Skip to content

πŸ›‘οΈ Sentinel: [security improvement] #2049

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
seonghobae wants to merge 1 commit into
base: main
Choose a base branch
from
+9 βˆ’5
Open

πŸ›‘οΈ Sentinel: [security improvement] #2049

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,3 +43,7 @@
**Vulnerability:** Denial of Service / Availability
**Learning:** Strix security scanners crashed when the backend LLM returned an 'internal server error' HTTP 500 response. This was because 'internal server error' string match was missing from the `is_llm_api_connection_error` function in the Strix retry gate.
**Prevention:** Always include `internal server error` in string match conditions when handling HTTP API Connection exceptions for LLM backends to ensure proper fail-closed and retry handling.
## 2026-09-08 - Overly Permissive Regex for URL Parameters
**Vulnerability:** Permissive regex `^[A-Za-z0-9_.-]+$` used for repo and org names allowed leading/trailing/consecutive dots, creating SSRF and path traversal risks when constructing URLs.
**Learning:** Basic alphanumeric regex with dots is insufficient for URL parameter validation as it permits path traversal sequences like `..`.
**Prevention:** Use negative lookaheads `^(?!.*(?:\.\.|\.$))[A-Za-z0-9_.-]+$` to explicitly reject trailing and consecutive dots in URL parameters.
4 changes: 2 additions & 2 deletions scripts/ci/agent_mention_sweep.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,8 @@
)
from redact_sensitive_log import redact_text

ORG_NAME_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
REPOSITORY_RE = re.compile(r"^ContextualWisdomLab/[A-Za-z0-9_.-]+$")
ORG_NAME_RE = re.compile(r"^(?!.*(?:\.\.|\.$))[A-Za-z0-9_.-]+$")
REPOSITORY_RE = re.compile(r"^ContextualWisdomLab/(?!.*(?:\.\.|\.$))[A-Za-z0-9_.-]+$")
REPOSITORY_SOURCES = frozenset({"organization", "installation"})
REPOSITORY_ROTATION_SECONDS = 5 * 60
# The sweep-organization-agent-mentions job has a 900s (15-minute) GitHub
Expand Down
2 changes: 1 addition & 1 deletion scripts/ci/organization_commercial_readiness_loop.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@


DEFAULT_ORGANIZATION = "ContextualWisdomLab"
ORGANIZATION_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
ORGANIZATION_RE = re.compile(r"^(?!.*(?:\.\.|\.$))[A-Za-z0-9_.-]+$")
ENTRYPOINT_MARKER = "# cwl-org-commercial-entrypoint: v1"
CENTRAL_REPOSITORY = f"{DEFAULT_ORGANIZATION}/.github"
CENTRAL_REPAIR_EVENT = "pr-review-fix-scheduler"
Expand Down
2 changes: 1 addition & 1 deletion scripts/ci/reconcile_repository_labels.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@


ORGANIZATION = "ContextualWisdomLab"
REPOSITORY_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
REPOSITORY_RE = re.compile(r"^(?!.*(?:\.\.|\.$))[A-Za-z0-9_.-]+$")


class TaxonomyError(ValueError):
Expand Down
2 changes: 1 addition & 1 deletion scripts/ci/reconcile_repository_metadata.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@


ORGANIZATION = "ContextualWisdomLab"
REPOSITORY_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
REPOSITORY_RE = re.compile(r"^(?!.*(?:\.\.|\.$))[A-Za-z0-9_.-]+$")
TOPIC_RE = re.compile(r"^[a-z0-9][a-z0-9-]{0,49}$")
MAX_DESCRIPTION_CHARS = 350
PAGES_BASE_URL = f"https://{ORGANIZATION.casefold()}.github.io"
Expand Down
Loading