mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-09-30 20:53:15 +00:00
Adam Moussa
1ba5ccc65d
- Mirror upstream #1786's nested-shell / executable-normalization hardening into the fork-only pr_verdict_guard.py (verdict-gating is a real fork control), keeping it in parity with pr_creation_guard.py. - Close the glued short-flag bypass (bash -c'...') in BOTH guards: a shell's -c argument can be concatenated into the same argv token, which the space-separated -c detection missed. Diverges pr_creation_guard.py from upstream #1786 by design; to be upstreamed. - Gate the new #1799 sidebar active-thread refresh on ownership so a non-owner viewing a shared thread reads last-known state without persisting a metadata write (mirrors the is_owner gate on the single-thread read path). - Fix an F821 in the #1799 cherry-pick (Mapping import / concrete dict type). Guards remain intentionally fail-open per the honest-agent threat model; docstrings narrowed to name the residual exotic-shell / stdin-fed vectors. |
||
|---|---|---|
| .. | ||
| test_app_bot_identity.py | ||
| test_autofix_webhook.py | ||
| test_ci_autofix.py | ||
| test_github_app.py | ||
| test_github_checks.py | ||
| test_github_ci.py | ||
| test_github_comment_prompts.py | ||
| test_github_feedback.py | ||
| test_github_http.py | ||
| test_github_issue_webhook.py | ||
| test_github_proxy_refresh.py | ||
| test_normalize_repo.py | ||
| test_open_pull_request.py | ||
| test_pr_creation_guard.py | ||
| test_pr_verdict_guard.py | ||
| test_repo_extraction.py | ||