From 539b475a923fe330822cd9f55be51cbfcc6ae140 Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Thu, 30 Jul 2026 11:56:18 +0000 Subject: [PATCH] fix(wake): #943 whole-string validation for WAKE_SNAPSHOT_TS_FUTURE_SLACK + version 0.6.13 grep is line-oriented, so a multi-line knob value passed the per-line anchors and was still fatal in arithmetic. Replaced with a case pattern matching the whole string, so an embedded or leading newline rejects. Manifest bumped 0.6.12 -> 0.6.13: three materially different detectors had shipped under one version string, and version= is the component sole self-identity claim. Authored-by: pepper Reviewed-by: mos-dt (independent, at this head; transfer proven by blob-hash equality) Merged-by: Mos Co-authored-by: mos-dt-0 --- .../mosaic/framework/tools/wake/detector.sh | 18 ++++++++--- .../mosaic/framework/tools/wake/manifest.txt | 32 +++++++++++++++---- .../tools/wake/test-wake-detector.sh | 22 ++++++++++++- 3 files changed, 59 insertions(+), 13 deletions(-) diff --git a/packages/mosaic/framework/tools/wake/detector.sh b/packages/mosaic/framework/tools/wake/detector.sh index 4eea6248..d0c33175 100755 --- a/packages/mosaic/framework/tools/wake/detector.sh +++ b/packages/mosaic/framework/tools/wake/detector.sh @@ -295,16 +295,24 @@ _poll_source() { # is interpolated into $((...)) under set -u, so a non-numeric value # ('300s', '5m', 'abc') would be FATAL to the poll — the one thing this # block must never be. Resolve it ONCE, validate, fall back loudly. - local now_s slack + local now_s slack slack_ok slack="${WAKE_SNAPSHOT_TS_FUTURE_SLACK:-300}" - if ! printf '%s' "$slack" | grep -Eq '^[0-9]{1,9}$'; then - echo "detector.sh: WAKE_SNAPSHOT_TS_FUTURE_SLACK='$slack' is not a plain non-negative integer (seconds) — falling back to 300, poll continues (#940)." >&2 + # NOT grep: grep is LINE-oriented, so ^...$ anchors bind per line and a + # multi-line value ($'300\n8') passes the regex yet is FATAL in $((...)). + # The case pattern matches the WHOLE string, newlines included. (snap_ts + # is immune: jq's number type-check above cannot emit an embedded newline.) + case "$slack" in + '' | *[!0-9]*) slack_ok=1 ;; + *) [ "${#slack}" -le 9 ] && slack_ok=0 || slack_ok=1 ;; + esac + if [ "$slack_ok" -ne 0 ]; then + echo "detector.sh: WAKE_SNAPSHOT_TS_FUTURE_SLACK='$slack' is not a plain non-negative integer of at most 9 digits (seconds) — falling back to 300, poll continues (#940)." >&2 slack=300 fi # Shape validation is not radix validation: bash reads a leading zero as - # OCTAL, so '08'/'09' pass the regex yet are FATAL in $((...)), and + # OCTAL, so '08'/'09' pass the shape check yet are FATAL in $((...)), and # '0300' silently means 192. Force base-10 so the knob means what the - # operator wrote (safe: the regex above guarantees pure digits). + # operator wrote (safe: the case pattern above guarantees pure digits). slack=$((10#$slack)) now_s="$(date +%s)" if [ "$snap_ts" -gt $((now_s + slack)) ]; then diff --git a/packages/mosaic/framework/tools/wake/manifest.txt b/packages/mosaic/framework/tools/wake/manifest.txt index 02830656..ee75d735 100644 --- a/packages/mosaic/framework/tools/wake/manifest.txt +++ b/packages/mosaic/framework/tools/wake/manifest.txt @@ -276,15 +276,21 @@ # yields a NEGATIVE age — stale-reads-fresher-than-fresh, the # exact failure class #940 fixes. The SLACK knob itself is # operator input interpolated into arithmetic under set -u, so it -# gets the same discipline (#941 §2 round 2): validated -# ^[0-9]{1,9}$, else LOUD fallback to 300 — a malformed knob +# gets the same discipline (#941 §2 round 2): shape-validated as +# a plain non-negative integer of at most 9 digits, else LOUD +# fallback to 300 — a malformed knob # ('300s', '5m', 'abc') must never kill the poll, and a negative # one must never invert the guard into deny-all. Shape validation # is NOT radix validation (#942 review): bash reads leading zeros -# as OCTAL, so '08'/'09' pass the regex yet are fatal in $((...)) -# and '0300' silently means 192 — the knob is therefore forced -# base-10 (10#) after validation, so it means what the operator -# wrote. SKEW GUARANTEE +# as OCTAL, so '08'/'09' pass the shape check yet are fatal in +# $((...)) and '0300' silently means 192 — the knob is therefore +# forced base-10 (10#) after validation, so it means what the +# operator wrote. The validator and the consumer must also agree +# on STRING EXTENT (#942 follow-up): grep's ^...