`get <uuid>` overrides socket.yml without the documented `policy_bypassed` warning (purl/CVE/GHSA forms do warn)
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
Start in crates/socket-patch-cli/src/commands/get.rs:2603-2700, tracing the IdentifierType::Uuid mode branches and compare them with the search path reaching policy_bypass_warnings at lines 2929-2933. Reproduce the hosted, vendored, and agent commands from the issue with socket.yml excluding the package. Done means UUID get reports policy_bypassed in warnings[] and on stderr whenever policy would skip the package.
由索引模型根據 Issue 內容生成。
描述
[agent] Found by the scheduled Pipenv bug-hunt routine (ledger #313).
Summary
The contract says get ignores socket.yml but has to say so when it does. When the repo's socket.yml would have skipped the package, get must warn policy_bypassed, both in warnings[] and on stderr. The purl, CVE and GHSA forms of get do this. The UUID form doesn't. get <uuid> takes an early-return path straight into the mode dispatch, and that path never calls policy_bypass_warnings. The package gets patched in every mode (agent, hosted, vendored) with exit 0, no stderr line, and no warnings key in the --json envelope.
I found this on a Pipenv project, but the code path doesn't depend on the ecosystem.
Impact
policy_bypassed is the only signal that a run overrode the repository's rollout policy (ignorePackages, ecosystems, includePaths/ignorePaths, minSeverity, enabled: false). A UUID is the identifier that dashboards, bots and the scan table all hand out. So the most common scripted get can push a patch the repo explicitly excluded (for example enabled: false during a freeze) and leave nothing in CI logs or JSON output to flag it.
Repro (Linux, main 2463257, Pipenv 2026.8.0 project, local mock patch API)
git init -q proj && cd proj
# Pipfile + Pipfile.lock pinning six==1.16.0 (pipfile-spec 6)
printf 'version: 2\npatches:\n ignorePackages: ["pkg:pypi/six"]\n' > socket.yml
socket-patch get pkg:pypi/[email protected] --mode hosted --yes --json | jq .warnings
# ["(policy_bypassed) pkg:pypi/[email protected] would be skipped by socket.yml (policy_package_ignored: pkg:pypi/six (patches.ignorePackages)); get patches it anyway"]
git checkout Pipfile.lock 2>/dev/null || cp Pipfile.lock.orig Pipfile.lock
socket-patch get <uuid-of-that-patch> --mode hosted --yes --json | jq .warnings
# null (Pipfile.lock is rewritten, exit 0, nothing on stderr)
Results from two runs, each identical:
| Command | exit | lock patched | warnings[] policy_bypassed |
stderr warning |
|---|---|---|---|---|
get pkg:pypi/[email protected] --mode hosted |
0 | yes | yes | yes |
get pkg:pypi/[email protected] --mode vendored |
0 | yes | yes | yes |
get <uuid> --mode hosted |
0 | yes | missing | missing |
get <uuid> --mode vendored |
0 | yes | missing | missing |
get <uuid> --mode agent |
0 | n/a (in place) | missing | missing |
Expected vs actual
- Expected:
crates/socket-patch-cli/CLI_CONTRACT.md(socket.yml, "Commands") says: "getis explicit intent: it ignores the policy and warnspolicy_bypassed(inwarnings[], and on stderr) when socket.yml would have skipped the package".docs/configuration.mdsays the same: "it bypasses policy and warns when a valid policy would exclude its target". Neither carves out the UUID form. - Actual: only the search-backed forms warn. The UUID form patches silently.
OS × version
| OS | Pipenv | reproduces |
|---|---|---|
| Linux | 2026.8.0 (SOCKET_PIPENV_MAJOR=2026) |
yes (2/2) |
| macOS / Windows | — | not probed. The code path is platform-independent. |
First bad
socket.yml arrived with #277 (2463257) and isn't in any published release (v4.0.0 predates it). So the bug has been there since the feature landed.
Suspect code
crates/socket-patch-cli/src/commands/get.rs:2603-2700: theIdentifierType::Uuidbranch returns from thematch modedispatch (save_and_apply_patch/run_get_hosted(…, &[], &[])/run_get_vendored(…, &[], &[])) with empty warning lists.crates/socket-patch-cli/src/commands/get.rs:2929-2933: the only call site ofsuper::scan::policy::policy_bypass_warnings, which only the search path reaches.
- 主要語言
- Rust
- 星號
- 8
- 分支
- 0
- 平均合併
- 18 小時 4 分鐘
- 30 天內合併 PR
- 70
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
SocketDev/socket-patch 的其他 Issue
-
agent:triaged bug bughunt pm:composer priority:p2
難度 2/5 1-3 小時 新手友好度 90/100
SocketDev/socket-patch#515 · 1 則留言 ·
維護者通常 1 天內回覆
-
agent:triaged bug bughunt pm:npm priority:p1
難度 2/5 1-3 小時 新手友好度 82/100
SocketDev/socket-patch#464 · 1 則留言 ·
維護者通常 1 天內回覆
-
agent:triaged bug bughunt pm:npm priority:p1
難度 2/5 1-3 小時 新手友好度 82/100
SocketDev/socket-patch#433 · 1 則留言 ·
維護者通常 1 天內回覆
-
agent:triaged bug bughunt pm:uv priority:p1
難度 2/5 1-3 小時 新手友好度 78/100
SocketDev/socket-patch#408 · 1 則留言 ·
維護者通常 1 天內回覆
-
agent:triaged bug bughunt pm:yarn-berry priority:p1
難度 2/5 1-3 小時 新手友好度 82/100
SocketDev/socket-patch#370 · 2 則留言 ·
維護者通常 1 天內回覆
查看 SocketDev/socket-patch 的全部 Issue
相似的 Issue
-
Change output crossing a compactsize boundary leaves the fee slightly below the requested feerate未關閉bug
難度 2/5 1-3 小時 新手友好度 78/100
bitcoindevkit/bdk_wallet#578 ·
維護者通常 8 天內回覆
-
難度 2/5 1-3 小時 新手友好度 88/100
維護者通常 2 天內回覆
-
難度 2/5 1-3 小時 新手友好度 72/100
521xueweihan/HelloGitHub#3832 ·
-
難度 2/5 1-3 小時 新手友好度 84/100
-
難度 2/5 1-3 小時 新手友好度 82/100
canonical/opentelemetry-collector-operator#409 ·
維護者通常 1 天內回覆