Skip to content

Lock PAT transport as inert request data - #1

Merged
GG-O-BP merged 1 commit into
mainfrom
fix/pat-shell-injection-regression
Sep 3, 2026
Merged

Lock PAT transport as inert request data#1
GG-O-BP merged 1 commit into
mainfrom
fix/pat-shell-injection-regression

Conversation

@GG-O-BP

@GG-O-BP GG-O-BP commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • mendraw#1 reported shell interpolation of MENDIX_PAT in the removed cmd_resolve_ffi.mjs downloader. The marketplace pipeline now lives in mxpak and never builds a shell command; this PR locks that contract with regression tests.
  • Sans-IO request tests prove hostile tokens (command substitution syntax, backticks, quotes, ampersands) are carried verbatim as authorization header data.
  • .env reader tests prove the same hostile values parse without transformation, and quote stripping now removes only one matching surrounding pair instead of mangling every quote in the value.

Fixes glendix-labs/mendraw#1

Verification

  • gleam test — 100 passed.
  • ./scripts/verify.sh inner mxpak — passed.
  • pre-push verify.sh final — passed (family checks, widget build, Lustre E2E, Mendix full E2E).

@GG-O-BP
GG-O-BP merged commit a8a8127 into main Sep 3, 2026
1 check passed
@GG-O-BP
GG-O-BP deleted the fix/pat-shell-injection-regression branch September 3, 2026 00:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[보안] .env의 MENDIX_PAT가 이스케이프 없이 셸 명령에 보간됨 (셸 인젝션)

1 participant