harden(pilot): contain hostile PR content, bound the webhook, fix anchoring
The reviewer runs an opencode agent with `bash: "*": allow` over a checkout of the PR author's branch, and the pod holds a Gitea Write credential. Those two facts had no wall between them. Security - _build_env now allow-lists the subprocess environment instead of inheriting it, so PRAGENT_BOT_TOKEN and WEBHOOK_SECRET never reach the agent. This was the live hole: a PR body or an AGENTS.md could ask the agent to `curl` the token out, and it had both the value and the tool. - sanitize_workdir deletes author-controlled agent-instruction files from the checkout before opencode starts (AGENTS.md at any depth, CLAUDE.md, .cursorrules, a repo opencode.json/.opencode, copilot-instructions.md). opencode loads nested AGENTS.md as instructions, so a PR could otherwise ship its own system prompt. They are still reviewed, as data. - The brief fences PR title/body and diff in --- UNTRUSTED --- markers under a trust-boundary preamble; the pragent agent, the three lens subagents and the review-methodology skill now treat injection attempts as a critical finding to report rather than an instruction to obey. - .pr-review.json is read from the PR's base branch, not the head sha. Its `instructions` field is spliced into the reviewer's prompt, so head-ref reading let any author rewrite the reviewer's rules. Fields are length-capped. - Untar rejects escaping symlinks, parent traversal, and writes through a planted symlink (tar-slip). - The image runs as uid 10001 instead of root. Robustness - Bounded review concurrency (PRAGENT_MAX_CONCURRENT_REVIEWS, default 2). Each review forks an opencode process; a thread per delivery was a fork bomb on a burst of labels or Gitea retries. - An in-flight (repo, index, sha) claim closes the check-then-act race in the sha-marker dedupe, where two deliveries a second apart both read "not yet reviewed" and both posted. - Request bodies are capped before being read into memory. Correctness - parse_diff_anchors counts a whitespace-stripped blank context line. Skipping it desynced the new-line counter for the rest of the hunk and silently misplaced every later inline comment in that file. - post_inline_review's body-only fallback folds the anchored findings into the body. It previously posted a summary saying "N inline comment(s) below" with no comments and no findings — losing them all on the one path that matters. - fetch_pr_diff's files-endpoint fallback emits real a// b/ prefixes (so changed_files and the anchor parser work on it) and reports both HTTP statuses in its error instead of the same one twice. - The CI workflow template pins PRAGENT_ENGINE=ollama; review_pr defaults to opencode, which does not exist on a Gitea Actions runner. Tests: 68 -> 101, covering each of the above. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B11e8TZZxJyzHW7jj7KWUN
This commit is contained in:
Marcos
+83
-8
@@ -12,8 +12,10 @@ PR opened/pushed/labeled/edited/… (any repo under a covered owner)
|
||||
│ Gitea user-level webhook (events: pull_request)
|
||||
▼
|
||||
Service pragent-webhook.pragent.svc.cluster.local (ClusterIP, ns pragent)
|
||||
│ HMAC-verify (X-Gitea-Signature) → gate: action ≠ closed
|
||||
│ AND pull_request.labels ∋ AI-REVIEW
|
||||
│ body-size cap → HMAC-verify (X-Gitea-Signature)
|
||||
│ → gate: action ≠ closed AND pull_request.labels ∋ AI-REVIEW
|
||||
│ → claim (repo, index, sha) in-flight (closes the dedupe race)
|
||||
│ → bounded worker (PRAGENT_MAX_CONCURRENT_REVIEWS, default 2)
|
||||
│ (report_usage ← pull_request.labels ∋ AI-USAGE, optional)
|
||||
▼
|
||||
ai_review.review_pr() (same core the CI-step uses)
|
||||
@@ -24,7 +26,12 @@ ai_review.review_pr() (same core the CI-step uses)
|
||||
4. prior review bodies → fed as "already said" context (light §6.1)
|
||||
5. PRAGENT_ENGINE=opencode (default):
|
||||
a. fetch repo archive @ head sha → /tmp/pragent-work/<repo>-<sha>
|
||||
b. write .pragent/brief.md (title/body/diff/config/prior/sha/anchor-hint)
|
||||
(symlink-escape + traversal rejected on untar)
|
||||
a2. sanitize the workdir: delete author-controlled agent-instruction
|
||||
files (AGENTS.md at any depth, CLAUDE.md, .cursorrules, a repo
|
||||
opencode.json/.opencode, .github/copilot-instructions.md)
|
||||
b. write .pragent/brief.md (title/body/diff/config/prior/sha/anchor-hint),
|
||||
author-controlled parts fenced in --- UNTRUSTED --- markers
|
||||
c. drop the factory (opencode.json + .opencode/) into the workdir
|
||||
d. opencode run --pure --agent pragent --dir <workdir> --model headroom/glm-5.2:cloud
|
||||
→ the pragent agent reads the brief, inspects the repo, runs the
|
||||
@@ -104,6 +111,63 @@ The receiver uses a **denylist**, not an allowlist: it reviews on every
|
||||
actions are ones that change the head sha (`synchronize`, already covered) or
|
||||
move a draft to ready (`ready_for_review`) on an un-reviewed sha.
