Repository navigation
fix(security): remediate deep scan findings - #124
Merged
Merged
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved critical issues allow writes outside the selected repository, break published constructor and deconstruction compatibility, and permit fetching from unvalidated remotes.
7 open issues
What changed in this PR
This PR addresses security-scan findings across TinyPl0’s compiler, virtual machine, IDE, and maintenance tooling, with regression tests and regenerated API documentation.
Changes:
- Adds resource limits and reduces batch VM and syntax-highlighting memory use.
- Hardens file paths, maintenance execution, model-phase identifiers, and release inputs.
- Updates a build dependency, security regression coverage, API metadata, and the IDE worklog.
| File | Description |
|---|---|
| tests/Pl0.Tests/VirtualMachineResourceBoundaryTests.cs | Tests batch allocations and state preservation on I/O failure. |
| tests/Pl0.Tests/PCodeSerializerTests.cs | Tests input limits and escaped error text. |
| tests/Pl0.Tests/ParserInputBoundaryTests.cs | Tests empty and unterminated token streams. |
| tests/Pl0.Tests/PackageWorkflowContractTests.cs | Checks environment-based release input handling. |
| tests/Pl0.Tests/CompilerResourceBoundaryTests.cs | Tests source, token, and diagnostic limits. |
| tests/Pl0.Tests/ArchitectureGuardTests.cs | Allows the private build dependency override. |
| src/Pl0.Vm/VmState.cs | Adds internal control over stack cloning. |
| src/Pl0.Vm/VirtualMachine.cs | Runs batch execution without step snapshots. |
| src/Pl0.Ide/Pl0SourceEditorView.cs | Bounds highlighting and stores compact spans. |
| src/Pl0.Ide/Pl0.Ide.csproj | Pins the patched build dependency and updates version fields. |
| src/Pl0.Ide/packages.lock.json | Records the updated dependency graph. |
| src/Pl0.Core/CompilerOptions.cs | Adds configurable compiler resource limits. |
| src/Pl0.Cli/Program.cs | Checks input size and streams P-Code parsing. |
| scripts/tests/test_registry_probe_authority.py | Tests rejection of unauthorized registry probes. |
| scripts/tests/test_linux_maintenance_hardening.py | Explicitly authorizes fixture registry probes. |
| scripts/lib/maintenance_execution_context.py | Restricts network Git commands and execution configuration. |
| scripts/check-homogeneity.sh | Adds patch-target containment and symlink checks. |
| scripts/check-homogeneity.ps1 | Adds PowerShell patch-target validation. |
| docs/ide-worklog.md | Records remediation and reported validation results. |
| api/toc.yml | Adds the highlight-span documentation entry. |
| api/Pl0.Vm.VmStepStatus.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Vm.VmDiagnostic.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Vm.VirtualMachine.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Vm.Pl0VmMessages.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Vm.IPl0Io.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Vm.ConsolePl0Io.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.yml | Adds generated highlight-span references. |
| api/Pl0.Ide.TerminalGuiIdeRuntimeDialogService.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.TerminalGuiIdeMessageDialogService.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.TerminalGuiIdeFileDialogService.Pl0SaveAllowedType.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.Program.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.Pl0SourceFormatter.ProcedureFrame.yml | Updates source branch and line references. |
| api/Pl0.Ide.Pl0HighlightKind.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.PhysicalIdeFileStorage.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IIdeRuntimeDialogService.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IIdeMessageDialogService.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IIdeFileStorage.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IIdeFileDialogService.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IIdeCompilerSettingsDialogService.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IIdeAboutDialogService.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IdeRuntimeIo.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IdeLookAndFeel.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IdeEmitMode.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IdeDebugHighlightSpan.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IdeDebugHighlightKind.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IdeCompilerSettingsDialogResult.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Ide.IdeCodeDisplayMode.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Core.TextPosition.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Core.SymbolKind.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Core.Pl0Token.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Core.Pl0Dialect.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Core.Pl0CoreMessages.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Core.Pl0Compiler.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Core.LexerResult.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Core.LexerDiagnostic.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Core.Instruction.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Core.CompilerDiagnostic.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Core.CompilationResult.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Cli.Pl0CliMessages.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Cli.Cli.EmitMode.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Cli.Cli.CompilationDiagnostics.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Cli.Cli.CliParseResult.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Cli.Cli.CliHelpPrinter.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Cli.Cli.CliDiagnostic.yml | Refreshes generated source-branch metadata. |
| api/Pl0.Cli.Cli.CliCommand.yml | Refreshes generated source-branch metadata. |
| .specify/scripts/bash/common.sh | Validates inferred feature paths beneath specs/. |
| .specify/presets/parallel-autonomous-run-governance/tests/test-coordinator.ps1 | Tests rejection of unsafe worker identifiers. |
| .specify/presets/autonomous-run-governance/tests/test-model-routing.ps1 | Tests unsafe identifiers and updates routing-file expectations. |
| .specify/presets/autonomous-run-governance/scripts/invoke-autonomous-model-phase.ps1 | Validates phase path segments and run UUIDs. |
| .github/workflows/release-please.yml | Passes release inputs through environment variables. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Zusammenfassung
Ein Workflow-Befund war bereits vor diesem Branch erledigt, weil die betroffenen Claude-Workflows auf dem Basisstand nicht mehr existierten. Die übrigen 22 Befunde erhielten Code- oder Konfigurationskorrekturen.
Validierung
Security-Evidence
Source scan:
79821f6b-524a-43ae-a6b6-5aedd8b86824Der vollständige persistente Fixbericht liegt als Codex-Security-Artefakt
artifacts/fix_report.mdvor.