🔒 Fix ReDoS vulnerability in read_secrets security rule#87
🔒 Fix ReDoS vulnerability in read_secrets security rule#87google-labs-jules[bot] wants to merge 1 commit into
Conversation
The previous regular expression for the `read_secrets` rule in `hooks/security_guard.py` used `.*` which was vulnerable to catastrophic backtracking (ReDoS) when processing long command arguments. This commit replaces the vulnerable pattern with a custom programmatic `check` parser (`_is_reading_secrets`). It properly tokenizes the shell command using existing `_split_subcommands` and `_shell_split` functions, identifying the command and testing specific target arguments safely, mitigating the denial of service risk.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
🎯 What: Fixed a catastrophic ReDoS (Regular Expression Denial of Service) vulnerability in the
⚠️ Risk: A long shell command argument could cause the naive
read_secretsrule of thesecurity_guardhook..*regex to backtrack extensively, leading to a denial of service (CPU exhaustion) against the agent.🛡️ Solution: Removed the vulnerable regex pattern and introduced a custom
_is_reading_secretscheck function. This relies on the robust_split_subcommandsand_shell_splitlogic to properly identify the executable in position and validate if trailing arguments match secret files without resorting to unbounded lookaheads.PR created automatically by Jules for task 7366585897842753865 started by @zknpr