Repository navigation
0.24.0: treat the manager as untrusted (security release) - #72
Merged
Merged
Conversation
The agent must hold even if the manager, or anything impersonating it, is hostile. Fixes the ten draft advisories from the 2026-09-27 review, and the two further instances of the same class found while fixing them. - URLs: backup uploads and media downloads only to manager.dartec.ae over https; redirects refused on the streamed upload and re-checked hop by hop on downloads; Dartec Link only joins https://headscale.dartec.ae, rebuilt from the allowlist (GHSA-v9pc-vw88-p798, GHSA-mqpf-x42g-g28w, GHSA-hrm5-cvxj-cc7w). - Sizes: media capped at 20 MB and backups at 4096 MB whatever the command asks, enforced on the bytes read or sent (GHSA-88r5-5vxg-53px). - Ids: automation ids, add-on slugs, backup ids and backup agents match strict patterns before they reach a path (GHSA-qj62-wg85-79cv, plus addon_slug and backup_id). - Targets: entity_id is split the way Home Assistant splits it, every entry checked, and the call made with the checked list (GHSA-vj2g-mxcr-wx5r). - Consent: scene.turn_on and automation.turn_on/turn_off are sensitive (GHSA-4m4w-x5r5-hmvh, GHSA-rwhg-fxhq-m6pg); only an administrator can grant consent, anyone can withdraw it (GHSA-qx58-m2pf-8388); Link and tunnel setup ask again after installing. - Household: create, update and remove are serialised, so two administrators cannot remove each other (GHSA-cvj4-75mr-7858). trust.py holds the allowlists and patterns; docs/trust-boundary.md the rules for new commands; tests/test_untrusted_manager.py one regression per advisory, each failing on 0.23.0.
A refused URL, id, size or ended consent inside a handler now gets the same 'Refused remote command' logbook line as a dispatcher refusal, instead of the 'Dartec ran ...' line sensitive actions get.
The owner's decision, 2026-09-27. The tunnel published a home's login page on the internet through whichever Cloudflare account the token in the command belonged to, and nothing on the home could check that. tunnel_setup is removed and refused by name (service_policy.RETIRED_ACTIONS, code 'retired') before consent is read, so no window brings it back. tunnel_status and tunnel_stop remain, to find and take down an existing tunnel.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The fix for GHSA-vj2g-mxcr-wx5r, GHSA-4m4w-x5r5-hmvh, GHSA-rwhg-fxhq-m6pg, GHSA-v9pc-vw88-p798, GHSA-qj62-wg85-79cv, GHSA-mqpf-x42g-g28w, GHSA-88r5-5vxg-53px, GHSA-cvj4-75mr-7858, GHSA-qx58-m2pf-8388 and GHSA-hrm5-cvxj-cc7w, developed and reviewed in the advisories' private fork and released now on the owner's go. The rules it enforces are in
docs/trust-boundary.md; the regression tests intests/test_untrusted_manager.py. Also retirestunnel_setup(Dartec Link replaces it).Tested: 1036 unit tests; live Home Assistant 2026.9.2 and 2026.8.3 (main, household, panels) run locally.
🤖 Generated with Claude Code