Repository navigation
harden osv adapter (sandbox, injection, cancellation, checkpoints) + Java - #6
Merged
Merged
Conversation
…kpoints) Addresses the automated review on the dependency-CVE adapter: Security: - uv is now sandboxed when resolving a repo-controlled manifest: `--no-build` (no PEP 517 build hooks / dynamic-metadata project builds), `--no-sources` (ignore attacker `[tool.uv.sources]`), and an empty temp cwd (no project `uv.toml`/`[tool.uv]`). Resolution still works; repo code never executes. - Sanitize package name/version (collapse whitespace, clamp length) before they reach the threat-model prompt — blocks newline/markdown injection from attacker-controlled lockfile fields. - osv-scanner now runs with a timeout (it had none) so a stalled scan can't wedge the info phase indefinitely. - Probe for uv/osv-scanner on PATH; a missing tool is reported distinctly (warn, no artifact) instead of writing an empty osv-findings.json that reads as "no vulnerable dependencies". Correctness: - Skip floor resolution when an authoritative lockfile exists (uv.lock, poetry.lock, requirements.txt, …) so installed/patched versions aren't overridden by hypothetical floor versions (false positives). - Resolve both lowest and highest allowed versions (widens range coverage). - Resolve every manifest in a monorepo, not just the first. - Dedupe parseOsv by name@version@ecosystem (a package can surface from multiple resolved lockfiles). - Matcher prompt: require closesSurfaceIds (the schema rejects empty, which could abort setup) — point it at the surface the vulnerable call sits in. Checkpoints / durability: - Bump rubricVersion (2 -> 3) so existing projects re-run and gain the enrichment. - Don't restore the pre-osv INFO.md over the CVE-enriched threat model. - Run the dependency-CVE matcher pass only on first generation, not every resume. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the PR vercel-labs#190 review hardening onto fork main, reconciled with the Java/Maven SBOM code so main has both:
Security: uv sandboxed (
--no-build,--no-sources, isolated cwd); name/version sanitized before the prompt; osv-scanner timeout; probe uv/syft/osv-scanner on PATH (missing tool reported distinctly).Correctness: skip floor-resolution when a real lockfile exists; resolve lowest+highest; resolve every manifest (monorepo); parseOsv dedup; matcher prompt requires closesSurfaceIds.
Durability: rubricVersion 2→3; don't overwrite CVE-enriched INFO.md; dep-CVE matcher pass only on first generation.
Java: syft SBOM path retained and probed (toolExists("syft")), shares the hardened osv-scanner invocation.
481 tests pass; typecheck + lint clean.
🤖 Generated with Claude Code