mirror of
https://github.com/MadsLorentzen/ai-job-search.git
synced 2026-11-02 21:22:51 +00:00
Mads LorentzenandClaude Fable 5.1
0bcfd75e60
Three findings on tools/security_guards.py and tools/install_portal_clis.py. GHSA-rv99-7xf2-8f4p (Martin Vlach, @Huge): the gitignore guard stripped both ends of each line, but git drops only unescaped trailing whitespace, so " salary_data.json" satisfied the required-rule check while git had stopped ignoring the file. Only the root file was read, though a .gitignore in a subdirectory outranks it, so a negation there re-included personal data with CI green. Lines are now read as git reads them, and every .gitignore below the root (outside .git and node_modules) is checked for negations; an intentional one is allowlisted as "<dir>/.gitignore:!p". GHSA-cqcv-crx7-x7q7 (@folovco, @Huge): the guard checked allow, ask, deny and hooks and ignored every other key, so env, apiKeyHelper, a statusLine command, enableAllProjectMcpServers, permissions.defaultMode or additionalDirectories passed CI. Any top-level key outside ALLOWED_SETTINGS_KEYS and any permissions key outside ALLOWED_PERMISSIONS_KEYS now fails. GHSA-wq7j-x5jq-pjrw (@folovco, @Huge), on top of #718's --ignore-scripts (cherry-picked, rudycelekli): the installer and check 3 now refuse a manifest that declares workspaces (whose packages bring their own lifecycle scripts; a workspace postinstall ran under Bun 1.3.10) or that has a bunfig.toml beside it (which reconfigures the install). The advisory's workspace proof of concept is now skipped before bun runs. Twelve new tests, all failing before this change; SECURITY.md, README and SETUP describe the new checks. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>