mosaicstack/stack
13
0
Fork 1
Code Issues 304 Pull Requests 10 Actions Packages Projects Releases 15 Wiki Activity

verify-sanitized.sh: identity denylist does not cover private-network topology (RFC1918) — gate gap surfaced by #1320 #1321

New Issue
Open
opened 2026-08-19 20:53:52 +00:00 by fargo · 0 comments
fargo commented 2026-08-19 20:53:52 +00:00
Member
Copy Link
Copy Source

From the #1320 review chain (rev-security-01 verdict, comment 23282): the sanitization gate's denylist catches operator identity tokens but not private-network addresses, so the estate RFC1918 endpoints that shipped inside folded skills and tools docs (10.1.1.x Portainer/Docker/Gitea/Coolify values) would regress silently — the gate has no rule that sees them.

Content was cleaned in the #1320 remediation (see that issue and its PR); this issue is the GATE defect on its own, filed separately so it has an owner rather than riding inside a content PR.

Scope for whoever takes it:

  • Detection: RFC1918 ranges (10/8, 172.16/12, 192.168/16) across the same file set the identity scan covers.
  • Carve-outs needed: RFC 5737 documentation ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24) so examples can use documentation addresses; consider 127.0.0.1 and link-local 169.254/16; decide whether example.internal / .example hostnames are the blessed DNS placeholder (the #1320 remediation used both *.example.internal and RFC5737).
  • Boundary case to encode: guides/INFRASTRUCTURE.md's cloudflare record-update example previously used 10.0.0.5 as a generic example value (not estate topology) — resolved by moving it to 192.0.2.5. A bare RFC1918 ban would have flagged it; the carve-out design should make the blessed pattern obvious.
  • Self-test additions in the gate's own style (planted-file with an RFC1918 address must fail; planted RFC5737 must pass).

Cross-ref: content issue #1320.

From the #1320 review chain (rev-security-01 verdict, comment 23282): the sanitization gate's denylist catches operator identity tokens but not private-network addresses, so the estate RFC1918 endpoints that shipped inside folded skills and tools docs (`10.1.1.x` Portainer/Docker/Gitea/Coolify values) would regress silently — the gate has no rule that sees them. Content was cleaned in the #1320 remediation (see that issue and its PR); this issue is the GATE defect on its own, filed separately so it has an owner rather than riding inside a content PR. Scope for whoever takes it: - Detection: RFC1918 ranges (10/8, 172.16/12, 192.168/16) across the same file set the identity scan covers. - Carve-outs needed: RFC 5737 documentation ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24) so examples can use documentation addresses; consider 127.0.0.1 and link-local 169.254/16; decide whether example.internal / .example hostnames are the blessed DNS placeholder (the #1320 remediation used both `*.example.internal` and RFC5737). - Boundary case to encode: guides/INFRASTRUCTURE.md's cloudflare record-update example previously used `10.0.0.5` as a generic example value (not estate topology) — resolved by moving it to `192.0.2.5`. A bare RFC1918 ban would have flagged it; the carve-out design should make the blessed pattern obvious. - Self-test additions in the gate's own style (planted-file with an RFC1918 address must fail; planted RFC5737 must pass). Cross-ref: content issue #1320.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1321