release: 2.2.0 - #24
Merged
Merged
Conversation
crowd.dev's settings produced 22 identical word-boundary warnings, and exactly one of the 22 rules grants remote writes. The one that deletes a branch read no louder than git logfoo. Three measured mechanics now set the volume. A wildcarded gh api allow rule is a write grant: flags ride any star, and gh switches GET to POST the moment a parameter is added — Bash(gh api repos*) auto-approved -X DELETE, -f description=x, and a git/refs branch deletion. A mid-rule star spans words, so one standing before the runner's subcommand admits an exec form: pnpm --filter web exec rm -rf ./x build was auto-approved by Bash(pnpm --filter * build). And fusion is ranked by reach: a one-word prefix swaps the program itself (python* covers python3), anything longer must share the prefix and drops to info. One fact per rule: the sharpest statement about a wildcard suppresses the word-boundary nag on the same rule. Deliberately not curl: the same flags ride its wildcards, but unlock writes nothing in the command is authorised to make.
A minor by the project's own precedent: a repository that reported nothing can now report a wildcarded gh api rule as a write grant, and two thirds of the corpus's word-boundary warnings drop to info. Every new sentence carries the measurement that grounds it. Internal ranges move with the version, as they did the last two times.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A ranking release: finding volume now tracks measured consequence on the permissions surface.
The motivating case: the Linux Foundation's crowd.dev settings produced 22 identical AGF506 warnings, of which exactly one rule (
Bash(gh api repos*)) grants remote writes. After this PR: 1 warning, 21 infos.gh apiallow rule reported as a write grant-X DELETE,-f description=x, and agit/refsbranch deletion all auto-approved underBash(gh api repos*); gh's own help documents the GET-to-POST switchpnpm --filter web exec rm -rf ./x buildauto-approved byBash(pnpm --filter * build); quiet once the subcommand is pinnedpython*coverspython3 -c ...;git logfoois nobody's commandBash(git * main)auto-approvesgit push --force origin mainDeliberately not curl/wget: the same flags ride their wildcards, but the write they unlock carries no credentials the command did not spell out. Scoping to
gh api(token on every call) is what keeps this out of the wall-of-noise failure the pattern set's own comment warns about.Corpus regression (344 real settings files, 12,556 rules)
api-method-ride-along: 34 hits, all wildcardedgh apirulesexec-admitting-wildcard: 0 corpus hits (the prisma shape is not in the sample; its fixtures carry the measurements)wildcard-before-subcommand: 4, including the measuredBash(git * main)force-push caseVersion
Minor by the project's own precedent: repositories that reported nothing can now report a finding. No new codes; severity defaults are documented as not stable.
Testing