Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Harden the docs-fetcher gate and raw-read stage (follow-ups from #6481 security review)

Cerrado
  • ¿Algo no está bien?
#6,488 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
55/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
bash, javascript, node.js
Área
security

Línea de trabajo

Start by reading the security review context in PR #6481, then the four named entry points: lib/docs-fetcher-gate.mjs plus both plugins/*/hooks/hooks.json (item 1, fail-open), plugins/discovery/agents/docs-fetcher.md maxTurns (item 2), parseRaw in plugins/discovery/workflows/research-sweep.js and plugins/multi-agent/workflows/drift-audit.js (item 3), and lib/fetch-docs.sh (item 4). Each item states its own fix, so pick one, implement it, and verify by simulating the failure (missing node, mismatched byte length, curl args). "Done" means the gate denies instead of failing open and each stage rejects a bad raw slice.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

needs-human needs-triage

The ready-flip security review of #6481 (docs-fetcher agent, its PreToolUse Bash gate, and the raw-read stage in research-sweep and drift-audit) found four hardening items. None blocks the PR; each needs its own design or a behavior check, so they are filed here instead of folded into it.

1. The gate fails open when it cannot run (P3, structural)

plugins/discovery/hooks/hooks.json and plugins/multi-agent/hooks/hooks.json launch lib/docs-fetcher-gate.mjs with node. When node is missing, the hook times out (10 s), or the script crashes (for example a stdin error event, which main() does not handle), Claude Code treats the hook error as non-blocking, so the docs-fetcher's Bash is held only by the session's permission rules. Under auto mode or a broad Bash allow rule, a command injected by page text could run. prerequisites.json already says so for a missing node.

Options: deny on a stdin error when the agent_type matches; have the workflows skip the Fetch stage unless a node probe passed (/discovery:check, /multi-agent:check); or wrap the hook in a shell form that exits 2 when node is absent and stdin names the fetcher. Mention the fail-open in both README docs-fetcher rows.

2. The discovery docs-fetcher can make several fetches of attacker-chosen URLs (P4)

plugins/discovery/agents/docs-fetcher.md sets maxTurns: 4, and the discovery gate allows any public https host with a query string, any number of times. A fetched page could tell the fetcher to call docs-raw.sh again on https://attacker.example/?d=<data> and leak what is in its context. "Never retry" is an instruction only.

Options: lower maxTurns to the minimum one Bash call plus the structured return needs (check the turn count a structured-output return takes before lowering it); optionally deny query strings in the discovery gate, with rawable() matching.

3. Raw slices are a model's copy, and parseRaw checks only the header URL (P4, structural)

In plugins/discovery/workflows/research-sweep.js and plugins/multi-agent/workflows/drift-audit.js, parseRaw checks that the header URL equals the requested URL, but the body is up to 64 KB retyped by the fetcher model. Injected page text or a copy error can produce a wrong body under a valid header, and readers and skeptics prefer slices over their own WebFetch.

Fix: compare the header's bytes= with the body's UTF-8 length, and for kind=page the sha256= with a hash of the body when the runtime has one; mark the slice unread on a mismatch.

4. curl inherits ~/.curlrc on attacker-steered requests (P4)

lib/fetch-docs.sh (and synced copies) runs curl without -q, so a user's ~/.curlrc (insecure, proxy, user) applies to requests whose URL a web page chose, which can remove the TLS name check that currently limits redirect and DNS SSRF to trusted https hosts. Fix: pass -q as curl's first argument and re-sync the copies. Separately, decide whether off-origin redirects should be refused before they are followed.

Lower priority

  • plugins/discovery/hooks/webfetch-truncation.mjs puts tool_input.url verbatim and unbounded into additionalContext; echo a normalized, length-capped form instead.
  • Up to 40 attacker-sized pages per sweep can enter the shared docs cache and push the user's own entries out of the LRU; consider a per-run cache dir for generic hosts.
Lenguaje dominante
Shell
Estrellas
22
Forks
2
Merge medio
5 h 11 min
PR fusionados (30 d)
838

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de melodic-software/claude-code-plugins

Todos los issues de melodic-software/claude-code-plugins

Issues similares

Más issues de Shell/Bash

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.