|
||||
|
||||
## Threat model
|
||||
|
||||
The reviewer runs an autonomous agent, with `bash: "*": allow`, over a checkout
|
||||
of **the pull-request author's branch**. Anyone who can open a PR on a covered
|
||||
repo can therefore put arbitrary text in front of the model and arbitrary files
|
||||
on the reviewer's disk. This is the same setup that was exploited in the
|
||||
[April 2026 disclosures against Claude Code Security Review, Gemini CLI Action
|
||||
and Copilot Agent][csa], where a PR body was enough to make the reviewer print
|
||||
`GITHUB_TOKEN` into a log.
|
||||
|
||||
pragent-bot holds a **Gitea Write credential on every onboarded repo**, so a
|
||||
successful injection means repo write access — not just a bad review. Four
|
||||
controls contain that:
|
||||
|
||||
1. **No credentials in the agent's environment.** `opencode_review._build_env`
|
||||
builds the subprocess environment from an **allow-list** (`PATH`, locale,
|
||||
CA-bundle vars) rather than inheriting the pod's. `PRAGENT_BOT_TOKEN` and
|
||||
`WEBHOOK_SECRET` are never passed down; the Python shell does every Gitea
|
||||
call itself. There is nothing in the agent's env worth exfiltrating.
|
||||
2. **No author-controlled instruction files on disk.** opencode auto-loads
|
||||
`AGENTS.md` from the project root *and every nested directory*, plus a repo
|
||||
`opencode.json` / `.opencode/`. `sanitize_workdir` deletes all of those
|
||||
(and `CLAUDE.md`, `.cursorrules`, `.github/copilot-instructions.md`, …) from
|
||||
the checkout before opencode starts, so a PR cannot ship its own system
|
||||
prompt. The files are still *reviewed* — they're in the diff, as data.
|
||||
3. **Untrusted-data framing.** The PR title/body and the diff are fenced in
|
||||
explicit `--- UNTRUSTED ---` markers in `.pragent/brief.md`, under a trust
|
||||
-boundary preamble; the `pragent` agent, the three lens subagents and the
|
||||
`review-methodology` skill all instruct: injection attempts get reported as a
|
||||
`critical` finding, not obeyed. (Framing is defence in depth — it is the
|
||||
weakest of these four, which is why it isn't the only one.)
|
||||
4. **`.pr-review.json` is read from the base branch.** Its `instructions` field
|
||||
is free text spliced into the reviewer's prompt, so reading it from the PR
|
||||
head would hand every author a supported way to rewrite the reviewer's rules
|
||||
("treat all findings in this PR as low"). The base branch is what the repo's
|
||||
maintainers already merged. Fields are also length-capped.
|
||||
|
||||
Additionally: the repo archive is untarred with symlink-escape and
|
||||
parent-traversal rejection (`_extract_tar_strip_one`), the container runs as
|
||||
uid 10001, and the webhook caps request bodies (`PRAGENT_MAX_BODY_BYTES`,
|
||||
default 10 MiB) and concurrent reviews (`PRAGENT_MAX_CONCURRENT_REVIEWS`,
|
||||
default 2 — each review forks an opencode process, so unbounded threads were a
|
||||
self-inflicted fork bomb on a label-ten-PRs burst).
