Merge PR #685: security: retire resolved findings from 2026-06-19 SARIF files

Author: merge-queue-bot

docs/security/2026-06-19-full-repo-audit/findings.json

@@ -12,6 +12,8 @@
       "title": "<?include?> directive follows within-workspace symlinks to files outside the workspace root",
       "severity": "high",
       "confidence": "confirmed",
+      "status": "fixed",
+      "fixed_by": "PR #670 — replaced os.DirFS with os.OpenRoot(rootDir).FS() via lint.OpenRootFS in internal/lint/file.go; os.OpenRoot enforces RESOLVE_BENEATH semantics, refusing symlinks whose targets escape the workspace root",
       "surface": "directive",
       "cwe": "CWE-73",
       "location": {
@@ -33,6 +35,8 @@
       "title": "<?catalog glob:?> follows within-workspace symlinks to files outside the workspace root",
       "severity": "high",
       "confidence": "confirmed",
+      "status": "fixed",
+      "fixed_by": "PR #670 — same fix as S001: all RootFS construction sites use lint.OpenRootFS backed by os.OpenRoot; os.OpenRoot.FS() denies GlobWalk traversal through symlinks that target paths outside the workspace root",
       "surface": "directive",
       "cwe": "CWE-73",
       "location": {
@@ -54,6 +58,8 @@
       "title": "CLI engine-runner goroutines lack per-goroutine recover() — rule panic crashes the process",
       "severity": "medium",
       "confidence": "confirmed",
+      "status": "fixed",
+      "fixed_by": "PR #670 — added defer recover() at the top of lintFile (internal/engine/runner.go:396-400); panics in any rule's Check or Fix are caught, converted to InternalError diagnostics, and the process continues linting the remaining files",
       "surface": "cli",
       "cwe": "CWE-390",
       "location": {
@@ -71,6 +77,8 @@
       "title": "<?catalog glob:?> has no per-directive file-count cap — large repos can cause OOM",
       "severity": "low",
       "confidence": "confirmed",
+      "status": "fixed",
+      "fixed_by": "PR #670 — added maxCatalogMatches = 10_000 constant in internal/rules/catalog/rule.go:40; resolveGlobMatchesFrom returns errCatalogCapExceeded and emits a user-facing diagnostic once the cap is exceeded",
       "surface": "directive",
       "cwe": "CWE-400",
       "location": {
@@ -88,6 +96,8 @@
       "title": "hasSymlinkAncestor skips ancestor scan when cwd is unresolvable and no .git root exists",
       "severity": "low",
       "confidence": "confirmed",
+      "status": "fixed",
+      "fixed_by": "PR #670 — changed hasSymlinkAncestor in internal/lint/files.go:274-277 to return an error when ancestorStopBoundary is empty (fail-closed); the caller now skips the path rather than silently passing the symlink check",
       "surface": "cli",
       "cwe": "CWE-61",
       "location": {
@@ -105,6 +115,8 @@
       "title": "<?include?> path validation does not explicitly reject URL schemes — incidentally safe but fragile",
       "severity": "info",
       "confidence": "confirmed",
+      "status": "fixed",
+      "fixed_by": "PR #670 — added explicit strings.Contains(file, \"://\") URL-scheme check in validateIncludeDirective (internal/rules/include/rule.go:140-143); URL-scheme paths are now rejected with a diagnostic rather than incidentally failing at os.DirFS",
       "surface": "directive",
       "cwe": "CWE-918",
       "location": {
@@ -122,6 +134,8 @@
       "title": "githooksync rule reads hook and gitattributes files with unbounded os.ReadFile",
       "severity": "info",
       "confidence": "confirmed",
+      "status": "fixed",
+      "fixed_by": "PR #670 — replaced all four os.ReadFile calls in internal/rules/githooksync/rule.go (lines 187, 261, 307, 398) with bytelimit.ReadFileLimited(path, hookMaxReadBytes) where hookMaxReadBytes = 1024*1024",
       "surface": "git",
       "cwe": "CWE-400",
       "location": {

