security: harden sandbox — fix injection, env leak, cross-nav bypass#51
Merged
Conversation
CRITICAL fixes: - Cross-nav queries now inherit target navigator's sandbox config instead of running completely unsandboxed (cross-nav.ts, related-navs.ts) - Shell injection via NONO_FLAGS fixed: flags now passed via temp file (one per line) read with `while read`, not unquoted env var expansion HIGH fixes: - Environment variable filtering: subprocess gets allowlisted vars only, not full process.env (strips plugin tokens, DB creds, etc.) - Path validation: config schema rejects traversal (..), null bytes - Command deny-list: bash, sudo, rm, python, etc. blocked in config schema - Wrapper script uses random UUID filename + mode 0700 (TOCTOU fix) MEDIUM fixes: - isSandboxEnabled() now warns on stderr before silent degradation - Shared buildSandboxConfigForOperation() eliminates duplicated logic Docs: security-model.md fully rewritten to reflect 3-provider model, nono wrapper architecture, env filtering, config validation, and sandbox_query diagnostic tool.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
NONO_FLAGS— flags passed via temp file, not unquoted env var.., null bytes) and commands (deniesbash,sudo,rm,python, etc.)isSandboxEnabled()now warns on stderr before silent degradationsecurity-model.mdfully rewritten for current architectureTest plan