After adversarial review of both codebases, closed real issues: Go client (trust boundary): - mode checks now cover special bits (setuid/setgid/sticky) and reject negative/out-of-range modes (no int64(-1) -> 0o7777 smuggling) - refuse symlink leaves + O_NOFOLLOW on open; omit symlinks from listings (defeats 'symlink at an allowed name -> /etc/passwd' and its TOCTOU variant) - wrong-typed write content is a protocol error, not a silent truncation - unknown frame types answer a protocol error; exit status clamped to 0..255; output streams refused on the control sid Ruby server: - validate hello protocol/capabilities types (clean ProtocolError, not a deep NoMethodError) - ignore responses for unknown/duplicate streams instead of crashing the session - ResponseError defaults; Session closes its transport when the worker ends; Transport::Queue close/deliver guarded by a mutex Adversarial tests added for every fix; PROTOCOL.md documents the enforcement model and the one known residual (intermediate-dir symlinks, #22). Verified: Ruby 92 examples 0 failures 99.5% line / 89.4% branch. Go protocol 95.9%, entitlement 100%, client 86.5%; vet + gofmt clean. Refs #14 #15 #16 #22

Uh oh!

Security / entitlement conformance vectors #22

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions