From 6a067174ede7d9123915c7363da9564a900265ce Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Fri, 31 Jul 2026 17:48:17 -0500 Subject: [PATCH] =?UTF-8?q?docs(remediation):=20bank=20D-9=20=E2=80=94=20c?= =?UTF-8?q?omms=20path=20shell-interprets=20message=20bodies?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit agent-send.sh -m with backticks executes them as command substitution: the recipient got a mangled body plus a shell error, and the send still reported success. Same class as the known pr-create.sh backtick bug — two tools in the comms path treating a message body as shell input. The failure mode is the mission's own pattern: silent corruption with a success receipt. Requirement on RM-40/RM-42: comms/v1 must carry payloads verbatim with no shell interpretation at any hop, with a byte-identical round-trip test (backticks, command substitution, quotes, newlines) registered under RM-02 including a must-fail control. Co-Authored-By: Claude Opus 5 (1M context) --- docs/remediation/TASKS.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md index 58e68115..0d6f92a5 100644 --- a/docs/remediation/TASKS.md +++ b/docs/remediation/TASKS.md @@ -93,6 +93,25 @@ and must not be cited as merge evidence. Rely on reviewer clearance + real CI. Three independent live instances in a single session — format gate, agent context reset, queue guard — is the class confirmed, not anecdote. +### D-9 — the comms path shell-interprets message bodies (injection-shaped, found by accident) + +Sending a status message with `agent-send.sh -m "...`backticks`..."` caused bash to **execute** the +backticked text as command substitution. The recipient received a mangled body plus a +`No such file or directory` error; the intended sentence never arrived. The message was reported as +delivered. + +This is the **same class** as the already-noted `pr-create.sh` backtick-quoting bug (M2 scratchpad): +**two tools in the comms path treat a message body as shell input.** A body that can execute on the +sender is a _correctness_ bug before it is ever a security one — and note the failure mode: the +send reported success while silently transmitting something other than what was written. Silent +corruption with a success receipt is precisely the pattern this mission exists to eliminate. + +**Requirement on RM-40 / RM-42 (comms/v1):** the envelope must carry its payload **verbatim**, and +the payload must not be subject to shell interpretation at **any** hop — sender, transport, or +adapter. Round-trip fidelity (send a body containing backticks, `$(…)`, quotes, and newlines; assert +byte-identical receipt) is a required registered test case under RM-02, including a must-fail control +proving the assertion can detect corruption. + ### D-8 — a PRE-REGISTERED acceptance check that was not runnable as written On PR #1025 the author (me) pre-registered AC2 with the fixture snippet `mkdir -p apps/*/venv/lib`.