progmune-runtime 3.7.26 → 3.7.27

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [3.7.27] — 2026-09-13
+
+### 归属校验 Python 化（A2，修复回归 fr-005 驱动）
+
+- **跨用户资源写入检测**（`tools/extract_ir.py` 新标记 `__progmune_cross_user_write__`）：函数把请求 payload 里的外来资源 id（folder_id）带着持久化（insert/add/create）却没有资源归属守卫 → 标记。**严格归属守卫词表**（任一出现即抑制）：归属字段比较（user_id/owner_id/user.id）、`has_*/check_*_folder_access` 助手、`get_*_by_id_and_user_id` 限定查询——**不含 `has_permission`**（fr-005 真值函数含特性权限检查，与资源归属无关）；`insert_` 前缀持久化原语不标（归属决策在上游路由层）
+- **引擎 IR 层消费**（`src/trust/engine.ts`）：`AUTHZ_CROSS_USER_WRITE` 违规直接报出（同 PATH_TRAVERSAL 模式）；`protocol-detector.ts` 同名规则供 source-level 路径
+- **fr-005 闭环验收**：修复前 DETECTED（open-webui main.py::chat_completion，真值位置）；修复后 0 误报（has_folder_write_access 抑制）；chats.py create_new_chat / automations.py（有守卫）均不标
+- **修复回归战绩 2/8**（fr-007 路径穿越 TS 化 + fr-005 归属校验 Python 化）
+
+### 回归
+
+- Python 盲测 64/64 零漂移 ✓ / Python 源级金标新规则 0 命中 ✓ / skyvern 24 无漂移 ✓ / 引擎测试 73 green ✓ / build ✓ / check 免疫正常 ✓
+
 ## [3.7.26] — 2026-09-13
 
 ### 精度修复批次（AI 生成项目验证 V2 + 真实修复回归驱动的引擎改动）

package/dist/protocol-detector.js

@@ -688,6 +688,20 @@ const SAFEGUARD_RULES = [
         conceptMissing: ["PathTraversalPrevention", "InputPathValidation"],
         conceptExpected: ["path allowlist", "basename normalization", "path sanitization"],
     },
+    {
+        name: "Authorization (Cross-User Resource Write)",
+        category: "authorization",
+        // 2026-09-13（REALWORLD_FIX_REGRESSION_V1 fr-005）：Python 提取器在
+        // 「请求 payload 外来资源 id（folder_id）带着持久化、无归属守卫」时
+        // 注入标记。证据语义全部在提取器侧（严格归属守卫词表——不含
+        // has_permission 类特性权限检查，见 tools/extract_ir.py）。
+        languages: ["python"],
+        trigger: /\b(__progmune_cross_user_write__)\b/,
+        safeguards: [],
+        violationMessage: "Data is persisted with a user-supplied foreign resource id (folder_id) without an ownership guard — any authenticated user can write into another user's resource.",
+        conceptMissing: ["ResourceOwnership", "CrossUserReference"],
+        conceptExpected: ["folder write-access check", "get_*_by_id_and_user_id query"],
+    },
     {
         name: "XSS (Unsafe Template Rendering)",
         category: "xss",

