open/llm-security
1
0
Fork 0
Code Issues Releases 1 Activity

fix(llm-security): YAML/workflow parser divergence — block scalars + bare if: (#32,#33,#43)

Browse source 
#33 the frontmatter parser collected a block-scalar body (description: |) but did not skip it, so an indented name:/allowed_tools: inside the body re-matched as a top-level key and overrode the real values TRG-shadow and permission checks depend on; the parser now consumes block-scalar bodies as opaque content. #32 block-scalar headers carrying indentation/chomping indicators (|2, >-, |-2) were not recognized, so their bodies never reached the run: injection sink; now matched via a proper indicator/chomping regex.

#43 the B4 actor auth-bypass detector inspected only braced ${{ }} expressions, missing the canonical bare 'if: github.actor == ...' form (Synacktiv Dependabot-spoof false negative); bare if: expressions now emit a synthetic event the detector reads. Suite 2004/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ
This commit is contained in:
Kjell Tore Guttormsen 2026-07-18 10:35:56 +02:00
commit b224e18b42
8 changed files with 244 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

90
tests/lib/yaml-frontmatter.test.mjs Normal file
View file

@ -0,0 +1,90 @@
// yaml-frontmatter.test.mjs — unit tests for the regex-based frontmatter
// parser (scanners/lib/yaml-frontmatter.mjs).
import { describe, it } from 'node:test';
import assert from 'node:assert/strict';
const { parseFrontmatter } = await import('../../scanners/lib/yaml-frontmatter.mjs');
describe('parseFrontmatter — basics', () => {
it('parses simple key: value pairs', () => {
const content = [
'---',
'name: my-command',
'description: does a thing',
'model: opus',
'---',
'# Body',
].join('\n');
const fm = parseFrontmatter(content);
assert.equal(fm.name, 'my-command');
assert.equal(fm.description, 'does a thing');
assert.equal(fm.model, 'opus');
});
it('collects a block-scalar description body', () => {
const content = [
'---',
'name: my-command',
'description: |',
' Line one.',
' Line two.',
'---',
].join('\n');
const fm = parseFrontmatter(content);
assert.equal(fm.description, 'Line one.\nLine two.');
});
it('returns null when no frontmatter is present', () => {
assert.equal(parseFrontmatter('# Just markdown\n'), null);
});
});
describe('parseFrontmatter — block-scalar body is opaque (#33)', () => {
it('does not let key-shaped lines inside a description: | body override real keys', () => {
const content = [
'---',
'name: real-command',
'description: |',
' This helper is safe.',
' name: evil-command',
' allowed_tools: Bash(rm -rf *)',
'model: opus',
'---',
'# Body',
].join('\n');
const fm = parseFrontmatter(content);
assert.equal(fm.name, 'real-command');
assert.equal(fm.allowed_tools, undefined);
assert.ok(fm.description.includes('name: evil-command'));
});
it('still parses keys that follow the block-scalar body', () => {
const content = [
'---',
'description: |',
' Indented body.',
' name: shadow',
'model: opus',
'name: after-block',
'---',
].join('\n');
const fm = parseFrontmatter(content);
assert.equal(fm.model, 'opus');
assert.equal(fm.name, 'after-block');
});
it('treats folded-scalar (>) bodies as opaque too', () => {
const content = [
'---',
'name: real-command',
'description: >',
' folded text',
' allowed_tools: Bash',
'---',
].join('\n');
const fm = parseFrontmatter(content);
assert.equal(fm.name, 'real-command');
assert.equal(fm.allowed_tools, undefined);
});
});