Repository navigation
Import YAAS v2 snapshot - #3
Closed
guangmian-circle wants to merge 1 commit into
Closed
guangmian-circle wants to merge 1 commit into
guangmian-circle wants to merge 1 commit into
Conversation
Dependency ReviewThe following issues were found:
License Issues.github/workflows/scan.yml
Allowed Licenses: BSD-1-Clause, BSD-2-Clause, BSD-3-Clause, MIT, MIT-0, Apache-1.1, Apache-2.0, Artistic-1.0, Artistic-2.0, PHP-3.0, PHP-3.01, PSF-2.0, Zlib, zlib-acknowledgement, BSL-1.0, OpenSSL, WTFPL, CC0-1.0, CC-PDDC, CC-BY-1.0, CC-BY-2.0, CC-BY-2.5, CC-BY-3.0, CC-BY-4.0, Unlicense, ISC, BlueOak-1.0.0, BSD-2-Clause-Patent, ADSL, Apache-2.0, APAFML, BSD-1-Clause, BSD-2-Clause, BSD-2-Clause-FreeBSD, BSD-2-Clause-NetBSD, BSD-2-Clause-Views, BSL-1.0, DSDP, ECL-1.0, ECL-2.0, ImageMagick, ISC, Linux-OpenIB, MIT, MIT-Modern-Variant, MS-PL, MulanPSL-1.0, Mup, PostgreSQL, Spencer-99, UPL-1.0, Xerox, 0BSD, AFL-1.1, AFL-1.2, AFL-2.0, AFL-2.1, AFL-3.0, AMDPLPA, AML, AMPAS, ANTLR-PD, ANTLR-PD-fallback, Apache-1.0, Apache-1.1, Artistic-2.0, Bahyph, Barr, BSD-3-Clause, BSD-3-Clause-Attribution, BSD-3-Clause-Clear, BSD-3-Clause-LBNL, BSD-3-Clause-Modification, BSD-3-Clause-No-Nuclear-License-2014, BSD-3-Clause-No-Nuclear-Warranty, BSD-3-Clause-Open-MPI, BSD-4-Clause, BSD-4-Clause-Shortened, BSD-4-Clause-UC, BSD-Source-Code, bzip2-1.0.5, bzip2-1.0.6, CC0-1.0, CNRI-Jython, CNRI-Python, CNRI-Python-GPL-Compatible, Cube, curl, eGenix, Entessa, FTL, HTMLTIDY, IBM-pibs, ICU, Info-ZIP, Intel, JasPer-2.0, Libpng, libpng-2.0, libtiff, LPPL-1.3c, MIT-0, MIT-advertising, MIT-open-group, MIT-CMU, MIT-enna, MIT-feh, MITNFA, MTLL, MulanPSL-2.0, Multics, Naumen, NCSA, Net-SNMP, NetCDF, NTP, OLDAP-2.0, OLDAP-2.0.1, OLDAP-2.1, OLDAP-2.2, OLDAP-2.2.1, OLDAP-2.2.2, OLDAP-2.3, OLDAP-2.4, OLDAP-2.5, OLDAP-2.6, OLDAP-2.7, OLDAP-2.8, OML, OpenSSL, PHP-3.0, PHP-3.01, Plexus, PSF-2.0, Python-2.0, Ruby, Saxpath, SGI-B-2.0, SMLNJ, SWL, TCL, TCP-wrappers, Unicode-DFS-2015, Unicode-DFS-2016, Unlicense, VSL-1.0, W3C, X11, XFree86-1.1, Xnet, xpp, Zlib, zlib-acknowledgement, ZPL-2.0, ZPL-2.1, AAL, Adobe-2006, Afmparse, Artistic-1.0, Artistic-1.0-cl8, Artistic-1.0-Perl, Beerware, blessing, Borceux, CECILL-B, ClArtistic, Condor-1.1, Crossword, CrystalStacker, diffmark, DOC, EFL-1.0, EFL-2.0, Fair, FSFUL, FSFULLR, Giftware, HPND, IJG, Leptonica, LPL-1.0, LPL-1.02, MirOS, mpich2, NASA-1.3, NBPL-1.0, Newsletr, NLPL, NRL, OGTSL, OLDAP-1.1, OLDAP-1.2, OLDAP-1.3, OLDAP-1.4, psutils, Qhull, Rdisc, RSA-MD, Spencer-86, Spencer-94, TU-Berlin-1.0, TU-Berlin-2.0, Vim, W3C-19980720, W3C-20150513, Wsuipa, WTFPL, xinetd, Zed, Zend-2.0, ZPL-1.1, GPL-2.0, GPL-2.0+, GPL-2.0-or-later, GPL-3.0, GPL-3.0+, GPL-3.0-or-later, LGPL-2.1, LGPL-2.1+, LGPL-2.1-or-later, LGPL-3.0, LGPL-3.0+, LGPL-3.0-or-later, MPL-1.1, MPL-2.0, MPL-2.0-no-copyleft-exception, CDDL-1.0, CDDL-1.1, CPL-1.0, IPL-1.0, EPL-1.0, EPL-2.0, Apache-1.0, CC-BY-SA-1.0, CC-BY-SA-2.0 Excluded from license check: OpenSSF Scorecard
