Repository navigation
fix: v1.148.0 — ISO 26262 Table 4 ASIL bug + unauth arbitrary-file-read + 13 other audit findings - #104
Merged
Conversation
…ad + 13 other audit findings An external audit's findings were each independently reconfirmed against live source before patching. Highlights: - hara.DetermineASIL mis-implemented ISO 26262-3:2018 Table 4 (S2/S3 cells inflated 1-2 ASIL levels, S1 correct); hara_test.go locked in the wrong values. Replaced with the canonical additive S+E+C table and rewrote tests from a 36-cell truth table. Regenerated .fusa-hara.json (max hazard ASIL is now B, not C) and .fusa.json (ASIL-B, canonical configVersion/standard/asil shape). - serve ran unauthenticated by default with /api/v1/diff?baseline=<path> taking an unvalidated filesystem path — sandboxed to project root. - Basic Auth credential compare was not constant-time. - qualify.hash included the live generatedAt timestamp and unsorted components, so it was never reproducible run-to-run. - sas never wrote its sas.md companion, only JSON. - Plus: vv self-attestation discounting, atomic history writes, webhook timeout, decision-coverage mislabeling, diff fingerprint language qualification, scheduler stop-channel leak, SOURCE_DATE_EPOCH support, configurable skip-dirs, EndLine/EndColumn, two invented standard clause citations, doc/spec-version drift, non-gating CI steps. Deliberately not patched (violates std-lib-only, or needs live registry lookups not derivable offline): Unicode NFC normalization; image/Action digest pinning. Signed-off-by: SoundMatt <SoundMatt@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // before running detection. | ||
| // | ||
| //fusa:req REQ-FO-ADP004 | ||
| var DefaultSkipDirs = map[string]bool{ |
| // before running detection. | ||
| // | ||
| //fusa:req REQ-FO-ADP004 | ||
| var DefaultSkipDirs = map[string]bool{ |
| // storeMu serialises the non-atomic read-modify-write of the history file so | ||
| // concurrent compute paths (startup, scheduler, /refresh) cannot race and lose | ||
| // or corrupt snapshots. | ||
| var storeMu sync.Mutex |
Follow-up to the prior commit's webhook timeout fix — the linter correctly flagged the new http.NewRequest call for not carrying a context. The http.Client.Timeout already bounds every attempt, so context.Background() is sufficient here. Signed-off-by: SoundMatt <SoundMatt@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
An external third-party audit of the whole x-FuSa ecosystem was checked
finding-by-finding against this repo's live source before applying any
patch — every claim below was independently reconfirmed by hand-computing
the ISO 26262-3:2018 Table 4 truth table and by reading the actual
vulnerable code paths, not taken on the audit's word.
hara.DetermineASILmis-implemented ISO 26262-3:2018 Table 4— every S2/S3 cell (S1 already correct) was inflated by 1-2 ASIL levels
versus the standard's additive S+E+C derivation (e.g.
S3/E1/C2returnedASIL-Binstead ofQM).hara_test.gohard-coded the wrong values,locking the bug in. Fixed the table, rewrote the test from the canonical
36-cell truth table, and regenerated
.fusa-hara.json(max hazard ASILis now B, not C) and
.fusa.json(ASIL-B, canonicalconfigVersion/top-levelstandard+asilshape).serveruns unauthenticated by default, and/api/v1/diff?baseline=<path>took an unvalidated filesystem path —arbitrary file read. Sandboxed to the project root.
constant-time.
qualify.hashincluded the livegeneratedAttimestamp and unsorted components — never reproduciblerun-to-run. Now blanks the timestamp and sorts before hashing.
sasnever wrote itssas.mdcompanion.vvself-attestation discounting, atomic historywrites, webhook timeout, decision-coverage mislabeling, diff fingerprint
language-qualification, scheduler stop-channel leak,
SOURCE_DATE_EPOCHsupport, configurable skip-dirs,EndLine/EndColumn, two invented standard-clause citations, doc/spec-versiondrift, non-gating CI steps.
golang.org/x/text, violating this repo's std-lib-only rule); image/Action digest pinning (needs live registry lookups not derivable
offline).
Test plan
go build ./...go vet ./...go test ./...— all packages passgofmt -l .— clean