Repository navigation
docs(security): correct the October review and sign it off, finding 8 included - #1655
Merged
Merged
Conversation
…indings to 3.4.0 The boundary 1 path row said EscapePathSegment and EscapePathSegments escape every argument it lists, the model registry download's included. That handler uses neither: its arguments are escaped with url.PathEscape, by client-go's own route under a directory and by rootFilePath at the package root. The row now says so, and names the model registry test for what it holds. The record said every requirement was traced at 8e959c3, where the path row describes code that arrived with 39b7093, the commit 3.4.0 was released from. The introduction, the scope and the method now name that commit for the path row. Finding 8 now says the request ran under the operator's token, or the caller's in HTTP mode, past the server's per-action controls, which is the harm its advisory names; it states which GitLab releases refuse the path and with which flags; and its status records the release, that the fix was merged from the advisory's private fork, and that the advisory is not yet in the GitHub Advisory Database or OSV, with its CVE unassigned. Findings 3, 4 and 5 waited for a release that has shipped. Each keeps the status signed off on 27 October and gains a dated update: #1560 corrected the policy, #1554 and Go 1.27.3 shipped in 3.4.0, before the 2 November deadline finding 4 named. The dependencies row says the same. Signed-off-by: José M. Requena Plens <mail@jmrp.io>
The record still read as if finding 8 were held back until its advisory is published, and asked whether it changes the result of any row without answering. GHSA-rxjw-584q-hxjr was published on 31 October 2026 with 3.4.0, and I read the boundary 1 path row and finding 8 that day. The status line, the introduction and the Sign-off table now say the review is signed off as of 31 October 2026, every finding included, with finding 8 held back from the sign-off of 27 October until its advisory was published, and the path row read at 39b7093, the commit 3.4.0 was released from. What the maintainer's review covers now answers the question on finding 8: of the rows recorded on 27 October it moves only input validation, whose untraced "String parameters are sanitized where applicable" did not hold for a path argument until 3.4.0, and that row now says so. The others keep their results, because every request stayed on the instance under the token's own authority, read-only mode removed every write it reaches, safe mode previewed each, and a read stayed a GET. Signed-off-by: José M. Requena Plens <mail@jmrp.io>
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes.
 |
jmrplens
added
documentation
jmrplens
changed the title
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The October security review record still read as if finding 8 were held back, and a review of the rows #1650 added found places where they said more, or less, than the code and the advisory do. This corrects them and closes the sign-off, for the OpenSSF Best Practices gold criterion
security_review, which asks for a security review a person performed as well as tools.The boundary 1 path row said
EscapePathSegmentandEscapePathSegmentsescape every argument it lists. The model registry download uses neither: its arguments are escaped withurl.PathEscape, by client-go's own route under a directory and byrootFilePathat the package root. The row now says so, and says what its model registry test holds.The record said every requirement was traced at
8e959c3d8, but the path row describes code that arrived with39b7093af, the commit 3.4.0 was released from. The introduction, the scope, the method and the Sign-off table now name that commit for the path row.Finding 8 now names the harm its advisory gives: the request ran under the operator's token, or the caller's in HTTP mode, past the server's per-action controls. It states which GitLab releases refuse the path and with which flags, and its status records the release, that the fix was merged from the advisory's private fork, and that the advisory is not yet in the GitHub Advisory Database or OSV and its CVE is unassigned.
Findings 3, 4 and 5 still waited for a release that has shipped. Each keeps the status signed off on 27 October and gains a dated update: #1560 corrected the policy, and #1554 and Go 1.27.3 shipped in 3.4.0, before the 2 November deadline finding 4 named. The dependencies row says the same.
I read the boundary 1 path row and finding 8 on 31 October and sign the review as of that date, every finding included. The record now answers the question it left open on finding 8: of the rows recorded on 27 October it moves only input validation, whose untraced "String parameters are sanitized where applicable" did not hold for a path argument until 3.4.0, and the others keep their results, since every request stayed on the instance under the token's own authority, read-only mode removed every write it reaches, safe mode previewed each, and a read stayed a GET.
Two dated updates follow from the layers below:
SECURITY.md's advisory count and disclosure steps, and the assurance case, are corrected for finding 8 in the first two layers of this stack.
Signed-off-by: José M. Requena Plens mail@jmrp.io