$ anchors bind +# per LINE, so a multi-line value ($'300\n8') passed the regex +# whole yet was fatal in $((...)) — validation is a whole-string +# case pattern, not grep, so an embedded newline rejects. +# SKEW GUARANTEE # (stated, not implied): the future-skew check runs against the # DETECTOR's clock; consumer-side age arithmetic runs on the # consumer's. A surviving snapshot_ts is therefore attested only @@ -300,8 +306,20 @@ # absence of these fields. # Changed: detector.sh, digest.sh (+ test-wake-detector.sh # D10/D11/D12/D13, test-wake-digest-quarantine.sh Q10). +# 0.6.13 #942/#943 SLACK-knob validation hardening, split from 0.6.12 because +# version= is the component's SOLE self-identity claim (no per-file +# hashes here) and two detector-changing merges after the 0.6.12 +# stamp had left three materially different detectors under one +# version string (#943 review §2). #942: the knob is resolved once, +# shape-validated, LOUD fallback 300, and forced base-10 (10#) so +# zero-padded values mean what the operator wrote instead of octal. +# #943: validation is a whole-string case pattern, not grep, so an +# embedded newline ($'300\n8' — accepted per-line by grep's ^...$ +# anchors, fatal in $((...))) rejects. Full rationale in the knob +# paragraph of the 0.6.12 entry above. +# Changed: detector.sh (+ test-wake-detector.sh D13). component=wake -version=0.6.12 +version=0.6.13 # Watch-list schema this component consumes, and the INCLUSIVE range of # schema_version values it supports. A wake-watch-list.json whose schema_version diff --git a/packages/mosaic/framework/tools/wake/test-wake-detector.sh b/packages/mosaic/framework/tools/wake/test-wake-detector.sh index 9ec80e68..176464a9 100755 --- a/packages/mosaic/framework/tools/wake/test-wake-detector.sh +++ b/packages/mosaic/framework/tools/wake/test-wake-detector.sh @@ -644,6 +644,26 @@ EOF entry="$("$STORE" drain | tail -1)" echo "$entry" | jq -e --arg s "$goodsha" 'select(.locators.snapshot_sha==$s) | .locators | has("snapshot_ts")' >/dev/null 2>&1 \ || fail_msg "D13: negative slack must NOT invert the guard into deny-all [$entry]" + # (c2) MULTI-LINE knobs — grep's ^...$ anchors bind PER LINE, so a value with + # an embedded newline ($'300\n8') passed the old regex whole yet is FATAL in + # \$((...)) ('error token is "8"'; $'300\nabc' dies as unbound variable). The + # case pattern matches the WHOLE string: both must fall back loudly, keep the ts. + printf '{"snapshot_sha":"%s","snapshot_ts":%s}\n' "$goodsha" "$(date +%s)" >"$stub/repo_r1.meta" + printf 'SHA-CC2\n' >"$stub/repo_r1" + err="$(WAKE_SNAPSHOT_TS_FUTURE_SLACK=$'300\n8' "$DET" poll-once 2>&1 >/dev/null)"; rc=$? + [ "$rc" -eq 0 ] || fail_msg "D13: multi-line SLACK (300\\n8) must NEVER fail the poll (rc=$rc) [$err]" + echo "$err" | grep -qi 'falling back to 300' || fail_msg "D13: multi-line slack must be LOUD on stderr [$err]" + entry="$("$STORE" drain | tail -1)" + echo "$entry" | jq -e --arg s "$goodsha" 'select(.locators.snapshot_sha==$s) | .locators | has("snapshot_ts")' >/dev/null 2>&1 \ + || fail_msg "D13: valid metadata must SURVIVE a multi-line knob [$entry]" + printf '{"snapshot_sha":"%s","snapshot_ts":%s}\n' "$goodsha" "$(date +%s)" >"$stub/repo_r1.meta" + printf 'SHA-CC3\n' >"$stub/repo_r1" + err="$(WAKE_SNAPSHOT_TS_FUTURE_SLACK=$'300\nabc' "$DET" poll-once 2>&1 >/dev/null)"; rc=$? + [ "$rc" -eq 0 ] || fail_msg "D13: multi-line SLACK (300\\nabc) must NEVER fail the poll (rc=$rc) [$err]" + echo "$err" | grep -qi 'falling back to 300' || fail_msg "D13: multi-line non-numeric slack must be LOUD on stderr [$err]" + entry="$("$STORE" drain | tail -1)" + echo "$entry" | jq -e --arg s "$goodsha" 'select(.locators.snapshot_sha==$s) | .locators | has("snapshot_ts")' >/dev/null 2>&1 \ + || fail_msg "D13: valid metadata must SURVIVE a multi-line non-numeric knob [$entry]" # (d2-pre) ZERO-PADDED knobs — shape-valid, radix-hostile. '08' passes the # regex but is fatal octal in \$((...)) without the 10# normalization; '0300' # silently means 192 (octal), so a ts +250s ahead would be WRONGLY dropped. @@ -671,7 +691,7 @@ EOF entry="$("$STORE" drain | tail -1)" echo "$entry" | jq -e --arg s "$goodsha" 'select(.locators.snapshot_sha==$s) | .locators | has("snapshot_ts") | not' >/dev/null 2>&1 \ || fail_msg "D13: valid SLACK=0 must drop the future ts but keep the sha [$entry]" - [ "$(det_seq)" = "6" ] || fail_msg "D13: all six real deltas must still have enqueued, got seq $(det_seq)" + [ "$(det_seq)" = "8" ] || fail_msg "D13: all eight real deltas must still have enqueued, got seq $(det_seq)" ) && ok echo