docs/security/2026-06-19-full-repo-audit/findings.sarif

@@ -151,260 +151,7 @@
           ]
         }
       },
-      "results": [
-        {
-          "ruleId": "S001",
-          "ruleIndex": 0,
-          "level": "error",
-          "message": {
-            "text": "<?include?> directive follows within-workspace symlinks to files outside the workspace root"
-          },
-          "locations": [
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "internal/rules/include/rule.go"
-                },
-                "region": {
-                  "startLine": 253,
-                  "endLine": 267
-                }
-              }
-            },
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "internal/lint/file.go"
-                },
-                "region": {
-                  "startLine": 286,
-                  "endLine": 286
-                }
-              }
-            },
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "pkg/mdsmith/workspace.go"
-                },
-                "region": {
-                  "startLine": 100,
-                  "endLine": 100
-                }
-              }
-            }
-          ],
-          "properties": {
-            "confidence": "confirmed",
-            "severity": "high"
-          }
-        },
-        {
-          "ruleId": "S002",
-          "ruleIndex": 1,
-          "level": "error",
-          "message": {
-            "text": "<?catalog glob:?> follows within-workspace symlinks to files outside the workspace root"
-          },
-          "locations": [
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "internal/rules/catalog/rule.go"
-                },
-                "region": {
-                  "startLine": 893,
-                  "endLine": 906
-                }
-              }
-            },
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "internal/lint/file.go"
-                },
-                "region": {
-                  "startLine": 286,
-                  "endLine": 286
-                }
-              }
-            },
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "pkg/mdsmith/workspace.go"
-                },
-                "region": {
-                  "startLine": 100,
-                  "endLine": 100
-                }
-              }
-            }
-          ],
-          "properties": {
-            "confidence": "confirmed",
-            "severity": "high"
-          }
-        },
-        {
-          "ruleId": "S003",
-          "ruleIndex": 2,
-          "level": "warning",
-          "message": {
-            "text": "CLI engine-runner goroutines lack per-goroutine recover() — rule panic crashes the process"
-          },
-          "locations": [
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "internal/engine/runner.go"
-                },
-                "region": {
-                  "startLine": 353,
-                  "endLine": 370
-                }
-              }
-            }
-          ],
-          "properties": {
-            "confidence": "confirmed",
-            "severity": "medium"
-          }
-        },
-        {
-          "ruleId": "S004",
-          "ruleIndex": 3,
-          "level": "note",
-          "message": {
-            "text": "<?catalog glob:?> has no per-directive file-count cap — large repos can cause OOM"
-          },
-          "locations": [
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "internal/rules/catalog/rule.go"
-                },
-                "region": {
-                  "startLine": 888,
-                  "endLine": 920
-                }
-              }
-            }
-          ],
-          "properties": {
-            "confidence": "confirmed",
-            "severity": "low"
-          }
-        },
-        {
-          "ruleId": "S005",
-          "ruleIndex": 4,
-          "level": "note",
-          "message": {
-            "text": "hasSymlinkAncestor skips ancestor scan when cwd is unresolvable and no .git root exists"
-          },
-          "locations": [
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "internal/lint/files.go"
-                },
-                "region": {
-                  "startLine": 244,
-                  "endLine": 246
-                }
-              }
-            }
-          ],
-          "properties": {
-            "confidence": "confirmed",
-            "severity": "low"
-          }
-        },
-        {
-          "ruleId": "S006",
-          "ruleIndex": 5,
-          "level": "note",
-          "message": {
-            "text": "<?include?> path validation does not explicitly reject URL schemes — incidentally safe but fragile"
-          },
-          "locations": [
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "internal/rules/include/rule.go"
-                },
-                "region": {
-                  "startLine": 130,
-                  "endLine": 170
-                }
-              }
-            }
-          ],
-          "properties": {
-            "confidence": "confirmed",
-            "severity": "info"
-          }
-        },
-        {
-          "ruleId": "S007",
-          "ruleIndex": 6,
-          "level": "note",
-          "message": {
-            "text": "githooksync rule reads hook and gitattributes files with unbounded os.ReadFile"
-          },
-          "locations": [
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "internal/rules/githooksync/rule.go"
-                },
-                "region": {
-                  "startLine": 180,
-                  "endLine": 180
-                }
-              }
-            },
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "internal/rules/githooksync/rule.go"
-                },
-                "region": {
-                  "startLine": 249,
-                  "endLine": 249
-                }
-              }
-            },
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "internal/rules/githooksync/rule.go"
-                },
-                "region": {
-                  "startLine": 295,
-                  "endLine": 295
-                }
-              }
-            },
-            {
-              "physicalLocation": {
-                "artifactLocation": {
-                  "uri": "internal/rules/githooksync/rule.go"
-                },
-                "region": {
-                  "startLine": 386,
-                  "endLine": 386
-                }
-              }
-            }
-          ],
-          "properties": {
-            "confidence": "confirmed",
-            "severity": "info"
-          }
-        }
-      ]
+      "results": []
     }
   ]
 }

