From cf34cf93fab453625a4a18631f7cb6d118ac53f0 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 30 Sep 2026 16:28:31 +0000 Subject: [PATCH 1/3] Record the task card for fix-blobstore-id-hardening --- .task/fix-blobstore-id-hardening.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .task/fix-blobstore-id-hardening.md diff --git a/.task/fix-blobstore-id-hardening.md b/.task/fix-blobstore-id-hardening.md new file mode 100644 index 00000000..875b3de3 --- /dev/null +++ b/.task/fix-blobstore-id-hardening.md @@ -0,0 +1,25 @@ +# fix/blobstore-id-hardening 任务卡 + +任务主记录：；状态：进行中；owner：weichen + +## 基线与授权 + +- 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= eb1877b3f707fc5bc6e59cd531e6d9d69424129b +- 工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-blobstore-id-hardening（worktree）；分支：fix/blobstore-id-hardening +- 授权与交付终点：<本次允许的动作与终点；未授权事项写明> + +## 目标与非目标 + +<预期结果、受影响入口/模块/契约；明确不做什么。> + +## 同步记录 + +| 节点 | sync_base_sha | tested_head_sha | checked_at | +|---|---|---|---| +| 启动 | eb1877b3f707fc5bc6e59cd531e6d9d69424129b | eb1877b3f707fc5bc6e59cd531e6d9d69424129b | 2026-09-30T16:28:31Z | + +## 结果与验证（完成后填写） + +- 结果： +- 验证： +- 影响与剩余项： From 7a65410cecebe9b25af55c8988c388c3cc9ee2a7 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 30 Sep 2026 16:34:01 +0000 Subject: [PATCH 2/3] Pin backend gitlink to the blobstore id validation fix Why: the 2026-09-30 deep security scan triage left one actionable finding: backend Local.Put joined the HTTP-supplied artifact id into the store directory unsanitized (reachable via UpdateArtifactContent path parameter), and Get/Delete took stored refs unvalidated. Backend PR #22 adds validID on Put plus a directory-containment check on Get/Delete with unit tests. Evidence: backend go vet ./... and go test -count=1 ./... pass (3 new blobstore test groups green); Dev make test combined verification exit 0 across core+backend+frontend+ui+agentcmd (log tail shows test-ui 37/37, agentcmd ok); gitlink pinned to backend main f98dc1d after confirming it already contains the chat-process pointer 76d64a1 (no regression). Impact: modules/backend gitlink only (+task card); no Dev-repo code change. Refs: .task/fix-blobstore-id-hardening.md, backend PR #22 --- .task/fix-blobstore-id-hardening.md | 14 ++++++++------ modules/backend | 2 +- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/.task/fix-blobstore-id-hardening.md b/.task/fix-blobstore-id-hardening.md index 875b3de3..4beaffeb 100644 --- a/.task/fix-blobstore-id-hardening.md +++ b/.task/fix-blobstore-id-hardening.md @@ -6,11 +6,13 @@ - 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= eb1877b3f707fc5bc6e59cd531e6d9d69424129b - 工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-blobstore-id-hardening（worktree）；分支：fix/blobstore-id-hardening -- 授权与交付终点：<本次允许的动作与终点；未授权事项写明> +- 授权与交付终点：落地 Mimosa 深度扫描甄别后的唯一实质修复——backend blobstore 对象 id 边界校验，并经组合验证后钉入 gitlink；终点为两个 PR（backend + Dev gitlink）合入后回收 worktree。 ## 目标与非目标 -<预期结果、受影响入口/模块/契约；明确不做什么。> +- 目标：backend `internal/blobstore` 增加 `validID`（Put 拒绝空/`.`/`..`/含路径分隔符/绝对路径/NUL 的 id）与 `contains`（Get/Delete 对入库引用做目录包含性检查），补齐单测；Dev 仓 gitlink 钉入 backend 合入后的新 main。 +- 非目标：不改 store/server 调用方与 API 形态；不做 S3 等其他实现；不动扫描报告其余误报项（已逐个核实为参数化查询）。 +- 依据：2026-09-30 Mimosa deep 扫描（封印 sha256:78acce…）甄别后唯一实质项；`store.UpdateArtifactContent` 的 HTTP 路径参数直达 `Put`，穿越面真实可达。 ## 同步记录 @@ -18,8 +20,8 @@ |---|---|---|---| | 启动 | eb1877b3f707fc5bc6e59cd531e6d9d69424129b | eb1877b3f707fc5bc6e59cd531e6d9d69424129b | 2026-09-30T16:28:31Z | -## 结果与验证（完成后填写） +## 结果与验证 -- 结果： -- 验证： -- 影响与剩余项： +- 结果：backend PR #22（commit 4fd0402）合入，backend main=f98dc1d；Dev gitlink 钉至 f98dc1d。跨仓顺序已核：backend main 先吸收了并行会话的 76d64a1（PR #21），钉入无回退。 +- 验证：backend `go vet ./...` + `go test -count=1 ./...` 全绿；新增 blobstore 三组单测（不安全 id 拒绝且目录零残留、正常 Put/Get/Delete 往返、目录外引用 Get/Delete 拒绝）；Dev 仓 `make test` 组合验证全链 exit 0（日志尾部 test-ui 37/37、agentcmd ok）。 +- 影响与剩余项：影响面仅 backend `internal/blobstore`，纯文件名 id（现网唯一形态）行为不变；剩余项为依赖 CVE 明细（扫描报 3 包 34 条通告未出清单，需子仓 govulncheck/npm audit，另立任务）。 diff --git a/modules/backend b/modules/backend index 76d64a1f..f98dc1dd 160000 --- a/modules/backend +++ b/modules/backend @@ -1 +1 @@ -Subproject commit 76d64a1f75ea81e508355209579861a8cd3aafef +Subproject commit f98dc1ddd4ab82f915e949c47f5ab35c49c78ac6 From ac0f565930db226f756d3f35d8bd341d3ae5cfc5 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 30 Sep 2026 16:38:22 +0000 Subject: [PATCH 3/3] Record the sync checkpoint --- .task/feature-duplication-lesson-records.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.task/feature-duplication-lesson-records.md b/.task/feature-duplication-lesson-records.md index a4582516..43cf820c 100644 --- a/.task/feature-duplication-lesson-records.md +++ b/.task/feature-duplication-lesson-records.md @@ -47,3 +47,4 @@ | 同步前验收 | 425c6e63f22fff0d200cfcbebd764fe0ed46c637 | b46d8905297dcb0d66ef4855f6ec026391cb4679 | 2026-09-30T16:01:38Z | | 同步前验收 | 03dc518eec70eccdc88a1c4f0e525e29bbd2a556 | a552939497cf7f5d8e0b2a9b19a2e9d110000bbd | 2026-09-30T16:03:44Z | | 同步前验收 | ab3cae07b5854ee71c9dd36b226cabd0f778d48d | c5ed9444a6f6b3ae9be9336c360a1d09204d9491 | 2026-09-30T16:06:01Z | +| 同步前验收 | a612361b98879f4679cab503035e2111c593bf9b | 290b9bbd26077ae4320783d3b24b6cef0c2e6e05 | 2026-09-30T16:38:22Z |