molecule-ai/molecule-core
41
0
Fork 2
Code Issues 66 Pull Requests 45 Actions 363 Packages Projects Releases Wiki Activity

fix(handlers): hotfix CWE-78 regression on staging — partial refs stay literal #1068

Closed
core-be wants to merge 1 commits from hotfix/cwe-78-staging into staging
pull from: hotfix/cwe-78-staging
merge into: molecule-ai:staging
Conversation 6 Commits 1 Files Changed 3 +209 -14

1 Commits

Author SHA1 Message Date
Molecule AI Core-BE
0cecb85a6d fix(handlers): restore CWE-78 guard on staging — partial refs like \$HOME/path stay literal
Some checks failed
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 36s
Details
CI / Detect changes (pull_request) Successful in 1m16s
Details
Harness Replays / detect-changes (pull_request) Successful in 21s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 1m28s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 1m25s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 30s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m36s
Details
gate-check-v3 / gate-check (pull_request) Successful in 24s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 1m28s
Details
qa-review / approved (pull_request) Successful in 16s
Details
security-review / approved (pull_request) Successful in 19s
Details
sop-checklist / na-declarations (pull_request) awaiting /sop-n/a declaration for: qa-review, security-review
Details
sop-checklist / all-items-acked (pull_request) Successful in 26s
Details
sop-tier-check / tier-check (pull_request) Successful in 25s
Details
CI / Canvas (Next.js) (pull_request) Successful in 8s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 9s
Details
CI / Python Lint & Test (pull_request) Successful in 8s
Details
Harness Replays / Harness Replays (pull_request) Successful in 12s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 9s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2m23s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 5m13s
Details
CI / Platform (Go) (pull_request) Failing after 8m43s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
audit-force-merge / audit (pull_request) Has been skipped
Details
CI / all-required (pull_request) Successful in 10s
Details 
HOTFIX: PR #1059 merged the vulnerable os.Expand-based expandWithEnv to staging.
This reverts that and applies the correct byte-parser from main.

os.Expand splits $HOME/path into key="HOME" and key="/path". The callback
cannot distinguish whole-string from partial prefix — it fell back to
os.Getenv for any non-empty key absent from the env map, leaking the host's
HOME/PATH/USER env vars into org template values.

Fix: character-by-character parser. Only os.Getenv when ref==whole (the matched
$VAR/${VAR} IS the entire input). For partial refs like $HOME/path, return the
literal "$HOME" — no host env leak.

Test coverage: 14 new regression tests in org_helpers_security_test.go covering
$HOME/path, ${ROLE}/admin, prefix$ROLE/suffix, mixed partial+whole, etc.
Updated TestExpandWithEnv_PartiallyPresent to reflect correct behavior.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-14 20:38:10 +00:00