Harden security boundaries and CI - #11
Conversation
code-to-gate PR ReviewGate Verdict
Blocking Reasons
Acceptable Risks
Suggested Tests
Spec Drift
Drift Budget
Evidence Links
Suppression / Baseline Summary
Gate Explainability
Generated by code-to-gate v1.5.0 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 76597fbf87
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| args.push( | ||
| "--permission", | ||
| "--allow-fs-read=" + pluginRoot, | ||
| "--allow-fs-read=" + workDir, | ||
| "--allow-fs-write=" + workDir |
There was a problem hiding this comment.
When a trusted Node plugin needs to inspect source files (the manifest/docs allow security.filesystem.read: ["${repoRoot}"] and many evaluators read file bodies from repo_graph.files), the spawned process gets --permission with read access only to the plugin directory and work dir. Node's --allow-fs-read is the read allowlist, so any fs.readFile of a repo path is denied in the default process sandbox even though the plugin is trusted; pass the configured repo/manifest read paths into these flags or process-mode plugins will fail.
Useful? React with 👍 / 👎.
| this.runningProcesses | ||
| this.runningProcesses, | ||
| { | ||
| pluginRoot: entry.path, |
There was a problem hiding this comment.
none sandbox mode
When users explicitly choose --sandbox none --unsafe-allow-none to run a legacy non-Node plugin such as python plugin.py, this still supplies pluginRoot, so buildPluginSpawnSpec() takes the contained-entrypoint branch and requires command[0] itself to be a file under the plugin directory. Commands resolved from PATH are rejected, so none is no longer the documented direct-execution escape hatch; only pass pluginRoot for process sandboxing or keep the raw spawn path for none.
Useful? React with 👍 / 👎.
| return path.isAbsolute(candidate) || path.win32.isAbsolute(candidate) | ||
| ? path.resolve(candidate) | ||
| : path.resolve(repoRoot, candidate); |
There was a problem hiding this comment.
On POSIX, importing a report produced with Windows absolute paths such as C:\agent\repo\src\a.ts hits the path.win32.isAbsolute branch, but path.resolve() then treats that string as relative under the current repo and it later normalizes to C:/agent/repo/src/a.ts. Those findings are marked accepted/complete even though the evidence path is not actually inside the repository; reject foreign Windows absolutes or translate them only with an explicit repo root mapping.
Useful? React with 👍 / 👎.
1 participant
Summary\n- 外部解析結果のimportに、manifest・SHA-256・revision・tool identity・入力上限・安全なpath検証を追加\n- plugin実行をfail-closed化し、process/Docker sandbox、権限・環境変数・出力・時間上限を導入\n- repository scanに件数・深さ・容量・時間上限とpartial伝播を追加\n- Semgrep、Gitleaks、npm audit、CycloneDX SBOM、golden testを含む固定済みsecurity gateを追加\n- README（英語・日本語を含む）、CLIおよびsandbox/security文書を更新\n\n## Why\n信頼できないimport、plugin、巨大repository、CI supply-chainを境界で検証し、異常時に安全側へ失敗させるためです。\n\n## Validation\n-
pm run build\n-
pm run test:smoke (56 passed)\n- security targeted suite (397 passed, 3 skipped)\n- architecture tests (18 passed)\n- package smoke\n-
pm run audit:deps (0 vulnerabilities)\n-
ode scripts/verify-security-toolchain.mjs\n\nローカルではDocker Engineが利用できなかったため、固定digestのSemgrep container実行はGitHub Actionsを正本として確認します。