boost-skill-cli 1.0.72__tar.gz → 1.0.73__tar.gz

{boost_skill_cli-1.0.72 → boost_skill_cli-1.0.73}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.72
+Version: 1.0.73
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.72 → boost_skill_cli-1.0.73}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.72'
-__version_tuple__ = version_tuple = (1, 0, 72)
+__version__ = version = '1.0.73'
+__version_tuple__ = version_tuple = (1, 0, 73)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.72 → boost_skill_cli-1.0.73}/boost_cli/core/gitutil.py

@@ -31,9 +31,21 @@ def run(args: List[str], cwd: Optional[Path] = None, check: bool = True,
     return proc
 
 
+# git's remote-helper transports run arbitrary commands straight from the URL
+# (notably `ext::sh -c …`), so refuse them outright — boost only ever clones
+# real http(s)/ssh/git remotes.
+_UNSAFE_TRANSPORTS = ("ext::", "file::", "fd::")
+
+
 def clone_shallow(url: str, dest: Path) -> None:
+    if url.lstrip().lower().startswith(_UNSAFE_TRANSPORTS):
+        raise BoostError(
+            "refusing to clone via unsafe git transport: %s" % url,
+            hint="use an https://, ssh://, or git@ remote")
     dest.parent.mkdir(parents=True, exist_ok=True)
-    run(["clone", "--depth", "1", "--quiet", url, str(dest)], timeout=600)
+    # `--` ends option parsing so a URL beginning with `-` cannot be read as a
+    # git flag — argument-injection defense-in-depth beside registry.parse_spec.
+    run(["clone", "--depth", "1", "--quiet", "--", url, str(dest)], timeout=600)
 
 
 def pull(repo: Path) -> str:

{boost_skill_cli-1.0.72 → boost_skill_cli-1.0.73}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.72
+Version: 1.0.73
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

boost_skill_cli-1.0.73/docs/roadmap/items/end-of-options-guard-on-git-commands.md

@@ -0,0 +1,26 @@
+---
+id: end-of-options-guard-on-git-commands
+board: code
+section: shipped
+status: shipped
+category: Security
+complexity: S
+impact: Med
+wow: 3
+note: transport allow-list + -- guard
+order: 8
+owner: loop/gitutil-transport-guard
+pr:
+title: End-of-options <code>--</code> guard on git commands
+---
+<code>clone_shallow</code> passed the clone URL as a positional with no
+           <code>--</code> separator, so a value beginning with <code>-</code>
+           could be read as a git flag, and git's remote-helper transports
+           (<code>ext::sh -c …</code>, <code>file::</code>, <code>fd::</code>)
+           can execute arbitrary commands straight from a URL. Now it refuses
+           those transports outright and passes <code>--</code> before the URL
+           so option parsing can't be hijacked — argument-injection
+           defense-in-depth beside <code>registry.parse_spec</code>. Kept scoped
+           to the one primitive that takes a user-influenced URL (the refs in
+           <code>pull</code>/<code>reset</code> are constants, and <code>--</code>
+           there would wrongly mean a pathspec). Six tests, mutation-verified.

{boost_skill_cli-1.0.72 → boost_skill_cli-1.0.73}/docs/roadmap.html

@@ -115,7 +115,7 @@
   <section class="block reveal">
     <div class="stats">
       <!-- ROADMAP:stats -->
-      <div class="stat"><b>7</b><span>Shipped</span></div>
+      <div class="stat"><b>8</b><span>Shipped</span></div>
       <div class="stat"><b>3</b><span>Next up</span></div>
       <div class="stat"><b>4</b><span>Planned</span></div>
       <div class="stat"><b>83</b><span>Loop finds</span></div>
@@ -248,6 +248,28 @@
           <span class="m">broken headline command, now works</span>
         </div>
       </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Security</span></div>
+        <h3>End-of-options <code>--</code> guard on git commands</h3>
+        <p><code>clone_shallow</code> passed the clone URL as a positional with no
+           <code>--</code> separator, so a value beginning with <code>-</code>
+           could be read as a git flag, and git's remote-helper transports
+           (<code>ext::sh -c …</code>, <code>file::</code>, <code>fd::</code>)
+           can execute arbitrary commands straight from a URL. Now it refuses
+           those transports outright and passes <code>--</code> before the URL
+           so option parsing can't be hijacked — argument-injection
+           defense-in-depth beside <code>registry.parse_spec</code>. Kept scoped
+           to the one primitive that takes a user-influenced URL (the refs in
+           <code>pull</code>/<code>reset</code> are constants, and <code>--</code>
+           there would wrongly mean a pathspec). Six tests, mutation-verified.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">transport allow-list + -- guard</span>
+        </div>
+      </article>
       <!-- /ROADMAP:cards -->
 
