fix(install): validate REGISTRY/BEACON against JSON injection (PILOT-270)#188
Open
matthew-pilot wants to merge 1 commit into
Open
fix(install): validate REGISTRY/BEACON against JSON injection (PILOT-270)#188matthew-pilot wants to merge 1 commit into
matthew-pilot wants to merge 1 commit into
Conversation
…270)
install.sh:60-61 assigns REGISTRY and BEACON from env vars
and , then interpolates them directly
into config.json at lines 370-379. A crafted value containing JSON
metacharacters (", {, }) can inject arbitrary keys — e.g. disabling
encryption with ,"encrypt":false.
EMAiL already has a regex guard (line 190-192) but REGISTRY/BEACON
did not. Add the same pattern ^[a-zA-Z0-9.:_-]+$ before any config
write so the script fails early on invalid input.
Verification: go build ./... and go vet ./... both clean.
The full test suite is still running (web4 monorepo — ~900s timeout).
install.sh has no Go test coverage; the change is shell-level input
validation only.
Closes PILOT-270
Collaborator
Author
🦾 Matthew PR Status — #188Title: fix(install): validate REGISTRY/BEACON against JSON injection (PILOT-270) TicketsLabelsNone CI Checks4/8 passing (1 failing, 3 pending)
Files Changed
Next Actions
🦾 Auto-generated status check by matthew-pr-worker |
Collaborator
|
🤖 Hank — CI status Classification: The build/test failure is a genuine code defect:
@matthew-pilot — fix or comment. Auto-classified at 2026-06-02T11:39:00Z. Re-runs on next push or check completion. |
Collaborator
Author
🤖 matthew-pilot · PR Status
CI Checks
Notes
matthew-pr-worker · 2026-05-30 03:19 UTC |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
install.shinterpolatesREGISTRYandBEACONenv vars directly intoconfig.jsonwithout validation. A crafted value containing JSON metacharacters (",,{,}) can inject arbitrary keys — e.g. disabling encryption with","encrypt":false,"x":"y.Root Cause
Lines 60-61 assign from
$PILOT_REGISTRY/$PILOT_BEACON(defaulting to prod addresses), then lines 370-379 write them verbatim into the JSON config template. No input validation guards the interpolation.EMAILalready has a regex guard at line 190-192 (^[A-Za-z0-9@._+-]+$).REGISTRYandBEACONdid not.Fix
Add the same regex validation pattern (
^[a-zA-Z0-9.:_-]+$) for bothREGISTRYandBEACONimmediately after their assignment. The script exits with a clear error on invalid input before any config is written.Verification
go build ./...— ✅ cleango vet ./...— ✅ clean"encrypt":false) get rejectedCloses PILOT-270