Bash 'classifier unavailable' dialog passes no grant fingerprint
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 88/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
- Domain
- authorization, security
Research direction
Start at the unclassified bash call in index.ts:4625 and compare its arguments with the eval-tool call at index.ts:4207 and the other bash paths. Review matchingGrant at index.ts:3177-3187, then add the missing arguments and a regression test showing that a session grant from an unclassified bash dialog matches the next identical command.
Written by the indexing model from the issue text.
Description
Every requestPermission call on the bash path passes userScopeFingerprint except the unclassified one (index.ts:4625), which passes only four arguments, so tool and the fingerprint are both undefined:
return await requestPermission(
ctx,
target,
"unclassified",
classifyError ? `classifier unavailable: ${truncated(classifyError, 160)}` : "classifier unavailable",
);
The eval-tool sibling (index.ts:4207) passes all of them. A session grant chosen on a bash "classifier unavailable" dialog is therefore stored with an undefined evidence fingerprint. matchingGrant compares that against the live fingerprint (index.ts:3177-3187), so the grant either never matches again (the user is re-prompted after saying "allow for session") or behaves differently from grants taken on every other path.
Fix: pass "bash", "", userScopeFingerprint like the other bash calls, plus a test that a session grant taken on an unclassified bash dialog matches the next identical command.
Found while threading audit fields through the call sites in #77, which kept the gap as-is on purpose.
- Dominant language
- TypeScript
- Stars
- 0
- Forks
- 1
- Avg merge
- 1h 20m
- Merged PRs (30d)
- 32
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from STRML/omp-classifier
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
STRML/omp-classifier#81 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
STRML/omp-classifier#80 ·
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
STRML/omp-classifier#84 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
STRML/omp-classifier#82 ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
STRML/omp-classifier#73 ·
All issues in STRML/omp-classifier
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug clawsweeper:linked-pr-open clawsweeper:needs-live-repro clawsweeper:no-new-fix-pr impact:message-loss issue-rating: 🐚 platinum hermit P2 regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
fullcalendar/fullcalendar#8106 ·