Scanned Files
|
5 tasks done
nexx88
added a commit
that referenced
this pull request
Aug 17, 2026
…arser) (#6) ## Summary Fixes the 5 items surfaced by a whole-codebase security audit of `yaas-triage`. The audit found **no high-confidence (>=8) exploitable vulnerabilities**; these are the defense-in-depth / correctness hardening items below the exploitable bar. Each is a small, surgical change with tests kept green. | # | Fix | File | |---|-----|------| | 1 | Reject path traversal from an unvalidated `watch.json` `type` before it builds/execs the checker path (`[a-z0-9_]+` gate → misconfig verdict otherwise) | `tick.py` | | 2 | Apply the `log-event.py` quest_id traversal guard to `slack-send.py` so both send paths validate identically | `surfaces/slack-send.py` | | 3 | Drop `pending_review -> start` so the human-approval gate is structural, not dependent on the checker | `approval_state.py` | | 4 | Enforce header/TS adjacency in the Slack message parser (removes orphan/lone-TS mis-count) | `checkers/slack_utils.py` | | 5 | Remove dead `_find_watch_json` (unvalidated-path helper, unreferenced) | `ledger/approval-helper.py` | ## Known residual (finding #4) The Slack MCP returns messages as one flattened, unescaped **text** blob, so a body that forges an *adjacent* `=== header ===` + `Message TS:` pair remains indistinguishable from a real message boundary. The parser change enforces the format contract and closes the orphan/lone-TS path, but full closure needs structured (per-message) MCP output — documented inline with a `ponytail:` note. Impact is now further blunted by #3 (dispatch requires a structural review gate). ## Test plan - [x] 44/44 real suites pass; differential `tick.py` vs goldens **29/0** (no golden edits) - [x] `slack_utils`, all `approval-*`, `watch-guard`, `log-event`, `slack-send` suites green - [x] Functional: `slack-send.py --quest-id ../../etc` → `invalid quest id` exit 1; real ids pass through - [x] Functional: `wtype` guard accepts every real watch type, rejects traversal/dotted/empty - [x] Syntax + import checks on all 5 edited modules (The one full-suite failure, `path-references.test.sh`, is entirely a local gitignored `.ua/` plugin cache — 0 non-`.ua` refs — not code and not from this branch.) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Guangmian Kung <guangmian.kung@circle.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Captured source SHA:
378baa783b342783ce282b3eda15bf932e804d71This PR publishes a one-commit snapshot of YAAS v2 into
master. Local commit history remains preserved on.git-yaas-v2/main.The delivery worktree adjusts
.github/workflows/scan.ymlbranch filters frommaintomasterfor this repository so pull request and push checks run on the protected default branch.Local dirty and untracked files from the working tree were excluded from this snapshot.