fix(security): reject dot path components before dependency-review compare - #1050
Draft
cursor[bot] wants to merge 7 commits into
Draft
fix(security): reject dot path components before dependency-review compare#1050cursor[bot] wants to merge 7 commits into
cursor[bot] wants to merge 7 commits into
Conversation
This was referenced Aug 16, 2026
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
Author
There was a problem hiding this comment.
Verdict
COMMENT on exact head 29a20baa.
This branch rejects ./.. path components and keeps ContextualWisdomLab/.github legal. A concurrent integration vehicle already lands the same slice with tighter identity-rejection diagnostics (curl exit uncalled, no raw invalid revision or repository echo).
Operator next step
- Prefer #1049 (
e4a7dffa) for integration. - Keep this pull request draft. Do not merge it.
- Keep #810 open until a protected-main public consumer run proves a non-200 cannot green Dependency Review.
- Wait only for exact-current-head required checks and a counted non-author formal approval on #1049.
Sent by Cursor Automation: Fix Issues
seonghobae
force-pushed
the
cursor/bc-f59729bf-862b-4dcf-bba2-73fdecc98207-5447
branch
from
August 20, 2026 01:45
29a20ba to
0764397
Compare
Contributor
|
Rebased the seven-commit dependency-review hardening series onto current origin/main c47bee5, retaining fail-closed availability, visibility, named-ref, and dot-component validation. Current HEAD: 0764397 Validation on this HEAD:
@OpenCode review this exact HEAD after the rebase. |
This was referenced Aug 20, 2026
Replay unique #897 source onto current origin/main. Skip shared ARCHITECTURE/CLAUDE trees. Treat non-200 or failed transport as unavailable evidence rather than a clean skip.
Close the remaining #810 diagnostic gap: allowlist public/private/internal/unknown visibility in probe diagnostics, execute 403/404/empty/malformed regressions, and stop making the pinned action independently skippable after a successful probe. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Add executable regressions for the EgressWeave #66 canary (HTTP 403 skip-was-success), a bare transport failure, and curl exit 18 with a printed 200. Record exact SHAs and allowlisted visibility without leaking the probe token. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
…arness Invoke the extracted support probe with an absolute bash path and keep the fake curl first on PATH so isolated executable regressions can run without calling the real binary. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Classify curl's no-status 000 write-out as unavailable instead of a three-digit HTTP code, and lock private/internal visibility plus raw visibility non-leakage with executable regressions. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
GitHub's compare API resolves named revisions to moving HEADs. Require exact 40- or 64-character hexadecimal object IDs and an owner/name repository identity before any compare request. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
…mpare A single-slash owner/name whose owner or name is . or .. still matched the previous identity regex, so ../.github and ContextualWisdomLab/.. could reach curl. RFC 3986 remove-dot-segments would collapse those into a different compare URL. The organization .github repository remains a legal name. Related to #810. Prefer this branch over #1042 and #1048 for integration. Do not close #810 until an EgressWeave canary proves a non-200 cannot green the job. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
seonghobae
force-pushed
the
cursor/bc-f59729bf-862b-4dcf-bba2-73fdecc98207-5447
branch
from
August 20, 2026 04:59
0764397 to
948de32
Compare
Contributor
|
@opencode-agent review exact current head 948de32 against protected base 2cce96f. Rebased the dependency-review fail-closed hardening onto current main; verified 72 queue/security contract tests, compileall, interrogate, security-scan actionlint, and diff --check. The prior preferred #1049 is closed, so this remains the open landing vehicle. Do not transfer predecessor review/check evidence. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Continue #1048. Named-ref rejection and the single-slash
owner/nameregex are necessary, but../.githubandContextualWisdomLab/..still match that regex. RFC 3986 remove-dot-segments would collapse/repos/../.github/...into/.github/...(Berners-Lee et al., 2005). A synthetic HTTP 200 would then writesupported=trueagainst a different compare URL.Prefer this branch over #897, #1033, #1041, #1042, #1044, #1045, and #1048 for integration. Keep #821 draft. Do not close #810 until a protected-main public consumer run proves a non-200 or failed-transfer comparison cannot produce a green Dependency Review gate.
What changed
owner/nameshape check, reject an owner or name that is exactly.or..before any compare request.ContextualWisdomLab/.githublegal: the organization special repository is a name, not a path-segment sentinel.../.github,ContextualWisdomLab/..,ContextualWisdomLab/., and./.github, and prove the.githubproduct repository still reaches compare.Acceptance
Merge only after exact-current-head deterministic, security, dependency, and required workflows are terminal and clean, current automated review has no valid unresolved finding, and a qualifying counted non-author formal approval exists.
Automated review is not qualifying approval or merge authority.
Operator next step