Add Codex security review notes
ober
a18a56dfa4e7385eb1ae6316b65817629ca89ff3
new file mode 100644 --- /dev/null +++ b/security-codex.md @@ -0,0 +1,76 @@ +# Security Review Notes + +Scope: `/Users/user/mine/jerboa*` and `/Users/user/mine/chez*`. + +## Findings + +### Critical: sibling build scripts can mutate the main Jerboa checkout + +The cross-build scripts in `jerboa-lsp` and `jerboa-awk` patch `$jerboa-home/lib` in place, delete compiled artifacts, then run `git checkout --` against `.ss` and `.sls` files. If `$jerboa-home` points at `/Users/user/mine/jerboa`, these scripts can silently discard uncommitted work in the main repo. + +- `/Users/user/mine/jerboa-lsp/build-jlsp-cross.ss:51` +- `/Users/user/mine/jerboa-lsp/build-jlsp-freebsd-cross.ss:50` +- `/Users/user/mine/jerboa-awk/build-jawk-cross.ss:173` + +### Critical: `jerboa-code` disables LLM safeguards while allowing broad local access + +`src/jcode/tool/external-llm.ss` adds provider flags such as `--dangerously-skip-permissions`, `--yolo`, and `--sandbox danger-full-access`. The macOS sandbox profile is allow-by-default, then the command is executed through the shell. That combination gives model-driven CLI processes broad filesystem and network reach. + +- `/Users/user/mine/jerboa-code/src/jcode/tool/external-llm.ss:53` +- `/Users/user/mine/jerboa-code/src/jcode/tool/external-llm.ss:157` +- `/Users/user/mine/jerboa-code/src/jcode/tool/external-llm.ss:215` + +### High: main repo has a confirmed syntax/build blocker + +`lib/std/compiler/pattern.ss` reaches EOF while still inside the `(library ...)` form. The Jerboa health check also reported balance failures in `lib/std/pipeline.ss`, `tests/test-pipeline.ss`, and `tests/test-security2-parsers.ss`. + +- `/Users/user/mine/jerboa/lib/std/compiler/pattern.ss:316` + +### High: `chez-inotify` exposes unchecked FFI buffer reads + +`chez_inotify_shim.c` casts `buf + offset` to `struct inotify_event *` without a buffer length or alignment check. A caller can read past the end of the buffer. The `read` wrapper also treats `EINTR` as a hard error instead of retrying. + +- `/Users/user/mine/chez-inotify/chez_inotify_shim.c:33` +- `/Users/user/mine/chez-inotify/chez_inotify_shim.c:66` + +### High: `jerboa-wafter` has shell injection in the Wireshark converter + +`tools/wireshark-convert.ss` accepts `--out`, then builds `mkdir -p` with string concatenation and passes it to `system`. A crafted output directory can inject shell syntax. + +- `/Users/user/mine/jerboa-wafter/tools/wireshark-convert.ss:1095` +- `/Users/user/mine/jerboa-wafter/tools/wireshark-convert.ss:1118` + +### Medium: `pipeline-timeout` can leave work running after timeout + +`pipeline-timeout` forks a worker, waits, then raises on timeout without joining or cancelling the worker. The worker can continue running and mutate captured state after the timeout path returns. + +- `/Users/user/mine/jerboa/lib/std/pipeline.ss:170` + +The related test does not actually exercise a failing inner stage: + +- `/Users/user/mine/jerboa/tests/test-pipeline.ss:164` + +### Medium: `jerboa-emacs` appears to use Gerbil process APIs + +Several Jerboa source files call `open-process` and `process-status`. Unless this repo injects compatibility wrappers at build time, those are not the Jerboa/Chez process APIs described by the project instructions. + +- `/Users/user/mine/jerboa-emacs/src/jerboa-emacs/editor-core.ss:110` +- `/Users/user/mine/jerboa-emacs/src/jerboa-emacs/editor-core.ss:132` +- `/Users/user/mine/jerboa-emacs/src/jerboa-emacs/editor-core.ss:1108` + +### Medium: main repo has raw `read` / FASL deserialization paths + +The Jerboa security scan found many raw `read` and FASL deserialization paths. These need source-by-source triage because untrusted `read` or FASL input is a deserialization risk. + +Examples: + +- `/Users/user/mine/jerboa/jerbuild.ss:308` +- `/Users/user/mine/jerboa/lib/std/actor/distributed.ss:303` +- `/Users/user/mine/jerboa/lib/std/fasl.ss:27` +- `/Users/user/mine/jerboa/lib/std/net/grpc.ss:162` + +## Review Notes + +The review covered all matching `/Users/user/mine/jerboa*` and `/Users/user/mine/chez*` directories with `rg`, manual source reads, git status inventory, and Jerboa MCP health/security/stale checks on the main repo plus key sibling repos. + +Full builds were not run because many worktrees are dirty and several build scripts write/delete generated artifacts across checkouts.