cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.0k Pull Requests 115 Actions Packages Projects Releases Wiki Activity

docs(spec): clarify sandbox path containment, datetime comparison, and plugin validation contracts #8276

Closed
HAL9000 wants to merge 1 commits from docs/m3-spec-clarify-path-datetime-plugin-contracts into master
pull from: docs/m3-spec-clarify-path-datetime-plugin-contracts
merge into: cleveragents:master
Conversation 6 Commits 1 Files Changed 2
+66

1 Commits

Author SHA1 Message Date
HAL9000 0d6d911e9d docs(spec): clarify sandbox path containment, datetime comparison, and plugin validation contracts
CI / push-validation (pull_request) Successful in 17s
Details
CI / helm (pull_request) Successful in 23s
Details
CI / lint (pull_request) Successful in 28s
Details
CI / quality (pull_request) Successful in 33s
Details
CI / build (pull_request) Successful in 35s
Details
CI / typecheck (pull_request) Successful in 57s
Details
CI / security (pull_request) Successful in 58s
Details
CI / e2e_tests (pull_request) Successful in 3m3s
Details
CI / integration_tests (pull_request) Successful in 6m40s
Details
CI / unit_tests (pull_request) Successful in 7m29s
Details
CI / docker (pull_request) Successful in 11s
Details
CI / coverage (pull_request) Successful in 10m24s
Details
CI / status-check (pull_request) Successful in 1s
Details
CI / benchmark-publish (pull_request) Has been skipped
Details
CI / benchmark-regression (pull_request) Successful in 57m4s
Details 
Three implementation contracts clarified in response to security/correctness
bugs surfaced by the bug hunt pool:

1. Path containment: Sandbox path validation MUST use Path.is_relative_to()
   not string prefix comparison. String prefix allows /tmp/sandboxmalicious
   to pass a /tmp/sandbox root check. Canonical implementation provided.

2. Datetime handling: All stored ISO timestamp comparisons MUST parse back
   to timezone-aware datetime objects before comparing. String comparison
   of ISO timestamps is incorrect when timezone offsets differ in format.
   Canonical parse_utc_ts() pattern provided.

3. Plugin protocol validation: Protocol compliance MUST be checked
   structurally via issubclass() — never by instantiating the plugin class.
   Instantiation runs __init__ side effects before the plugin is approved.

These are minor clarifications (implementation contracts, not architectural
changes) added to the existing Security and Extensibility sections.
Updated CHANGELOG.md with entry for this documentation change.

Refs: BUG-HUNT issues #7336 (path traversal), #7341 (datetime comparison),
      #7331 (plugin instantiation)

ISSUES CLOSED: #7680
 2026-04-13 07:21:54 +00:00