Repository navigation
fix(security): memory-privacy IDOR + workspace-shell CSWSH hardening - #10989
Merged
Merged
Conversation
- _forget/_amend_working_memory: allowlist canonical key shape before any Redis op (no arbitrary-key delete) + require dict payload owned by caller (fail-closed on non-dict) - _forget_graph_entity: deny-by-default ownership (drop fail-open 'owner and' guard) - task_workspace_ws: validate Origin against CORS allowlist before shell attach (CSWSH) - 13 regression tests
Contributor
✅ SSOT Configuration Compliance: Passing🎉 No hardcoded values detected that have SSOT config equivalents! |
12 tasks done
This was referenced Jul 6, 2026
Umbrella: harden the July-6 autonomy wave (workspace/adapters, self-improvement, OAuth, eval)
#11058
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thinking Path
Two background security reviews flagged HIGH-severity issues in this session's merged memory-privacy (#10554) and workspace-shell (#10544) code. All are real IDOR / cross-origin gaps — fixed fail-closed.
What Changed
IDOR — arbitrary Redis key deletion & fail-open ownership (
memory/transparency.py,api/memory_privacy.py)is_working_memory_key()inmemory/working_memory.py(allowlists theautobot:session:*:memory:*shape)._forget_working_memory/_amend_working_memory: reject any non-working-memory key before any Redis op (no arbitrary-key read/delete), and require the decoded value to be a dict owned by the caller — a non-dict payload is now denied (was fail-open:if isinstance(value, dict) and ...skipped the check for non-dicts)._forget_graph_entity: deny-by-default ownership — dropped the fail-openif owner and owner != user_idguard so a missing/blank owner is no longer deletable by a normal caller (shared/system entities protected).CSWSH — missing Origin validation (
api/task_workspace_ws.py)_validate_ws_originnow validates theOriginheader against the CORS allowlist (get_config_manager().get_cors_origins()) before a shell is attached. Browser cross-origin connections (which carry ambient cookies but a disallowed Origin) are rejected; non-browser clients omit Origin and authenticate via the internal-service key. Fail-closed if config is unavailable. Auth-header requirement retained.Verification
memory/security_idor_hotfix_test.py— 13 tests pass: key-shape allowlist; forget/amend reject arbitrary keys without touching Redis; non-dict payload denied; tenant mismatch denied; owner can delete; graph-entity missing-owner denied by default; WS disallowed-Origin rejected, allowlisted-Origin + absent-Origin(non-browser) pass, absent-auth rejected in production. Black (26.3.1) clean.Model Used
Opus 4.8