dillenberg/ECC
1
0
Fork 0
mirror of https://github.com/Jeuners/ECC.git synced 2026-09-12 08:22:29 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: reject credential-bearing Itō CLI shims (#2559)

Browse source
This commit is contained in:
Affaan Mustafa 2026-07-23 21:07:59 -07:00 • committed by GitHub
parent 7dc2c116e7
commit 34fbe007f0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 108 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

76
tests/scripts/ito-cli-bridge.test.js
View file

@ -30,8 +30,17 @@ function runCli(args, environment = {}) {
function makeItoProbe(exitCode = 0) {
const directory = fs.mkdtempSync(path.join(os.tmpdir(), "ecc-ito-cli-"));
const log = path.join(directory, "invocation.json");
const script = path.join(directory, "ito-probe.js");
const script = path.join(
directory,
"ito-cloud-runtime",
"cli",
"ito-compute-cli",
"dist",
"bin",
"ito.js"
);
const executable = script;
fs.mkdirSync(path.dirname(script), { recursive: true });
fs.writeFileSync(
script,
[
@ -230,6 +239,71 @@ function main() {
fs.rmSync(collisionDirectory, { recursive: true, force: true });
}
}],
["rejects an absolute POSIX shim before it can resolve an interpreter through PATH", () => {
if (process.platform === "win32") return;
const directory = fs.mkdtempSync(path.join(os.tmpdir(), "ecc-hostile-ito-shim-"));
const shim = path.join(directory, "ito");
const hostileNode = path.join(directory, "node");
const stolenEnvironment = path.join(directory, "stolen.json");
try {
fs.writeFileSync(shim, "#!/usr/bin/env node\n");
fs.writeFileSync(
hostileNode,
[
"#!/bin/sh",
`env > ${JSON.stringify(stolenEnvironment)}`,
"",
].join("\n")
);
fs.chmodSync(shim, 0o755);
fs.chmodSync(hostileNode, 0o755);
const result = runCli(["ito", "auth"], {
ECC_ITO_CLI_EXECUTABLE: shim,
ITO_API_KEY: "must-never-reach-shim-interpreter",
PATH: directory,
});
assert.notStrictEqual(result.status, 0);
assert.match(result.stderr, /canonical dist\/bin\/ito\.js/i);
assert.ok(
!fs.existsSync(stolenEnvironment),
"a shim-resolved interpreter must never receive the Itô credential"
);
} finally {
fs.rmSync(directory, { recursive: true, force: true });
}
}],
["rejects a readable JavaScript decoy outside the canonical package entry", () => {
const directory = fs.mkdtempSync(path.join(os.tmpdir(), "ecc-hostile-ito-js-"));
const decoy = path.join(directory, "ito.js");
const stolenEnvironment = path.join(directory, "stolen.json");
try {
fs.writeFileSync(
decoy,
[
'"use strict";',
'const fs = require("fs");',
`fs.writeFileSync(${JSON.stringify(stolenEnvironment)}, JSON.stringify(process.env));`,
"",
].join("\n")
);
const result = runCli(["ito", "auth"], {
ECC_ITO_CLI_EXECUTABLE: decoy,
ITO_API_KEY: "must-never-reach-js-decoy",
});
assert.notStrictEqual(result.status, 0);
assert.match(result.stderr, /canonical dist\/bin\/ito\.js/i);
assert.ok(
!fs.existsSync(stolenEnvironment),
"an arbitrary JavaScript file must never receive the Itô credential"
);
} finally {
fs.rmSync(directory, { recursive: true, force: true });
}
}],
["rejects a relative executable override instead of searching or guessing", () => {
const result = runCli(["ito", "status"], {
ECC_ITO_CLI_EXECUTABLE: "ito",