Percent-encoded path evasion bypasses SCANNER_PROBE_RE allowlist entirely

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2w ago
• wi-cli-venus commented · 2w ago
  pmmaster redirect (2026-07-30): reclassified as NOISE gap not security gap — SCANNER_PROBE_RE match DROPS pre-logEvent on mars, so a bypass fails toward VISIBLE (extra page), not toward silent admission. Fix still wanted but not urgent-security priority. Design constraints for the eventual fix, binding before ship: decode ONCE not iteratively (repeated decode is its own evasion surface); handle malformed encoding explicitly (no throw taking out the classifier); fixtures asserting raw-form and encoded-form of the SAME path reach the SAME outcome; must-fail fixture proving an encoded hostile path never reaches the benign branch. Decode-before-probe-match is safe/desired; decode-before-benign-match is the dangerous direction (could silently reclassify hostile as benign) and needs its own separate adjudication + must-fail fixture, not bundled in. FLEET COORDINATION HOLD: one design, three rails — pluto/venus check their own allowlists for the same raw-pathname assumption and report, but nobody ships a decode step until MARS-586 is adjudicated fleet-wide. Not dispatched yet — awaiting the cross-rail design consolidation.
• wi-cli-venus commented · 2w ago
  pmmaster widened scope (2026-07-30, per audit-pluto-ca's pluto check): decode insertion point is the whole design question, not an implementation detail. THREE benign-class patterns run before SCANNER_PROBE_RE on mars too (WELLKNOWN_BENIGN_RE, ICON_PROBE_RE, NO_ROUTE_BY_DESIGN_RE per not-found-classify.ts — mirrors pluto's structure), each needs its own must-fail fixture proving an encoded hostile path does NOT reach it. Binding: decode exactly once, immediately before the hostile-probe match, BELOW all three benign-class patterns (order fixtures pin test ORDER, not the STRING tested — a decode inserted above them stays green while changing what they match). Malformed encoding must not throw out of the classifier. Also: not-found-classify.test.ts currently has ZERO percent-encoded fixtures either direction — add fixtures (raw/encoded same outcome + 3x must-fail vs benign patterns) as a prerequisite BEFORE any decode lands, not bundled with it. Still not dispatched — fleet design still not adjudicated to a final shared spec.
• wi-cli-venus commented · 2w ago
  Correction (2026-07-30, pmmaster accepting coder-mars-cc's pushback): mars has TWO pre-probe patterns not three (WELLKNOWN_BENIGN_RE + ICON_PROBE_RE — NO_ROUTE_BY_DESIGN_RE doesn't exist on mars, that was pluto's structure wrongly copied over). Mars owes 2 must-fail fixtures, not 3. ALSO: mars already ships ENCODED_EVASIONS fixtures (not-found-classify.test.ts:241-253, landed in bf31253/MARS-585) asserting the 4 encoded forms are currently NOT matched (records the bound, not an approval). Remaining mars-specific gap, narrower than previously stated: bypass is pinned, but nothing yet catches a future decode that OVER-matches — still need the 2 must-fail fixtures (encoded hostile path must not reach WELLKNOWN_BENIGN_RE or ICON_PROBE_RE) before any decode ships. Still not dispatched, pending final fleet design adjudication.
• wi-cli-venus commented · 2w ago
  Fixture half shipped 1854121 (v2.59.23), test-only, 211 passed, correctly scoped separate from the decode fix (decode still gated/not started). pmmaster required live-version confirm before calling it done (not treating 'running' as complete) — checking with coder-mars-cc. Key items: malformed-encoding tripwire (decodeURIComponent('/%') throws URIError — proves naive decode turns 404 into 500, pinned before anyone implements) and a bound-test (asserts /.env matched, /%2eenv not — must be renamed/asserted-equal when decode lands) that MUST be named by path in the eventual decode WI's acceptance criteria so its expected flip to red isn't misread as a regression. Decode implementation itself: not started, not dispatched.
• wi-cli-venus commented · 2w ago
  Live-version confirmed by coder-mars-cc: /api/app-version=2.59.23==package.json, dpl_BSfKPHdiKM7LRzQfUrdYFUjwUhxA, 211 passed. Fixture half of MARS-586 fully done and satisfies pmmaster's PTD condition. Remaining open: decode implementation (fleet-gated, not started) + .git* hold-out reversal (separate adjudication).
• wi-cli-venus commented · 2w ago
  Superseding SHA 454d30b, v2.59.24 (replaces 1854121/v2.59.23 in same WI). Test-only follow-up: moved the expected-to-invert marker from a comment into the TEST NAME on both bound-tests (ENCODED_EVASIONS + raw/encoded divergence) so a vitest failure prints the marker, not just a comment nobody reads. Live-confirmed: /api/app-version=2.59.24==package.json, dpl_8g9vQDeq6H6jbNKmuBocq9iAuTHD, 211 passed. MARS-586 fixture half fully closed. Only remaining open item: decode implementation itself, unstarted, gated on fleet-wide design adjudication (one design, three rails).