Repository navigation
fix(security): constrain ProxyCommand endpoint token expansion - #342
Merged
Merged
Conversation
Validate all endpoint tokens at the common expansion boundary before launching the local shell, preventing inventory, environment and library input from adding shell syntax or arguments. Preserve trusted command quoting and pipelines, and document the restricted token alphabet and IPv6 compatibility. Add no-side-effect regressions for host, username and alias tokens, resolved YAML/environment inputs, and a successful IPv6 pipeline. The nine proxy tests pass locally. Refs #326
Keep the pre-spawn shell data boundary while allowing unused endpoint fields to retain their original values. Escaped literal tokens do not trigger validation. Add regression coverage and update compatibility documentation. Refs #326
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Prevent endpoint data from changing a trusted ProxyCommand shell program by validating
%h,%n,%r, and%kat the common expansion boundary before spawning. CLI, inventory, environment-derived and public library inputs share this check; errors identify the token without echoing unsafe data.Only substituted values are checked; unused fields and escaped literal tokens such as
%%hare unrestricted. Substituted values must be nonempty ASCII letters/digits or.,_,:,@,-, without a leading-. Whitespace, substitutions, wildcards, quotes, non-ASCII names, raw bracketed IPv6 and scoped IPv6 are rejected even inside quoted tokens. Ordinary aliases, CLI-normalized IPv6 and authored shell quoting/pipelines remain supported. README (English/Korean), man page and API docs explain these restrictions; templates themselves remain trusted code.Validation
cargo clippy --lib -- -D warningspass. Broader integration checks are handled by the orchestration gate.Closes #326