Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Vendored Hatch runs a `hatch` executable planted in the scanned project

Chiusa Adatta ai principianti
  • Qualcosa non va?
#613 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@mikolalysenko ci sta già lavorando.

Dal 2/10/2026.

  • #617 di @mikolalysenko — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
Mezza giornata
Idoneità per principianti
88/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
cli, security

Direzione di ricerca

Inizia in crates/socket-patch-core/src/vendor/pypi_hatch.rs, all’interno di require_environment_context_support, e confronta i pattern sicuri di spawn in utils/process.rs, vendor/npm_dir.rs e patch/redirect/npmrc.rs. Aggiungi una copertura di regressione per un eseguibile Hatch piantato e per un eseguibile con PATH assoluto, quindi esegui cargo test -p socket-patch-core vendor::pypi_hatch e i test end-to-end di Hatch vendored; il lavoro è completato quando l’eseguibile piantato non viene eseguito e il controllo della versione continua a funzionare.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

agent:claimed agent:triaged arch-audit bug pm:hatch priority:p1

[agent] Filed by the scheduled architecture audit routine (CLI and core). Register: discussion #560 register.

Kind: bug. Source: §1 #4; Part 7.3. Register row C04.

Problem

require_environment_context_support spawns the bare name hatch from inside the scanned project:
vendor/pypi_hatch.rs#L114-L135

tokio::process::Command::new("hatch")
    .arg("--version")
    .current_dir(root)

It runs whenever a vendored Hatch project has an environment dependency on the patched package (#L103-L105).``

utils/process.rs#L23-L42 documents this exact pattern as unsafe. A relative PATH entry (. or an empty component) resolves against the child's cwd, so a bare spawn runs a hatch file committed to the repository being scanned. Every other spawn uses resolve_tool and spawns the resolved path, for example git in vendor/npm_dir.rs#L453 and node in redirect/npmrc.rs#L315. This is the only production bare-name spawn left. #442 closed the global package-manager probes but didn't touch this one.

Reproduced twice on 045d7ec with a temporary unit test in pypi_hatch.rs (not committed):

  • root/hatch is an executable script that touches root/PWNED and prints Hatch, version 1.13.0;
  • PATH is set to .:$PATH, and no real hatch is installed;
  • the test calls require_environment_context_support(root).

Output: result=Ok(()) pwned=true resolve_tool=None. The planted script ran, and its fake version also passed the >=1.2 gate. resolve_tool("hatch") returns None on the same PATH, so the shared helper would have refused it.

Symptoms

None filed. This is the same class as #421, #434 and #438 (bare spawns), which were fixed by #442 for the PM probes.

Impact

Arbitrary code execution from a scanned checkout when the user's PATH contains a relative entry, which is common in some CI images and dev shells. On macOS, posix_spawnp can run both the planted file and the real binary (see the process.rs doc). The fix is small.

Proposed change

  • Resolve with crate::utils::process::resolve_tool("hatch"). When it returns None, take the existing "Hatch >=1.2 on PATH" refusal.
  • Spawn the resolved path through process::command_for (lifted with tokio::process::Command::from), keeping current_dir(root), the null stdin, kill_on_drop and the 10 s timeout.
  • Nothing else changes; the bare spawn is deleted.

Size and scope

crates/socket-patch-core/src/vendor/pypi_hatch.rs only, about 10 production lines plus tests. Out of scope: the Hatch {root:uri} issues #505 and #547.

Acceptance criteria

  • No Command::new("hatch") remains in production code.
  • A Unix regression test: a planted executable hatch in root with PATH=.:<dirs without hatch> is not executed (its marker file is absent), and the result is pypi_hatch_unsupported.
  • A test where a real-looking hatch on an absolute PATH dir is used and passes the version gate.
  • Optional: an architecture test banning Command::new("<literal>") in core/CLI production code outside utils/process.rs, so the next bare spawn fails CI.
  • cargo test -p socket-patch-core vendor::pypi_hatch and the vendored Hatch e2e stay green.

Dependencies

None. No open PR touches pypi_hatch.rs.

Lingua principale
Rust
Stelle
8
Fork
0
Merge medio
19h 21m
PR unite (30g)
421

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di SocketDev/socket-patch

Tutte le issue di SocketDev/socket-patch

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.