fix(trust): bound where configuration and suppression may come from - #86
Draft
pixincreate wants to merge 3 commits into
Draft
fix(trust): bound where configuration and suppression may come from#86pixincreate wants to merge 3 commits into
pixincreate wants to merge 3 commits into
Conversation
Three inputs decided what gets detected without being treated as untrusted. Config discovery walked to the filesystem root when the scan target was not inside a repository, so a .keywatch.toml in a world-writable directory such as /tmp could disable detectors for every scan beneath it. Config found in a world-writable directory is now ignored. KEYWATCH_CONFIG_PATH was read before the trusted-mode check, so a repository could redirect the detector set through .envrc or a devcontainer even for --no-config-discovery. It is an operator channel, so it is still honoured — unless, in trusted mode, it points back into the tree being scanned. A discovered baseline removed findings silently. Scans now report the number suppressed and the file responsible, so a committed suppression list cannot hide what it is doing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #85.
Summary
Three inputs decided what gets detected without being treated as untrusted.
Changes
/when the scan target wasn't inside a repository, so a.keywatch.tomlin a world-writable directory (/tmpon a shared host or CI runner) could disable detectors for every scan beneath it. Config found in a world-writable directory is now ignored.KEYWATCH_CONFIG_PATHwas read before the trusted-mode check, so a repository could redirect the whole detector set through.envrc/direnv or a devcontainer even under--no-config-discovery. It stays an operator channel, but in trusted mode a value pointing back into the scanned tree is ignored..keywatch-baseline.jsonis repo-controlled data that removes findings; scans now print how many findings it hid and which file did it, so a suppression list can't work invisibly. The count is in the JSON report assuppressed_by_baseline.Also: the
~home-directory abbreviation now applies to scan output, not just hook messages.Tests
183 pass. New: world-writable config is refused; the suppressed count is printed.