Summary
Remote malformed frames or send errors can make process_stream return an error after setup state has been created, but the teardown hook runs only on the clean path.
Tracking
Canonical finding id: csf_657baefa2f906b26d622cd05
Primary fingerprint: codex-security/v1:sha256:53b30ab9442a1d50acd2d05fc88fa0fac795d0591e0e140da7ab1b456794b1ee
Scan id: 3969c3b0af5f_20260624T110328Z
Candidate ids: WF-LIFECYCLE-TEARDOWN-ERR, wireframe-app-lifecycle-teardown-error-001
Severity
Severity: medium
Confidence: high
CWE: CWE-772, CWE-459
Rationale: The cleanup bypass is remote-triggerable and can leak security-relevant per-connection state in hook-using applications, but impact is application-dependent; severity is medium.
Source
Repository: https://github.com/leynos/wireframe
Scanned target: git_worktree snapshot at revision 3969c3b
Source status: unverified for commit-pinned links because the sealed target kind is git_worktree; locations are listed as canonical plain paths.
- Location (root_control): src/app/inbound_handler.rs:106-123
- Location (cleanup_hook): src/app/inbound_handler.rs:126-127
- Location (hook_contract): src/app/lifecycle.rs:18-33
Root cause
The invariant should be that teardown runs exactly once for any connection after setup succeeds. The implementation returns early on stream errors.
Recommended fix
Run teardown from a guard or finally-style path whenever setup completed, regardless of whether stream processing ended cleanly or with error.
Regression tests
- Add tests for decode-error and send-error paths asserting teardown callback invocation after setup.
Public issue note
This issue intentionally omits code snippets and detailed attack-path notes from the sealed scan report.
Summary
Remote malformed frames or send errors can make
process_streamreturn an error after setup state has been created, but the teardown hook runs only on the clean path.Tracking
Canonical finding id: csf_657baefa2f906b26d622cd05
Primary fingerprint: codex-security/v1:sha256:53b30ab9442a1d50acd2d05fc88fa0fac795d0591e0e140da7ab1b456794b1ee
Scan id: 3969c3b0af5f_20260624T110328Z
Candidate ids: WF-LIFECYCLE-TEARDOWN-ERR, wireframe-app-lifecycle-teardown-error-001
Severity
Severity: medium
Confidence: high
CWE: CWE-772, CWE-459
Rationale: The cleanup bypass is remote-triggerable and can leak security-relevant per-connection state in hook-using applications, but impact is application-dependent; severity is medium.
Source
Repository: https://github.com/leynos/wireframe
Scanned target: git_worktree snapshot at revision 3969c3b
Source status: unverified for commit-pinned links because the sealed target kind is
git_worktree; locations are listed as canonical plain paths.Root cause
The invariant should be that teardown runs exactly once for any connection after setup succeeds. The implementation returns early on stream errors.
Recommended fix
Run teardown from a guard or
finally-style path whenever setup completed, regardless of whether stream processing ended cleanly or with error.Regression tests
Public issue note
This issue intentionally omits code snippets and detailed attack-path notes from the sealed scan report.