-
Notifications
You must be signed in to change notification settings - Fork 0
fix(reliability): bound remote collaborator IDs before normalization #309
Copy link
Copy link
Open
Labels
area: apiAPI, protocol, event, or external contractAPI, protocol, event, or external contractarea: authAuthentication, authorization, identity, or tenant isolationAuthentication, authorization, identity, or tenant isolationarea: ci-cdCI, GitHub Actions, checks, release, or supply chainCI, GitHub Actions, checks, release, or supply chainarea: securitySecurity boundary, hardening, or vulnerability preventionSecurity boundary, hardening, or vulnerability preventionmaintenancepriority: mediumNormal-priority or P2 workNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmentOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behaviorDefect or incorrect behaviortype: maintenanceMaintenance, build, dependency, or operational upkeepMaintenance, build, dependency, or operational upkeep
Description
Activity
Metadata
Metadata
Assignees
Labels
area: apiAPI, protocol, event, or external contractAPI, protocol, event, or external contractarea: authAuthentication, authorization, identity, or tenant isolationAuthentication, authorization, identity, or tenant isolationarea: ci-cdCI, GitHub Actions, checks, release, or supply chainCI, GitHub Actions, checks, release, or supply chainarea: securitySecurity boundary, hardening, or vulnerability preventionSecurity boundary, hardening, or vulnerability preventionmaintenancepriority: mediumNormal-priority or P2 workNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmentOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behaviorDefect or incorrect behaviortype: maintenanceMaintenance, build, dependency, or operational upkeepMaintenance, build, dependency, or operational upkeep
Current authoritative state
Protected shipped truth is exact
main@a40b9489665bed7d95af619a6079b9c51cab299a; remote collaborator counting still accepts malformed identifiers and directly reads caller-controlled properties. Closed Draft #167 is historical evidence only.Issue-specific Draft PR #408 /
codex/remote-collaborator-id-validation-309owns this repair. It is stacked on #407 at exact base7a7093b92616296be6b4c3c7ce990880d12f8271; current exact head is55965a8d69c51801bc1b56a8293763a8fc1a0ec2. This is active-PR behavior, not protected-main shipped truth.Required behavior
Remote
userandidare accepted only as own enumerable data properties; accessors, inherited/non-enumerable values, primitives, nulls, and reflection-hostile shapes are skipped without executing caller code or aborting later entries. Identifier sources above 1,024 UTF-16 code units are rejected before trim. In-bound values are trimmed, nonblank, nonnumeric, and at most 80 Unicode code points using the allocation-free public bound from #407.Remote awareness remains untrusted presentation data and never authorization evidence. Provider transport/lifecycle, authorization, tenancy, persistence, credentials, deployment, retention, migration, model policy, and durable audit remain host-owned.
Exact-head evidence
Test-only
4c0591522ec39d608450690f5e05937ca87a53f4reproduces 5 failures / 1 passing hostile-shape check. Current GREEN head passes:Repository-local success is not protected integration, independent approval, or release proof. Keep #408 Draft until its dependency chain integrates or is otherwise resolved, and while #118 owns the protected release boundary. Before lifecycle action, refetch exact head/base, reviews, threads, live rules, and every applicable workflow; do not transfer #167 evidence, self-approve, weaken gates, or fabricate release identity.