A scenario declaring fonts: [{ source: "google", ... }] makes rustmotion validate and rustmotion still reach out to fonts.googleapis.com and write the result into the font cache. Neither command asks, and there is no equivalent of --allow-remote-include to gate it.
That matters because the declared consumer of a scenario is a model generating JSON, so the file is untrusted input. Validating someone else's scenario should not be a network operation, and on a CI runner it turns a lint step into an outbound fetch whose target the scenario author chose.
The path-containment half of this was closed on chantier/audit-2026-09-25: the font cache file name is now refused rather than rewritten when it would escape the cache directory. The network half is untouched — the call site deciding when to resolve a Google font sits outside the files that lot owned.
Reuse the shape of RemoteIncludePolicy rather than inventing a second authorization vocabulary. Deny by default with a named refusal naming the family, and one flag to opt in.
Related, and deliberately left alone: resolve_local_path canonicalizes and then reads, so the symlink swap between the two calls is still open. It is the same TOCTOU already accepted for WAV extraction; worth closing in the same pass if this one is done properly.
Refs #315
A scenario declaring
fonts: [{ source: "google", ... }]makesrustmotion validateandrustmotion stillreach out tofonts.googleapis.comand write the result into the font cache. Neither command asks, and there is no equivalent of--allow-remote-includeto gate it.That matters because the declared consumer of a scenario is a model generating JSON, so the file is untrusted input. Validating someone else's scenario should not be a network operation, and on a CI runner it turns a lint step into an outbound fetch whose target the scenario author chose.
The path-containment half of this was closed on
chantier/audit-2026-09-25: the font cache file name is now refused rather than rewritten when it would escape the cache directory. The network half is untouched — the call site deciding when to resolve a Google font sits outside the files that lot owned.Reuse the shape of
RemoteIncludePolicyrather than inventing a second authorization vocabulary. Deny by default with a named refusal naming the family, and one flag to opt in.Related, and deliberately left alone:
resolve_local_pathcanonicalizes and then reads, so the symlink swap between the two calls is still open. It is the same TOCTOU already accepted for WAV extraction; worth closing in the same pass if this one is done properly.Refs #315