplied
baseRefwith no leading-dash guard, passed positionally togitbefore any--terminator — a ref starting with-(e.g."--output=/some/path") is parsed by git as an option, not a revision, lettinggit diffoverwrite an arbitrary file silently (gitOutputswallows all errors). Rejects any leading-dash ref at the choke point incollectLocalBranchMetadata(defense in depth alongside the zod schema layer), adds--end-of-optionsto every git invocation taking a caller-supplied ref, and pre-resolvesbaseRefto a real SHA once so only that SHA — never the raw string — reaches every downstream git call.Test plan
npx tsc --noEmit -p tsconfig.json --incremental false— cleantest/unit/local-branch.test.ts(4 new tests, including a real temp-git-repo exploit reproduction proving the target file survives untouched) andapps/loopover-miner-ui/src/auth.test.ts(updated + new tests covering the bootstrap path and the never-leak-Set-Cookie-on-anonymous-request regression)npx vitest run test/unit/local-branch.test.ts— 79/79 passingapps/loopover-miner-ui's ownvitest run src/auth.test.ts— 26/26 passingnpm run cf-typegen/npm run selfhost:env-reference/npm run db:migrations:check/npm run branding-drift:check— all clean, no drift