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.26";
+exports.RUNTIME_VERSION = "3.7.27";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -1265,6 +1265,7 @@ async function collectProtocolViolations(ctx, callGraph) {
                     // 在 IR 层直接消费——call-sequence 构建会过滤 __progmune_ 前缀
                     // （P4.5 历史），标记到不了 checkSpecificViolations；此前的 Python
                     // 标记因此在引擎管线中一直是死的。此处同时点亮 Python 与 TS 两侧。
+                    // 2026-09-13（fr-005）：同层消费跨用户资源写入标记。
                     for (const f of functions) {
                         const calls = f.calls || [];
                         if (calls.includes("__progmune_path_traversal__")) {
@@ -1281,6 +1282,20 @@ async function collectProtocolViolations(ctx, callGraph) {
                                 policy_ref: "protocol-safety.specific",
                             });
                         }
+                        if (calls.includes("__progmune_cross_user_write__")) {
+                            violations.push({
+                                severity: "medium",
+                                rule_id: "AUTHZ_CROSS_USER_WRITE",
+                                file: f.file,
+                                function: f.name || "unknown",
+                                message: "Data is persisted with a user-supplied foreign resource id (folder_id) without an ownership guard — any authenticated user can write into another user's resource.",
+                                evidence: "__progmune_cross_user_write__",
+                                why: "Extractor-verified: folder_id from request payload is persisted (insert/add/create) " +
+                                    "with no ownership comparison or folder write-access check in this function.",
+                                fix: "Verify folder write access for the acting user (ownership query or access-control helper) before persisting.",
+                                policy_ref: "protocol-safety.specific",
+                            });
+                        }
                     }
                     for (const f of functions) {
                         if (!f.protocol)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.26",
+  "version": "3.7.27",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",

package/tools/extract_ir.py

@@ -691,6 +691,47 @@ def has_template_tag_decorator(node):
     return False
 
 
+CROSS_USER_WRITE_MARKER = "__progmune_cross_user_write__"
+
+
+def has_cross_user_resource_write(node):
+    """跨用户资源写入（REALWORLD_FIX_REGRESSION_V1 fr-005 open-webui）：
+    函数把请求 payload 里的外来资源 id（folder_id 等）连同持久化调用
+    写入（insert/add/create），却没有资源归属守卫——任意已认证用户可
+    把数据写进其他用户的资源。归属守卫证据（任一出现即抑制）：
+    ① 归属字段比较 user_id/owner_id/author_id/user.id/folder.user_id
+    ② 文件夹写权限助手 has_*/check_*_folder_access / has_folder_access
+    ③ 按用户 id 限定的查询 get_*_by_id_and_user_id。
+    注意：不把 has_permission 算作归属证据——fr-005 真值函数含
+    features.direct_tool_servers 特性权限检查（user.role != 'admin' 同
+    族，has_ownership_checked 会误放行），与资源归属无关。
+    另：函数名以 insert_/save_/add_ 开头 = 持久化原语层（模型方法），
+    归属决策在上游路由层，不标记。"""
+    try:
+        name = getattr(node, "name", "")
+        if re.match(r"^(insert_|save_|add_)", name):
+            return False
+        text = ast.unparse(node)
+    except Exception:
+        return False
+    if "folder_id" not in text:
+        return False
+    if not any(k in text for k in ("metadata", "form_data", "body", "request")):
+        return False
+    if not re.search(r"insert_new_chat|insert_new\w*|\binsert\(|\.add\(|\.create\(", text):
+        return False
+    if re.search(r"\b(user_id|owner_id|author_id|user\.id|folder\.user_id)\s*[!=]==?", text):
+        return False
+    if re.search(
+        r"has_folder_write_access|has_folder_access|"
+        r"has_\w*_folder_access|check_\w*_folder_access|check_folder\w*|"
+        r"get_\w+_by_id_and_user_id",
+        text,
+    ):
+        return False
+    return True
+
+
 def has_ownership_checked(node):
     """Inline ownership comparison: an identity-named parameter (user,
     current_user, profile, author, owner) compared with ==/!= against another
@@ -861,6 +902,8 @@ def extract_calls(node, unsafe_vars=None, imports=None, module_constants=None, g
         calls.append(TEMPLATE_TAG_MARKER)
     if has_ownership_checked(node) and OWNERSHIP_CHECKED_MARKER not in calls:
         calls.append(OWNERSHIP_CHECKED_MARKER)
+    if has_cross_user_resource_write(node) and CROSS_USER_WRITE_MARKER not in calls:
+        calls.append(CROSS_USER_WRITE_MARKER)
     if has_command_taint_flow(node) and CMD_FLOW_MARKER not in calls:
         calls.append(CMD_FLOW_MARKER)
     if has_csrf_exempt(node) and CSRF_MARKER not in calls: