jpmschweitzer/clide
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix untrusted-workspace RCE in dugite git resolution (T-98)

Browse Source 
Drop the workspaceRoot parameter from resolveToolchainPaths /
Toolchain.resolvePaths entirely. The old code resolved
\`<workspaceRoot>/native/dugite/bin/git\` as the git binary before
falling back to PATH — a malicious repo could commit an executable
at that path and clide would run it on the first auto-fired
git.status (which fires automatically on workspace open).

Dugite now resolves against trusted locations only:
1. CLIDE_DUGITE_DIR env var (dev override).
2. <exe-parent>/dugite/bin/git (production bundle).
3. <exe-parent>/lib/dugite/bin/git (alternate bundle layout).

Test plants `native/dugite/bin/git` in a temp workspace and asserts
the resolved git path is NOT inside the workspace.

Callers updated (8 sites): main.dart, backend_entry.dart twice,
test_app.dart three times (compute now wraps a no-arg call), plus
five test fixtures. backend.dart's now-vestigial hintRoot left in
the struct for cleanup under T-99.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
jpmschweitzer
2026-05-17 20:56:02 +02:00
co-authored by Claude Opus 4.7
parent 8d1fcabb98
commit 70ce6c270e
13 changed files with 107 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/test_app.dart
+4 -4
View File
@@ -86,7 +86,7 @@ class _ClideTestAppState extends State<ClideTestApp> {
_say('');
final tc = Toolchain();
tc.applyResolved(Toolchain.resolvePaths(workspaceRoot: workDir));
tc.applyResolved(Toolchain.resolvePaths());
if (runToolchain) await _runToolchainTests(tc, workDir);
if (runIpc) await _runIpcTests(workDir);
@@ -159,12 +159,12 @@ class _ClideTestAppState extends State<ClideTestApp> {
_say('--- boot sequence ---');
await _testAsync('compute(resolveToolchainPaths)', () async {
final paths = await compute(resolveToolchainPaths, workDir);
final paths = await compute((_) => resolveToolchainPaths(), null);
return 'git=${paths.git} pql=${paths.pql}';
});
await _testAsync('Isolate.run(resolveToolchainPaths)', () async {
final paths = await Isolate.run(() => resolveToolchainPaths(workDir));
final paths = await Isolate.run(resolveToolchainPaths);
return 'git=${paths.git} pql=${paths.pql}';
});
@@ -180,7 +180,7 @@ class _ClideTestAppState extends State<ClideTestApp> {
});
await _testAsync('compute + immediate Process.run', () async {
final paths = await compute(resolveToolchainPaths, workDir);
final paths = await compute((_) => resolveToolchainPaths(), null);
final tc2 = Toolchain();
tc2.applyResolved(paths);
final r = await Process.run(tc2.git, ['rev-parse', '--show-toplevel'], workingDirectory: workDir, environment: tc2.gitEnv);