mosaicstack/stack
21
0
Fork 1
Code Issues 337 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

harden: reject whitespace-only tmux socket_name in roster-v2 (silently selects default server) #794

New Issue
Closed
opened 2026-07-16 20:01:19 +00:00 by jason.woltje · 1 comment
jason.woltje commented 2026-07-16 20:01:19 +00:00
Owner
Copy Link
Copy Source

Summary

requiredTmuxSocket() in packages/mosaic/src/fleet/roster-v2.ts trims socket_name before
validating it against a permissive regex that accepts the empty string, so a whitespace-only value
(e.g. socket_name: " ") is normalized to "" and silently selects the operator's default tmux
server instead of being rejected.

Detail (on main)

const TMUX_SOCKET_IDENTIFIER = /^[A-Za-z0-9_.-]*$/;   // '*' → empty string matches

function requiredTmuxSocket(value, label) {
  if (typeof value !== 'string') throw new RosterV2ValidationError(...);
  const result = value.trim();                         // " " → ""
  if (!TMUX_SOCKET_IDENTIFIER.test(result)) throw ...; // "" passes
  return result;                                        // returns ""
}

Consumption confirms the impact — comms-onboarding.ts:

if (rosterSocket) parts.push('-L', shellArg(rosterSocket));  // "" is falsy → -L omitted → default server

and the intended contract is explicit in tests: "omits -L only for the literal default socket."

So a whitespace-only socket_name bypasses the "explicit decision to use the default server" and can
point fleet tmux operations (message/session/runtime) at an unintended shared namespace.

Severity

Low. Requires an operator to hand-author a whitespace-only socket_name; no privilege escalation. This
is input-validation hardening, not an active exploit. (Flagged by an automated Codex pass whose
"medium/blocker" rating is inflated for this path.)

Proposed fix

  • Accept an empty socket only when the source string was exactly empty; reject any non-empty value
    whose trimmed form differs from the source (i.e. reject whitespace-only and whitespace-padded values).
  • Add YAML + JSON parser tests for whitespace-only and whitespace-padded socket_name, asserting
    RosterV2ValidationError.

Provenance

Surfaced as a byproduct of an independent review; pre-existing on main, not introduced by any
open PR (noted during PR #793 review, which it does not belong to). Filed to preserve the finding.

## Summary `requiredTmuxSocket()` in `packages/mosaic/src/fleet/roster-v2.ts` trims `socket_name` before validating it against a **permissive** regex that accepts the empty string, so a whitespace-only value (e.g. `socket_name: " "`) is normalized to `""` and silently selects the operator's **default** tmux server instead of being rejected. ## Detail (on `main`) ``` const TMUX_SOCKET_IDENTIFIER = /^[A-Za-z0-9_.-]*$/; // '*' → empty string matches function requiredTmuxSocket(value, label) { if (typeof value !== 'string') throw new RosterV2ValidationError(...); const result = value.trim(); // " " → "" if (!TMUX_SOCKET_IDENTIFIER.test(result)) throw ...; // "" passes return result; // returns "" } ``` Consumption confirms the impact — `comms-onboarding.ts`: ``` if (rosterSocket) parts.push('-L', shellArg(rosterSocket)); // "" is falsy → -L omitted → default server ``` and the intended contract is explicit in tests: *"omits -L only for the literal default socket."* So a whitespace-only `socket_name` bypasses the "explicit decision to use the default server" and can point fleet tmux operations (message/session/runtime) at an unintended shared namespace. ## Severity Low. Requires an operator to hand-author a whitespace-only `socket_name`; no privilege escalation. This is input-validation hardening, not an active exploit. (Flagged by an automated Codex pass whose "medium/blocker" rating is inflated for this path.) ## Proposed fix - Accept an empty socket only when the source string was **exactly** empty; reject any non-empty value whose trimmed form differs from the source (i.e. reject whitespace-only and whitespace-padded values). - Add YAML + JSON parser tests for whitespace-only and whitespace-padded `socket_name`, asserting `RosterV2ValidationError`. ## Provenance Surfaced as a byproduct of an independent review; **pre-existing on `main`**, not introduced by any open PR (noted during PR #793 review, which it does not belong to). Filed to preserve the finding.
jason.woltje commented 2026-07-20 08:35:23 +00:00
Author
Owner
Copy Link
Copy Source

Superseded by #854 — contract REVERSED on socket-boundary security grounds

Closing as superseded-by-#854 (NOT a generic duplicate). This issue's title/body and PR#793 provenance are preserved unchanged for the audit trail.

Reversal rationale (Mos ruling, Option B): #794 (2026-07-16, Low) proposed to ACCEPT a literal-empty socket_name, rejecting only whitespace-only/padded values. Today's 3-source primary analysis @ main 11d281845376eb5910a74403300956d8edcc93a8 (builder ms-m3002-build + MS-LEAD + homelab W-jarvis) identified the tmux socket-BOUNDARY / session-isolation impact that #794 did not weigh: an empty socket_name collapses to the operator's default tmux socket → cross-session boundary risk. That REVERSES the contract to REJECT-empty (re-rated medium / security).

The FCM-M3-002 acceptance test (packages/mosaic/src/fleet/fleet-reconciler.acceptance.spec.ts) encodes reject-empty and is endorsed CORRECT — it must not be weakened.

Canonical tracker + exact fix spec (*→+ L276, minLength:1 schema L176, msg align L480) + parked Jul-23 Opus-SECREV sequence: #854. Provenance retained here.

### Superseded by #854 — contract REVERSED on socket-boundary security grounds Closing as **superseded-by-#854** (NOT a generic duplicate). This issue's title/body and PR#793 provenance are preserved **unchanged** for the audit trail. **Reversal rationale (Mos ruling, Option B):** #794 (2026-07-16, Low) proposed to **ACCEPT a literal-empty** `socket_name`, rejecting only whitespace-only/padded values. Today's **3-source primary analysis** @ main `11d281845376eb5910a74403300956d8edcc93a8` (builder `ms-m3002-build` + MS-LEAD + homelab W-jarvis) identified the tmux **socket-BOUNDARY / session-isolation** impact that #794 did not weigh: an empty `socket_name` collapses to the operator's **default** tmux socket → **cross-session boundary risk**. That **REVERSES** the contract to **REJECT-empty** (re-rated **medium / security**). The FCM-M3-002 acceptance test (`packages/mosaic/src/fleet/fleet-reconciler.acceptance.spec.ts`) encodes reject-empty and is endorsed **CORRECT** — it must not be weakened. Canonical tracker + exact fix spec (`*`→`+` L276, `minLength:1` schema L176, msg align L480) + parked Jul-23 Opus-SECREV sequence: **#854**. Provenance retained here.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#794