Authenticate Exocrate archives before extraction - #3627
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3627 +/- ##
=======================================
Coverage 91.85% 91.85%
=======================================
Files 20 20
Lines 6093 6093
=======================================
Hits 5597 5597
Misses 496 496 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: af082de62c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
af082de to
7c15c79
Compare
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Authored by an AI agent acting on Josh Liebow-Feeser's behalf. @googlebot rescan |
7c15c79 to
1ef6ed4
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1ef6ed4b53
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Exocrate previously unpacked a remote archive before checking its pinned SHA-256. If cleanup of a rejected archive failed, a later authentic download could reuse and promote residual attacker-controlled files. Spool and authenticate the complete compressed stream before parsing it, then extract those exact bytes. Use one versioned, parent-wide staging slot whose claim-bearing lock serializes cooperating installers and bounds process-crash residue without adopting an unclaimed path. Reserve the staging namespace from every absolute installation path and fail closed on unknown protocol state. Normalize protocol-owned directory permissions before recovery cleanup without following symlinks. Add regressions for authentication order, first-use races, process exit, permission-restricted residue, migration collisions, panic and rename cleanup, and filesystem-name normalization. Closes #3612 *Authored by an AI agent acting on Josh Liebow-Feeser's behalf.* gherrit-pr-id: Glahihffrli3s5lgyhtbnivg7cwjftslj
1ef6ed4 to
4d866f8
Compare
|
@codex review Authored by an AI agent acting on Josh Liebow-Feeser's behalf. |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Exocrate previously unpacked a remote archive before checking its pinned SHA-256. If cleanup of a rejected archive failed, a later authentic download could reuse and promote residual attacker-controlled files.
Spool and authenticate the complete compressed stream before parsing it, then extract those exact bytes. Use one versioned, parent-wide staging slot whose claim-bearing lock serializes cooperating installers and bounds process-crash residue without adopting an unclaimed path. Reserve the staging namespace from every absolute installation path and fail closed on unknown protocol state.
Normalize protocol-owned directory permissions before recovery cleanup without following symlinks. Add regressions for authentication order, first-use races, process exit, permission-restricted residue, migration collisions, panic and rename cleanup, and filesystem-name normalization.
Closes #3612
Authored by an AI agent acting on Josh Liebow-Feeser's behalf.
Latest Update: v4 — Compare vs v3
📚 Full Patch History
Links show the diff between the row version and the column version.
⬇️ Download this PR
Branch
git fetch origin refs/heads/Glahihffrli3s5lgyhtbnivg7cwjftslj && git checkout -b pr-Glahihffrli3s5lgyhtbnivg7cwjftslj FETCH_HEADCheckout
git fetch origin refs/heads/Glahihffrli3s5lgyhtbnivg7cwjftslj && git checkout FETCH_HEADCherry Pick
git fetch origin refs/heads/Glahihffrli3s5lgyhtbnivg7cwjftslj && git cherry-pick FETCH_HEADPull
Stacked PRs enabled by GHerrit.