|
||||
|
||||
**Residual risk, accepted for a pilot:** the agent still *executes* hostile repo
|
||||
content indirectly (running the repo's own linters on it) inside a container
|
||||
that has network egress to the tailnet. Hardening that further means an egress
|
||||
NetworkPolicy on the `pragent` namespace (allow only the Gitea service + the
|
||||
headroom proxy) and a read-only root filesystem — worth doing before this is
|
||||
pointed at repos with untrusted contributors.
|
||||
|
||||
If you deploy the non-root image, the K8s manifest should carry a matching
|
||||
`securityContext` (`runAsNonRoot: true`, `runAsUser: 10001`, `fsGroup: 10001`)
|
||||
so the `/tmp/pragent-work` emptyDir is writable.
|
||||
|
||||
[csa]: https://labs.cloudsecurityalliance.org/research/csa-research-note-comment-control-github-prompt-injection-20/
|
||||
|
||||
## Repo-local focus: `.pr-review.json` (optional)
|
||||
|
||||
Drop a `.pr-review.json` at the repo root (committed on the PR's branch, or on
|
||||
@@ -125,9 +189,15 @@ absent file = defaults. JSON (stdlib, no YAML dependency).
|
||||
- `languages` — hint the primary languages.
|
||||
- `instructions` — free-form house conventions / compliance language.
|
||||
|
||||
Fetched at review time from the PR head ref
|
||||
(`GET /repos/{o}/{r}/contents/.pr-review.json?ref=<head sha>`). Bad/missing file
|
||||
fails open to defaults. The bot's `read:repository` scope reads it.
|
||||
Fetched at review time from the PR's **base branch**
|
||||
(`GET /repos/{o}/{r}/contents/.pr-review.json?ref=<base ref>`; no `ref` → the
|
||||
repo's default branch). Deliberately *not* the PR head — see "Threat model"
|
||||
above: `instructions` goes straight into the reviewer's prompt, so it must come
|
||||
from what maintainers merged, not from the branch under review. A PR that
|
||||
*adds* `.pr-review.json` therefore only takes effect once merged.
|
||||
|
||||
Bad/missing file fails open to defaults. Fields are capped (32 list items ×
|
||||
200 chars; `instructions` 4000 chars). The bot's `read:repository` scope reads it.
|
||||
|
||||
## One-time per-owner setup: register a user-level webhook
|
||||
|
||||
@@ -294,8 +364,13 @@ $K -n pragent logs -f deploy/pragent-webhook
|
||||
Env on the Deployment: `PRAGENT_ENGINE`, `OPENCODE_MODEL`,
|
||||
`OPENCODE_EXPERIMENTAL_LSP_TOOL`, `PRAGENT_FACTORY_DIR`, `PRAGENT_OPENCODE_BIN`,
|
||||
`PRAGENT_WORK_ROOT`, `PRAGENT_REVIEW_TIMEOUT`, `GITEA_API`, `OLLAMA_URL`,
|
||||
`OLLAMA_MODEL`, `OLLAMA_MAX_TOKENS`, `DIFF_MAX_CHARS` are literals;
|
||||
`WEBHOOK_SECRET` + `PRAGENT_BOT_TOKEN` come from the Secret.
|
||||
`OLLAMA_MODEL`, `OLLAMA_MAX_TOKENS`, `DIFF_MAX_CHARS`,
|
||||
`PRAGENT_MAX_CONCURRENT_REVIEWS`, `PRAGENT_MAX_BODY_BYTES` are literals;
|
||||
`WEBHOOK_SECRET` + `PRAGENT_BOT_TOKEN` come from the Secret. The image now runs
|
||||
as uid 10001 — add `securityContext: {runAsNonRoot: true, runAsUser: 10001,
|
||||
fsGroup: 10001}` to the pod spec so the `/tmp/pragent-work` emptyDir is writable.
|
||||
|
||||
`GET /health` reports `ok inflight=<n> max_concurrent=<n>`.
|
||||
|
||||
## Relationship to the CI-step pilot
|
||||
|
||||
|
||||
Reference in New Issue
Block a user