     </div>
@@ -431,17 +453,6 @@
         </div>
       </article>
 
-      <article class="cap rcard">
-        <div class="head"><span class="pill next">Next</span><span class="cat">Security</span></div>
-        <h3>End-of-options <code>--</code> guard on git commands</h3>
-        <p><code>clone_shallow</code>/<code>fetch</code>/<code>reset</code> pass the URL &amp; ref as positionals with no <code>--</code> separator (<code>core/gitutil.py:34–46</code>), so a value starting with <code>-</code> is parsed as a git option. <code>parse_spec</code> constrains most URL shapes, but adding <code>--</code> before positionals and rejecting <code>ext::</code>/<code>file::</code>/<code>fd::</code> transports closes the argument-injection surface as defense-in-depth.</p>
-        <div class="meta">
-          <span class="m">Complexity <b>S</b></span>
-          <span class="m">Impact <b>Med</b></span>
-          <span class="m">Wow <b class="wow">★★★</b></span>
-        </div>
-      </article>
-
       <article class="cap rcard">
         <div class="head"><span class="pill planned">Planned</span><span class="cat">Robustness</span></div>
         <h3>Atomic skill install (temp-dir swap)</h3>

{boost_skill_cli-1.0.72 → boost_skill_cli-1.0.73}/tests/unit/test_gitutil.py

@@ -145,10 +145,36 @@ class TestCloneAndInspect:
         calls = _record_run(monkeypatch)
         gitutil.clone_shallow("git@example:x.git", tmp_path / "d")
         (args, kw), = calls
-        assert args == ["clone", "--depth", "1", "--quiet",
+        assert args == ["clone", "--depth", "1", "--quiet", "--",
                         "git@example:x.git", str(tmp_path / "d")]
         assert kw.get("timeout") == 600     # long clone timeout, not the 300 default
 
+    def test_clone_shallow_puts_end_of_options_before_url(self, tmp_path,
+                                                          monkeypatch):
+        # a URL beginning with `-` must be a positional, never a git flag
+        calls = _record_run(monkeypatch)
+        gitutil.clone_shallow("--upload-pack=evil", tmp_path / "d")
+        (args, _kw), = calls
+        assert "--" in args and args.index("--") < args.index("--upload-pack=evil")
+
+    @pytest.mark.parametrize("bad", [
+        "ext::sh -c evil", "file::/etc/passwd", "fd::7",
+        "EXT::sh -c evil",           # case-insensitive
+        "  ext::sh -c evil",         # leading whitespace stripped first
+    ])
+    def test_clone_shallow_rejects_unsafe_transports(self, tmp_path, monkeypatch,
+                                                     bad):
+        calls = _record_run(monkeypatch)
+        with pytest.raises(BoostError) as ei:
+            gitutil.clone_shallow(bad, tmp_path / "d")
+        assert "unsafe git transport" in ei.value.message
+        assert calls == []           # git is never invoked for a rejected URL
+
+    def test_clone_shallow_allows_ordinary_https(self, tmp_path, monkeypatch):
+        calls = _record_run(monkeypatch)
+        gitutil.clone_shallow("https://github.com/o/r", tmp_path / "d")
+        assert len(calls) == 1       # a normal remote clones, not rejected
+
     def test_head_commit_argv_is_rev_parse_head(self, tmp_path, monkeypatch):
         calls = _record_run(monkeypatch, stdout="c0ffee\n")
         assert gitutil.head_commit(tmp_path / "r") == "c0ffee"

boost_skill_cli-1.0.72/docs/roadmap/items/end-of-options-guard-on-git-commands.md

@@ -1,16 +0,0 @@
----
-id: end-of-options-guard-on-git-commands
-board: code
-section: internals
-status: next
-category: Security
-complexity: S
-impact: Med
-wow: 3
-note: 
-order: 6
-owner:
-pr:
-title: End-of-options <code>--</code> guard on git commands
----
-<code>clone_shallow</code>/<code>fetch</code>/<code>reset</code> pass the URL &amp; ref as positionals with no <code>--</code> separator (<code>core/gitutil.py:34–46</code>), so a value starting with <code>-</code> is parsed as a git option. <code>parse_spec</code> constrains most URL shapes, but adding <code>--</code> before positionals and rejecting <code>ext::</code>/<code>file::</code>/<code>fd::</code> transports closes the argument-injection surface as defense-in-depth.