mirror of
https://github.com/stablyai/orca.git
synced 2026-09-29 16:02:50 +00:00
NeilandOrca
5c59c84c7a
* fix(plugins): close trust-boundary holes in the plugin system
Move five security decisions to their chokepoints rather than leaving them
enumerated at individual call sites.
- Kill-list revocation reaches content packs: PluginContentPackRegistry now
takes an isKilled predicate and intersects it with any caller-supplied
approval, so a killed plugin's VM recipes can no longer reach
spawn(..., { shell: true }) through either reconcile() call site.
- Bound kill-list generatedAt to a 24h future skew at the parse chokepoint.
A far-future timestamp previously made every genuine later list look
"older" and disabled revocation permanently, persisted across restarts.
- Protect the whole auto.components.settings.Plugin* translation subtree
instead of an enumerated prefix list, so language packs cannot forge the
consent provenance badge or rewrite install-error security copy.
- Resolve manifest panel icons by own-key only; "constructor"/"__proto__"
previously yielded non-component prototype members that crashed the
right sidebar to its error boundary.
- Give panel liveness frames a reserved control budget so a panel that
saturates its action budget can still answer the watchdog.
Co-authored-by: Orca <help@stably.ai>
* fix(plugins): keep the kill-list future bound off the cache read path
The schema-level generatedAt bound re-judged the on-disk cache against the
device clock at every launch, so a client whose clock ran behind the last
genuine publication discarded its whole cached kill list and started with
zero revocations. Move the bound to the two fetch chokepoints instead.
Co-authored-by: Orca <help@stably.ai>
* fix(plugins): remove the reserved-lane starvation window and the revocation TOCTOU
Review follow-ups on the trust-boundary fixes:
- The reserved liveness lane had a per-window count equal to the ping
interval, so a panel's own pong-shaped traffic could spend it and drop
the next genuine reply — reintroducing the starvation the lane exists to
prevent. The lane is now size-bounded only; rate stays bounded because
every pong is also charged to the data budget.
- Only schema-valid pongs take the lane now, so near-miss pong-shaped junk
cannot drain it. readPanelPongId replaces the zod parse on this
guest-controlled path (a rejected safeParse allocates an issue list, ~90x
the accepted-path cost) and is pinned to the schema by a parity test.
- Re-read the kill list inside approveAtomically: approvedKeys is snapshotted
before an awaited verification phase, so a plugin killed during that wait
could still publish VM recipes and language packs.
- Assert the curated icon resolves to FileText; the old equality also passed
when both sides fell back to Plug.
Co-authored-by: Orca <help@stably.ai>
* fix(plugins): match zod's safe-integer bound in the pong reader
readPanelPongId used Number.isInteger, but zod's .int() rejects anything
above 2**53-1, so pingIds like 1e100 took the reserved lane the schema
would have refused. The parity test never probed that boundary.
Co-authored-by: Orca <help@stably.ai>
---------
Co-authored-by: Orca <help@stably.ai>
47 lines
1.7 KiB
TypeScript
47 lines
1.7 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { PANEL_PONG_TYPE, panelPongSchema, readPanelPongId } from './plugin-panel-bridge'
|
|
|
|
/** `readPanelPongId` is hand-rolled to avoid zod's ~90x rejected-parse
|
|
* allocation cost on the guest-controlled bridge path. It must therefore
|
|
* accept exactly what `panelPongSchema` accepts, forever. */
|
|
|
|
const CASES: unknown[] = [
|
|
{ type: PANEL_PONG_TYPE, pingId: 0 },
|
|
{ type: PANEL_PONG_TYPE, pingId: 7 },
|
|
{ type: PANEL_PONG_TYPE, pingId: Number.MAX_SAFE_INTEGER },
|
|
// Above the safe range zod's .int() refuses, though Number.isInteger accepts.
|
|
{ type: PANEL_PONG_TYPE, pingId: Number.MAX_SAFE_INTEGER + 1 },
|
|
{ type: PANEL_PONG_TYPE, pingId: 2 ** 60 },
|
|
{ type: PANEL_PONG_TYPE, pingId: 1e100 },
|
|
{ type: PANEL_PONG_TYPE, pingId: Number.MAX_VALUE },
|
|
{ type: PANEL_PONG_TYPE, pingId: 7, extra: 'ignored' },
|
|
{ type: PANEL_PONG_TYPE, pingId: -1 },
|
|
{ type: PANEL_PONG_TYPE, pingId: 1.5 },
|
|
{ type: PANEL_PONG_TYPE, pingId: Number.NaN },
|
|
{ type: PANEL_PONG_TYPE, pingId: Number.POSITIVE_INFINITY },
|
|
{ type: PANEL_PONG_TYPE, pingId: '7' },
|
|
{ type: PANEL_PONG_TYPE, pingId: null },
|
|
{ type: PANEL_PONG_TYPE },
|
|
{ type: 'orca-panel-action', pingId: 7 },
|
|
{ pingId: 7 },
|
|
'orca-panel-pong',
|
|
null,
|
|
undefined,
|
|
42,
|
|
[]
|
|
]
|
|
|
|
describe('readPanelPongId', () => {
|
|
it.each(CASES.map((data, index) => [index, data]))(
|
|
'agrees with panelPongSchema on case %i',
|
|
(_index, data) => {
|
|
expect(readPanelPongId(data) !== null).toBe(panelPongSchema.safeParse(data).success)
|
|
}
|
|
)
|
|
|
|
it('returns the pingId the watchdog must correlate against', () => {
|
|
expect(readPanelPongId({ type: PANEL_PONG_TYPE, pingId: 7 })).toBe(7)
|
|
expect(readPanelPongId({ type: PANEL_PONG_TYPE, pingId: 0 })).toBe(0)
|
|
})
|
|
})
|