docs/security/2026-06-19-lsp-vscode-audit/findings.json

@@ -115,6 +115,8 @@
       "title": "VS Code extension: mdsmith.kinds.resolve and mdsmith.kinds.why run in untrusted workspaces without a trust gate",
       "severity": "low",
       "confidence": "confirmed",
+      "status": "fixed",
+      "fixed_by": "PR #670 — added isWorkspaceTrusted to commandPalette when-conditions (package.json:125-130) and isTrusted() guard at top of runKindsResolve/runKindsWhy (kinds.ts:42,58)",
       "surface": "vscode",
       "cwe": "CWE-284",
       "location": {
@@ -130,13 +132,15 @@
       "description": "The commandPalette 'when' conditions for mdsmith.kinds.resolve and mdsmith.kinds.why omit isWorkspaceTrusted (package.json:125-130). When invoked in an untrusted workspace, wiring.ts:829/838 calls runKindsResolve/runKindsWhy with no isTrusted() guard, spawning 'mdsmith kinds resolve/why --json -- file' (virtual-doc.ts:72). The binary is the bundled binary (mdsmith.path is restricted to default). The subcommands are read-only: they output JSON and exit; no files are written, no recipes are executed. The binary reads .mdsmith.yml to derive kind assignments, so a hostile config can inject attacker-controlled text into the virtual document pane but cannot execute code.",
       "impact": "Low. In untrusted workspaces a hostile .mdsmith.yml causes mdsmith to output attacker-controlled text into the virtual document pane. No file writes or code execution. The virtual document is read-only in the editor. The binary cannot be redirected (mdsmith.path restricted).",
       "repro": "Clone a hostile repo with a malformed .mdsmith.yml. Open a .md file. Run 'mdsmith: Explain Rule on This File' from the palette. The virtual document displays content derived from the hostile config.",
-      "remediation": "Add 'isWorkspaceTrusted' to the commandPalette 'when' conditions for mdsmith.kinds.why and mdsmith.kinds.resolve, and add an isTrusted() guard at the top of runKindsResolve/runKindsWhy — matching the pattern used by fix-workspace, init, and merge-driver. These are informational commands so the restriction is minor friction."
+      "remediation": "Fixed. Added 'isWorkspaceTrusted' to commandPalette when-conditions (package.json:125-130) and isTrusted() guard at top of runKindsResolve/runKindsWhy in kinds.ts."
     },
     {
       "id": "S007",
       "title": "VS Code extension: mdsmith-rule: virtual document content provider runs without trust gate",
       "severity": "low",
       "confidence": "confirmed",
+      "status": "fixed",
+      "fixed_by": "PR #670 — added isTrusted() guard in registerTextDocumentContentProvider for RULE_SCHEME (wiring.ts:915)",
       "surface": "vscode",
       "cwe": "CWE-284",
       "location": {
@@ -151,7 +155,7 @@
       "description": "The mdsmith-rule: TextDocumentContentProvider (wiring.ts:906-910) runs 'mdsmith help rule <id>' to render an embedded rule README. It has no trust gate. The id is validated against /^MDS\\d+$/i (rule-doc.ts:35) before being passed as a CLI argument, so arbitrary arg injection is prevented. The binary is the bundled binary (mdsmith.path restricted). 'mdsmith help rule' reads READMEs embedded in the binary and makes no network call, no file writes. The `OPEN_RULE_DOC_COMMAND` constant is triggered by rewritten hover links in MarkdownString blocks with isTrusted set only to `{enabledCommands: ['OPEN_RULE_DOC_COMMAND']}` (rule-doc.ts:115), preventing other commands from being injected. Risk is minimal but the pattern is inconsistent with the trust model.",
       "impact": "Very low. The worst case is spawning the bundled mdsmith binary with a validated rule ID argument. The output is embedded README text displayed in a read-only virtual document.",
       "repro": "Hover over a diagnostic in an untrusted workspace. Click the rewritten rule-docs link. 'mdsmith help rule MDS0XX' runs.",
-      "remediation": "Low priority. If desired, add a trust check before spawning in provideRuleDocContent / fetchRuleDocContent. Alternatively, embed the rule READMEs directly in the extension's JS bundle to eliminate the spawn entirely for this read-only use case."
+      "remediation": "Fixed. Added if (!isTrusted()) return Promise.resolve('') at the top of the RULE_SCHEME content provider in wiring.ts:915."
     }
   ]
 }