From 26348a2c164d447fdcc97bbb01e4715e2b8259c6 Mon Sep 17 00:00:00 2001 From: CleverThis Date: Fri, 15 May 2026 01:49:47 +0000 Subject: [PATCH] fix(lsp): prevent header injection in LSP transport ASCII decoding Closes #7112 ISSUES CLOSED: #7112 EPIC REFERENCES: #824 --- CHANGELOG.md | 5 +++++ CONTRIBUTORS.md | 1 + 2 files changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index bdea20376..3e8b7623a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -272,6 +272,11 @@ Changed `wf10_batch.robot` to be less likely to create files, and versions (<3.13.4) cannot be installed even if upstream transitive dependencies have loose version constraints. +- **LSP transport header injection fix** (#10608 / #7112): The `_read_one_message()` method in + `src/cleveragents/lsp/transport.py` now uses `errors="strict"` instead of `errors="replace"` for + ASCII decoding of LSP headers, preventing header injection attacks. Non-ASCII bytes raise + `LspError`. A printable-ASCII guard rejects characters outside 0x20-0x7E range. Epic #824. + ### Fixed - **Error suppression removed from `reactive_registry_adapter.py`** (#9060): Removed two `try...except Exception:` blocks in `register_registry_agents()` that silently suppressed errors, violating the CONTRIBUTING.md fail-fast policy. Exceptions from `actor_registry.list_actors()` and the route bridge refresh now propagate to the caller instead of being swallowed. Added Behave scenarios verifying RuntimeError, AttributeError, and TypeError propagation. diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md index e97eb3f11..205a0edb2 100644 --- a/CONTRIBUTORS.md +++ b/CONTRIBUTORS.md @@ -28,6 +28,7 @@ Below are some of the specific details of various contributions. * HAMZA KHYARI has contributed the ACMS execute-phase context assembler project-level hot_max_tokens fix (PR #11036 / issue #11035): added `_resolve_effective_budget()` method that reads each linked project's `settings.hot_max_tokens` and uses the maximum override value as the pipeline budget instead of the hardcoded global 16K default. * This project was made possible thanks to considerable donation of time, money, and resources by CleverThis, Inc. * HAL 9000 has contributed automated bug fixes, CLI output formatting improvements, and ongoing maintenance as part of the CleverAgents automation system. +* HAL 9000 has contributed the LSP transport header injection vulnerability fix (PR #10608 / issue #7112): restored strict ASCII decoding in `_read_one_message()` by using `errors="strict"`, added LspError exception raises on non-ASCII byte detection, and implemented a printable-ASCII guard rejecting characters outside the 0x20-0x7E codepoint range. * HAL 9000 has contributed the file edit encoding parameter fix (PR #8258 / issue #7559). * HAL 9000 has contributed the architecture-pool-supervisor milestone assignment feature (PR #8188 / issue #7521): added `forgejo_update_pull_request` permission and documented the PR workflow for major spec changes, enabling automatic milestone assignment for specification PRs. * HAL 9000 has contributed the git worktree TOCTOU race condition fix (PR #8178 / issue #7507): replaced the unsafe mkdtemp() + rmdir() pattern with a parent-directory approach to eliminate the race window in concurrent git worktree operations.