T19 — Built-in sensitive path protection

{`
SENSITIVE_PATTERNS = [
    "*/.ssh/*",
    "*/.aws/credentials",
    "*/.aws/config",
    "*/.azure/*",
    "*/.kube/config",
    "*/.gnupg/*",
    "*/.config/gcloud/*",
    "**/.env",
    "**/secrets.yaml",
    "**/secret.yaml",
    "**/*.pem",
    "**/*.key",
]

def is_sensitive_path(path: str | Path) -> bool:
    """
    Returns True if path matches any sensitive pattern.
    ALWAYS called first — before mode, before rules.
    """
    # CVE-2026-40502 fix: resolve to absolute path first
    resolved = Path(path).resolve()
    resolved_str = str(resolved)

    for pattern in SENSITIVE_PATTERNS:
        if resolved.match(pattern):
            return True
        # Also check string-level match for patterns with **
        if fnmatch.fnmatch(resolved_str, f"*/{pattern}"):
            return True
    return False
`}

{`
# CVE-2026-40515: root path bypass
# Before fix:
def old_check(path: str) -> bool:
    return any(fnmatch.fnmatch(path, p) for p in SENSITIVE_PATTERNS)

# Attack: old_check("/") → False (no pattern matches "/")
# But glob("/") returns everything including ~/.ssh/id_rsa

# After fix: check the FILES being accessed, not the search root
def new_check_glob_result(found_paths: list[str]) -> list[str]:
    return [p for p in found_paths if not is_sensitive_path(p)]
`}

{`
# CVE-2026-40502: file_path not normalized before check
# Attack payload: "/../../../.ssh/id_rsa"

# Before fix:
def old_is_sensitive(path: str) -> bool:
    return any(fnmatch.fnmatch(path, p) for p in SENSITIVE_PATTERNS)
# old_is_sensitive("/../../../.ssh/id_rsa") → False
# fnmatch sees literal "/../../../.ssh/id_rsa", not "/home/user/.ssh/id_rsa"

# After fix (current code):
def is_sensitive_path(path: str | Path) -> bool:
    resolved = Path(path).resolve()   # ← resolve FIRST
    resolved_str = str(resolved)      # → "/home/user/.ssh/id_rsa"
    for pattern in SENSITIVE_PATTERNS:
        if resolved.match(pattern):   # matches "*/.ssh/*" ✓
            return True
    return False
# is_sensitive_path("/../../../.ssh/id_rsa") → True ✓
`}

{`
# ~/.config/op/credentials — 1Password CLI credential
# Không nằm trong SENSITIVE_PATTERNS → không bị block

# Mitigations:
# 1. Thêm pattern mới vào SENSITIVE_PATTERNS khi phát hiện
# 2. Thêm wildcard rộng hơn: "*/.config/*/*credentials*"
# 3. Implement pluggable pattern list để operator có thể extend
#    mà không cần fork OpenHarness

# SENSITIVE_PATTERNS hiện tại bao phủ: AWS, GCP, Azure, kube,
# SSH, GPG, .env, PEM/KEY — nhưng không phải mọi credential manager
`}

{`
# Attack: tạo symlink trỏ đến sensitive file
# ln -s ~/.ssh/id_rsa /tmp/key.txt

# Thử bypass: is_sensitive_path("/tmp/key.txt")
# Path("/tmp/key.txt").resolve() → "/home/user/.ssh/id_rsa"
# (resolve() theo symlink đến đích thật)
# Kết quả: match "*/.ssh/*" → BLOCK ✓

# resolve() tự động follow symlinks — đây là behavior mong muốn.
# Symlink attack bị chặn vì check được áp dụng lên ĐÍCH thật,
# không phải tên symlink.
`}

{`
# Attack: thay vì đọc trực tiếp, agent tạo archive
# bash_tool: "tar cf /tmp/keys.tar ~/.ssh/"

# T19 check: path argument của bash_tool là "/tmp/keys.tar" (output)
# hoặc check command string "tar cf /tmp/keys.tar ~/.ssh/"
# T20 layer 5 check command deny patterns — nhưng nếu pattern
# không cover "tar ... ~/.ssh/", command có thể pass

# Mitigations:
# - Thêm command deny pattern: r"tar\s+.*\.ssh" vào layer 5 (T20)
# - Block bash_tool hoàn toàn trong PLAN mode (T18)
# - Audit bash command args cho known archive tools
`}

{`
import fnmatch
from pathlib import Path

SENSITIVE = [
    "*/.ssh/*", "*/.aws/credentials", "*/.aws/config",
    "*/.kube/config", "*/.gnupg/*", "**/.env", "**/*.pem", "**/*.key",
]

def is_sensitive(path_str: str) -> bool:
    # CVE-2026-40502 fix: resolve() TRƯỚC khi check
    resolved = Path(path_str).resolve()
    s = str(resolved)
    return any(
        resolved.match(pat) or fnmatch.fnmatch(s, "*/" + pat)
        for pat in SENSITIVE
    )

def safe_read(path_str: str) -> str:
    if is_sensitive(path_str):
        raise PermissionError(f"Blocked: sensitive path {path_str}")
    return Path(path_str).read_text()

# CVE-2026-40515 fix: filter kết quả glob, không chỉ filter tham số
def safe_glob(root: str, pattern: str) -> list[str]:
    all_results = list(Path(root).glob(pattern))
    return [str(p) for p in all_results if not is_sensitive(str(p))]

# Usage:
# safe_read("/../../../.ssh/id_rsa")  → PermissionError ✓
# safe_glob("/", "**/*")              → trả về list đã lọc sensitive files ✓
`}