fix(security): remediate 2C/5M/6L findings from security audit#22
Merged
Conversation
…om audit Critical: - C1: Replace shell=True with shlex.split()+shell=False in stop quality gate, add test runner allowlist, remove /tmp command cache fallback - C2: Escape shell metacharacters with printf %q in tmux/dmux/worktree runners High: - H1: Move all /tmp/lacp-* state to ~/.lacp/hooks/state/ with 0700 perms - H2: Replace source .env with strict KEY=VALUE parser (safe $HOME expansion) Medium: - M2: Keep LACP_MCP_REQUIRE_SERVER_ALLOWLIST=true in mcp-heavy profile - M3: Enable LACP_REQUIRE_SESSION_FINGERPRINT in enterprise policy pack - M4: Hardcode REPO_SLUG in install.sh, add optional SHA-256 verification - M5: Add constraints.reject_when_env guard to trusted-local-dev profile Low: - L1: Sanitize session IDs in file paths (hook_contracts.py, stop_quality_gate.py) - L2: Move debug log to ~/.lacp/hooks/state/ with 0600 perms - L3: Use full SHA-256 digest in provenance chain (backward-compatible verify) - L4: Increase agent ID entropy from 32-bit to 128-bit - L5: Document exfiltration check as defense-in-depth - L6: Replace personal vault path with placeholder in obsidian manifest
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Full security audit remediation covering 2 critical, 5 high/medium, and 6 low severity findings across hooks, runners, configs, and CLI tools.
Critical Fixes
shell=Truein stop quality gate — replaced withshlex.split()+shell=False, added test runner allowlist, removed/tmpcommand cacheprintf %qHigh Fixes
/tmpfile paths — moved all hook state to~/.lacp/hooks/state/with 0700 dirs.envsourcing — replacedsource .envwith strict KEY=VALUE parser (safe$HOME/~expansion only)Medium Fixes
mcp-heavyprofile now keeps server allowlist requirement enabledtrusted-local-devcredential profile rejected whenLACP_ALLOW_EXTERNAL_REMOTE=trueLow Fixes
/tmpto~/.lacp/with 0600 permsTest plan
bin/lacp-test --quickpassesscripts/ci/test-hook-contracts.shpassesbash -nsyntax checkpython3 -m json.toolvalidation.envparser verified: expands$HOME/~, blocks$(...)injection🤖 Generated with Claude Code