@codyswann/lisa 4.55.8 → 4.55.10

package/plugins/src/expo/skills/jira-journey/SKILL.md

@@ -17,8 +17,13 @@ Read a JIRA ticket's Validation Journey, execute it via Playwright MCP browser t
 ## Prerequisites
 
 - `JIRA_API_TOKEN` environment variable set
-- `jira-cli` configured — `.lisa/jira-cli/.config.yml` (written by the
-  `setup-jira-cli` SessionStart hook) or `~/.config/.jira/.config.yml`
+- `jira-cli` configured in the operator's `~/.config/.jira/.config.yml`.
+  This Expo parser deliberately remains home-config-only: it does not consume
+  checkout configuration or a `JIRA_SERVER` environment override. Its server must
+  be a bare HTTPS origin with no userinfo, query, fragment, or path prefix.
+  ASCII DNS names, IPv4, and bracketed IPv6 are supported; default port `443`
+  and a root slash are canonicalized away. Whitespace, controls, encoded or
+  non-ASCII hosts, trailing dots, and port zero are rejected before the token is read.
 - `gh` CLI authenticated
 - Playwright MCP server running (browser tools available)
 - Dev server running

package/plugins/src/expo/skills/jira-journey/scripts/parse-plan.py

@@ -25,6 +25,7 @@ Output (JSON):
     }
 """
 
+import ipaddress
 import json
 import os
 import re
@@ -33,6 +34,31 @@ import sys
 import urllib.request
 from base64 import b64encode
 from pathlib import Path
+from urllib.parse import urlsplit
+
+
+def server_origin(server):
+    """Validate the base parser's bare HTTPS grammar before accessing a token."""
+    if not server or any(char <= " " or char >= "\x7f" for char in server):
+        return ""
+    try:
+        parsed = urlsplit(server)
+        if (parsed.scheme != "https" or "@" in parsed.netloc
+                or "?" in server or "#" in server
+                or parsed.path not in ("", "/") or not parsed.hostname):
+            return ""
+        host = parsed.hostname
+        if parsed.netloc.startswith("["):
+            host = f"[{ipaddress.IPv6Address(host).compressed}]"
+        elif not re.fullmatch(r"[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*", host):
+            return ""
+        port = parsed.port
+        if port == 0:
+            return ""
+        suffix = f":{port}" if port is not None and port != 443 else ""
+        return f"https://{host}{suffix}"
+    except ValueError:
+        return ""
 
 
 def get_jira_config():
@@ -51,6 +77,12 @@ def get_jira_config():
             elif line.startswith("login:"):
                 login = line.split(":", 1)[1].strip()
 
+    # Home configuration remains the operator-owned source; never trust checkout input here.
+    server = server_origin(server)
+    if not server:
+        print("ERROR: Jira server must be a bare HTTPS origin without userinfo, path, query or fragment.", file=sys.stderr)
+        sys.exit(1)
+
     token = os.environ.get("JIRA_API_TOKEN", "")
     if not token:
         print("ERROR: JIRA_API_TOKEN env var not set", file=sys.stderr)

package/plugins/src/rails/skills/jira-evidence/SKILL.md

@@ -17,6 +17,9 @@ Upload captured evidence and generated templates to GitHub PR description and JI
 
 ## Prerequisites
 
+- `python3` for destination validation. Configure `server` as a bare HTTPS origin:
+  no userinfo, path prefix, query, or fragment. Invalid destinations are rejected
+  before Basic authorization is constructed.
 - `JIRA_API_TOKEN` environment variable set
 - a jira-cli config — `.lisa/jira-cli/.config.yml` if the `setup-jira-cli`
   SessionStart hook wrote one, otherwise `~/.config/.jira/.config.yml`. `server`

package/plugins/src/rails/skills/jira-evidence/scripts/post-evidence.sh

@@ -73,8 +73,38 @@ else
   echo "  writes the project config — or run 'jira init' locally." >&2
   exit 1
 fi
-JIRA_SERVER=$(grep '^server:' "$JIRA_CONFIG" | awk '{print $2}')
+JIRA_SERVER=$(sed -n 's/^server:[[:space:]]*//p' "$JIRA_CONFIG")
 JIRA_USER=$(grep '^login:' "$JIRA_CONFIG" | awk '{print $2}')
+# Validate before constructing credentials; use only the approved HTTPS origin.
+JIRA_SERVER=$(python3 - "$JIRA_SERVER" <<'PY_ORIGIN'
+import ipaddress
+import re
+import sys
+from urllib.parse import urlsplit
+
+raw = sys.argv[1]
+try:
+    if not raw or any(c <= " " or c >= "\x7f" for c in raw):
+        raise ValueError()
+    url = urlsplit(raw)
+    if (url.scheme != "https" or "@" in url.netloc or "?" in raw
+            or "#" in raw or url.path not in ("", "/") or not url.hostname):
+        raise ValueError()
+    host = url.hostname
+    if url.netloc.startswith("["):
+        host = f"[{ipaddress.IPv6Address(host).compressed}]"
+    elif not re.fullmatch(r"[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*", host):
+        raise ValueError()
+    port = url.port
+    if port == 0:
+        raise ValueError()
+    suffix = f":{port}" if port is not None and port != 443 else ""
+    print(f"https://{host}{suffix}")
+except ValueError:
+    sys.exit("ERROR: JIRA_SERVER must be a bare HTTPS origin without userinfo, path, query or fragment.")
+PY_ORIGIN
+)
+
 GH_REPO=$(gh repo view --json nameWithOwner --jq '.nameWithOwner')
 RELEASE_TAG="pr-assets"
 
@@ -104,7 +134,7 @@ fi
 echo "Found ${#SCREENSHOTS[@]} screenshots and ${#TEXT_EVIDENCE[@]} text evidence files to upload"
 
 # Compute JIRA auth early (used in steps 3 and 4)
-JIRA_AUTH=$(echo -n "$JIRA_USER:$JIRA_API_TOKEN" | base64)
+JIRA_AUTH=$(printf '%s' "$JIRA_USER:$JIRA_API_TOKEN" | base64 | tr -d '\n')
 
 # ── Step 1: Upload to GitHub pr-assets release ──────────────────────────────
 echo ""