Skip to content

v2.0.1: Security & Supply Chain Hardening

Choose a tag to compare

View all tags
@w3bwizart w3bwizart released this 07 Oct 15:26
· 56 commits to main since this release
v2.0.1
9e5cad7

Sprawl CLI v2.0.1: Security & Supply Chain Hardening

This release incorporates comprehensive security enhancements, addressing 100% of findings from the internal security and engineering audit.

🛡️ Security Fixes & Hardening

  • Path Containment Escape Patch: Patched a critical boundary escape where sibling directories sharing a prefix (e.g., /mount vs /mount-secrets) could bypass path containment in workspace_fs.py. Both mount root and workspace root guards now enforce strict boundaries using os.sep-appended comparisons.
  • Atomic File Renames: Replaced direct file write operations with atomic temporary file writes and renames to prevent state corruption during sudden process interruptions.
  • Symlink Target Containment Validation: Added pre-flight realpath validation to ensure symlinks generated during sprawl bind cannot escape the designated workspace boundary.
  • Subprocess Execution Timeouts: Enforced strict timeout boundaries across all background Git operations and CLI diagnostics to prevent indefinite terminal hangs on restricted enterprise networks.
  • Automated CI Security Scans: Integrated automated Bandit AST security scanning (bandit -c pyproject.toml) into the GitHub Actions CI pipeline, enforcing zero unresolved High/Medium security alerts on main.

📦 Installation

pipx install git+https://github.com/sprawl-software/sprawl-cli.git@v2.0.1
Assets 2
Loading