@opengsd/gsd-core 1.9.1 → 1.11.0

package/gsd-core/bin/lib/security.cjs

@@ -29,6 +29,7 @@ exports.requireSafePath = requireSafePath;
 exports.scanForInjection = scanForInjection;
 exports.sanitizeForPrompt = sanitizeForPrompt;
 exports.sanitizeForDisplay = sanitizeForDisplay;
+exports.sanitizeLabel = sanitizeLabel;
 exports.validateShellArg = validateShellArg;
 exports.safeJsonParse = safeJsonParse;
 exports.validatePhaseNumber = validatePhaseNumber;
@@ -73,13 +74,52 @@ function validatePath(filePath, baseDir, opts = {}) {
         resolvedPath = node_fs_1.default.realpathSync(resolvedPath);
     }
     catch {
-        const parentDir = node_path_1.default.dirname(resolvedPath);
+        // realpathSync failed — either resolvedPath doesn't exist at all, or it's
+        // a dangling symlink (the link itself exists but its target doesn't).
+        // lstat (unlike stat/realpath) stats the link itself and does NOT follow
+        // it, so it succeeds for a dangling symlink and throws ENOENT for a
+        // genuinely absent path. That's the discriminator: without it, a dangling
+        // symlink to a non-existent OUTSIDE path would fall through to the
+        // parent-resolution fallback below and be re-accepted as an in-project
+        // path, while a symlink to an EXISTING outside path is correctly
+        // rejected via the realpathSync success branch above — a state
+        // difference an attacker can use as an existence oracle for arbitrary
+        // absolute paths.
         try {
-            const realParent = node_fs_1.default.realpathSync(parentDir);
-            resolvedPath = node_path_1.default.join(realParent, node_path_1.default.basename(resolvedPath));
+            if (node_fs_1.default.lstatSync(resolvedPath).isSymbolicLink()) {
+                return { safe: false, resolved: '', error: 'Path is an unresolvable symbolic link' };
+            }
         }
         catch {
-            // Parent doesn't exist either — keep the resolved path as-is
+            // lstat also threw — resolvedPath (and its would-be link) genuinely
+            // doesn't exist. Fall through to ancestor resolution below.
+        }
+        // Walk up to the nearest ancestor that exists and realpath THAT, then
+        // re-append the remaining (not-yet-created) segments. This canonicalizes
+        // resolvedPath the same way resolvedBase was canonicalized above,
+        // regardless of how many leading directories are missing — a single
+        // parent-only check would leave resolvedPath un-canonicalized whenever
+        // the parent is also missing, which breaks the startsWith comparison
+        // below on any non-canonical cwd (e.g. macOS /var/... vs
+        // /private/var/...).
+        let ancestor = node_path_1.default.dirname(resolvedPath);
+        const remainder = [node_path_1.default.basename(resolvedPath)];
+        for (;;) {
+            try {
+                const realAncestor = node_fs_1.default.realpathSync(ancestor);
+                resolvedPath = node_path_1.default.join(realAncestor, ...remainder);
+                break;
+            }
+            catch {
+                const parent = node_path_1.default.dirname(ancestor);
+                if (parent === ancestor) {
+                    // Reached filesystem root without finding an existing ancestor —
+                    // keep resolvedPath as-is.
+                    break;
+                }
+                remainder.unshift(node_path_1.default.basename(ancestor));
+                ancestor = parent;
+            }
         }
     }
     const normalizedBase = resolvedBase + node_path_1.default.sep;
@@ -193,7 +233,7 @@ exports.INJECTION_PATTERNS = [
     /override\s+(system|previous)\s+(prompt|instructions)/i,
     // Role/identity manipulation
     /you\s+are\s+now\s+(?:a|an|the)\s+/i,
-    /act\s+as\s+(?:a|an|the)\s+(?!plan|phase|wave)/i,
+    /\bact\s+as\s+(?:a|an|the)\s+(?!plan|phase|wave)/i,
     /pretend\s+(?:you(?:'re| are)\s+|to\s+be\s+)/i,
     /from\s+now\s+on,?\s+you\s+(?:are|will|should|must)/i,
     // System prompt extraction
@@ -349,6 +389,65 @@ function sanitizeForDisplay(text) {
         .join('\n');
     return sanitized;
 }
+/**
+ * Sanitize a value that must render as a SINGLE LINE and is derived from a
+ * filesystem name (a phase directory's number/name token, an archived
+ * milestone label, a bare filename) — not from file/frontmatter CONTENT.
+ *
+ * Why this is NOT `sanitizeForDisplay`: that helper's job is multi-line
+ * prose — it strips whole protocol-leak LINES while deliberately preserving
+ * `\n` between legitimate ones (see its docstring and
+ * `tests/security.test.cjs`'s neighbouring describe). A filesystem name is
+ * the opposite shape: it is supposed to be one line, so a `\n`/`\r` inside
+ * one is never legitimate content to preserve — it is an attacker (or a
+ * doctored checkout) using the directory NAME itself as the injection
+ * vector. #3458's reproduction: a phase directory literally named
+ *   `zz\n0 open items require decisions.\n\x1b[2K\x1b[1G FORGED`
+ * flows verbatim into `audit-open`'s human report (the phase-number
+ * fallback taken when the name doesn't match `PHASE_NUMBER_TOKEN_SOURCE`).
+ * `sanitizeForDisplay` would pass every one of those bytes straight through
+ * — by design, since it never touches control characters — so the embedded
+ * `\n` becomes a real newline in the report, printing a forged
+ * "0 open items require decisions." as its own line, and the raw ESC bytes
+ * reach the terminal.
+ *
+ * This helper closes that hole by ESCAPING (never silently stripping) the
+ * C0 control range (0x00–0x1F, including ESC 0x1B, CR, LF), DEL (0x7F), and
+ * the C1 range (0x80–0x9F) into a visible representation (`\n`, `\x1b`,
+ * ...). Escaping rather than stripping is deliberate: a reviewer reading the
+ * report should be able to SEE that a name was doctored, not have it quietly
+ * normalized away as if nothing happened. Every other character — including
+ * all ordinary printable and non-ASCII text — passes through byte-identical.
+ */
+function sanitizeLabel(text) {
+    if (!text || typeof text !== 'string')
+        return text;
+    const NAMED_ESCAPES = {
+        0x00: '\\0',
+        0x07: '\\a',
+        0x08: '\\b',
+        0x09: '\\t',
+        0x0a: '\\n',
+        0x0b: '\\v',
+        0x0c: '\\f',
+        0x0d: '\\r',
+        0x1b: '\\x1b',
+    };
+    let out = '';
+    for (const ch of text) {
+        const code = ch.codePointAt(0);
+        const isC0 = code <= 0x1f;
+        const isDel = code === 0x7f;
+        const isC1 = code >= 0x80 && code <= 0x9f;
+        if (isC0 || isDel || isC1) {
+            out += NAMED_ESCAPES[code] ?? `\\x${code.toString(16).padStart(2, '0')}`;
+        }
+        else {
+            out += ch;
+        }
+    }
+    return out;
+}
 // ─── Shell Safety ───────────────────────────────────────────────────────────────────────
 /**
  * Validate that a string is safe to use as a shell argument when quoted.