WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-09-20 16:47:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3126 from VarunGore36/fix/reviewer-followups

Browse Source 
fix(security): security follow-ups for worker, installer, claw, hooks
This commit is contained in:
Affaan Mustafa
2026-09-19 19:58:43 -04:00
committed by GitHub
parent a0600a00fb d5dee31321
commit fc9273e5e0
16 changed files with 453 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/codex-git-hooks/pre-commit
+4 -3
View File
@@ -5,12 +5,13 @@ set -euo pipefail
# Blocks commits that add high-signal secrets.
if [[ "${ECC_SKIP_GIT_HOOKS:-0}" == "1" || "${ECC_SKIP_PRECOMMIT:-0}" == "1" ]]; then
printf '[ECC pre-commit] WARNING: hook bypassed via env (ECC_SKIP_*=1)\n' >&2
exit 0
fi
if [[ -f ".ecc-hooks-disable" || -f ".git/ecc-hooks-disable" ]]; then
exit 0
fi
# NOTE: file-based disables (.ecc-hooks-disable) were removed — a malicious
# repo could ship that file and silently turn off secret scanning exactly
# where it is most needed. Use the env bypass above (audible warning) instead.
if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
exit 0
scripts/codex-git-hooks/pre-push
+21 -5
View File
@@ -5,12 +5,12 @@ set -euo pipefail
# Runs a lightweight verification flow before pushes.
if [[ "${ECC_SKIP_GIT_HOOKS:-0}" == "1" || "${ECC_SKIP_PREPUSH:-0}" == "1" ]]; then
printf '[ECC pre-push] WARNING: hook bypassed via env (ECC_SKIP_*=1)\n' >&2
exit 0
fi
if [[ -f ".ecc-hooks-disable" || -f ".git/ecc-hooks-disable" ]]; then
exit 0
fi
# NOTE: file-based disables (.ecc-hooks-disable) were removed — a malicious
# repo could ship that file and silently disable verification.
if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
exit 0
@@ -85,8 +85,14 @@ run_node_script() {
}
if [[ -f "package.json" ]]; then
pm="$(detect_pm)"
log "Node project detected (package manager: $pm)"
# SECURITY: executing a cloned repo's lint/test/build scripts on push is
# arbitrary code execution (package.json scripts run as you). Opt-in only:
# set ECC_PREPUSH_RUN_CHECKS=1 for repos you trust.
if [[ "${ECC_PREPUSH_RUN_CHECKS:-0}" != "1" ]]; then
printf '[ECC pre-push] Node project detected but ECC_PREPUSH_RUN_CHECKS!=1; skipping repo script execution (set =1 to opt in).\n' >&2
else
pm="$(detect_pm)"
log "Node project detected (package manager: $pm)"
for script_name in lint typecheck test build; do
if has_node_script "$script_name"; then
@@ -98,7 +104,9 @@ if [[ -f "package.json" ]]; then
fi
done
fi
if [[ "${ECC_PREPUSH_AUDIT:-0}" == "1" ]]; then
pm="${pm:-$(detect_pm)}"
ran_any_check=1
log "Running dependency audit (ECC_PREPUSH_AUDIT=1)"
case "$pm" in
@@ -111,6 +119,9 @@ if [[ -f "package.json" ]]; then
fi
fi
# SECURITY: go test / pytest execute repo-controlled code (TestMain,
# conftest.py). Same opt-in gate as Node scripts above.
if [[ "${ECC_PREPUSH_RUN_CHECKS:-0}" == "1" ]]; then
if [[ -f "go.mod" ]] && command -v go >/dev/null 2>&1; then
ran_any_check=1
log "Go project detected. Running: go test ./..."
@@ -281,6 +292,11 @@ if [[ -f "pyproject.toml" || -f "requirements.txt" ]]; then
log " venv, env, uv, poetry, PATH). Set ECC_PYTEST_CMD to point at it."
fi
fi
else
if [[ -f "go.mod" || -f "pyproject.toml" || -f "requirements.txt" ]]; then
log "Go/Python project detected but ECC_PREPUSH_RUN_CHECKS!=1; skipping test execution."
fi
fi
if [[ "$ran_any_check" -eq 0 ]]; then