Repository navigation
feat: harden scanner against installer/loader gaps and add WebAssembly analysis - #2
Merged
Merged
Conversation
- Scan `__MACOSX/`, `.DS_Store` and `Thumbs.db` entries: Acode installs them, so code hidden there was never analysed. Real metadata is recognised by its header and stays quiet. - Resolve `main` the way loadPlugin.js does: a `main` that climbs out of the plugin folder is Critical, one with backslashes falls back to main.js. - Grade Executor / terminal commands by source like eval: downloaded is Critical, decoded is High. - Follow `.call`, `.apply`, `.bind`, `Reflect.apply` and `Reflect.construct` to the real target. - Flag plugins that write scripts or plugin.json where code is loaded from (own folder, baseUrl, cache/data storage); Critical when the content is downloaded or the entry/manifest is rewritten. - Flag requests to acode.app/api, which Acode sends with the user's cookies (non-GET High, account reads Medium and part of the exfiltration check), and calls to the Authenticator bridge (`saveToken` Critical). - Parse WebAssembly modules, shipped (by header) or inlined as base64: flag imports that run JS strings, feed data-segment URLs into the endpoint checks, flag disguised/invalid modules and modules compiled from remote URLs.
…pdate arguments
- Flag hooks on native-plugin globals (`system`, `Executor`, `sdcard`…),
security-relevant DOM/built-in methods (`addEventListener`,
`appendChild`, input `value`, `Function.prototype.call`…), Acode's ad
objects, and `pluginsDisabled` edits. `Object.defineProperty(obj,
"name")` now checks `obj.name`.
- Grade HTML sinks: `innerHTML`/`outerHTML`/`insertAdjacentHTML` with
downloaded or decoded HTML, `createContextualFragment`/`srcdoc` (which
run scripts), `on*` attributes, and `setAttribute("src")` on scripts.
- Run shipped `.sh` and `#!` scripts through the command rules, and add
patterns for download-then-chmod, SSH keys and stored credentials, curl
uploads, piping env/files to the network, untrusted package sources,
and cron/boot persistence.
- Classify the `webview` module (remote pages, evaluate/loadHTML).
- Flag forms and password fields in the readme/changelog, which the
plugin page renders through DOMPurify (forms are kept by default).
- `diff` reports new arguments for capabilities the old version already
had (shell commands, native actions, remote script URLs), so an update
that runs a different command needs review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes:
__MACOSX/,.DS_StoreorThumbs.dbpaths was never scanned, although Acode installs those entries.mainwith..or backslashes made Acode's loader run a different file than the one the scanner treated as the entry.eval,Executorand other sinks reached through.call,.apply,.bind,Reflect.applyorReflect.constructwent undetected.plugin.jsonat runtime (a post-review second stage) were not flagged.acode.app/api, which Acode sends with the user's session cookies, and calls to theAuthenticatorbridge were not flagged.pluginsDisabledsetting went undetected.innerHTML,insertAdjacentHTML,createContextualFragment,srcdoc,on*attributes orsetAttribute("src")was not flagged.webviewmodule were not flagged.diffpassed updates that used an existing capability with new arguments (e.g. a different shell command).