[PR] fix(security): confine MCP credential paths; publish only announced records [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1795:
URL: https://github.com/apache/magpie/pull/1795

   ## Summary
   
   Two tools that run outside the agent's sandbox trusted inputs the agent controls:
   
   - **`gmail-plaintext` MCP server — `credentials_path` was unconfined.** It is a tool argument, so whoever drives the agent chose it: `setup_credentials` could write the Gmail refresh token wherever a sandboxed command can read it (defeating the `~/.config/apache-magpie*` read deny), and `create_draft` / `check_auth` could load a planted credentials file. A caller-supplied path must now be a `.json` file directly in `~/.config/apache-magpie/` or in the directory of `$GMAIL_OAUTH_CREDENTIALS` (the server's own configuration, not a tool call), with no symlink on the file or its directory. Omitting it keeps the default lookup.
   - **`vulnogram-api-record-publish` — the publish gate was not checked.** `--allow-state` accepted any value, so a `DRAFT` could be pushed to `PUBLIC`, and nothing confirmed the advisory had shipped, which is the gate the move stands for. `--allow-state` is now limited to `REVIEW` / `READY`, and the move refuses (new exit code 4, also in dry-run) a record whose `references[]` has no entry tagged `vendor-advisory` — the tag `generate-cve-json` gives the archived advisory URL. The `issue-sync` publish step documents both.
   
   ## Type of change
   
   - [x] Python package (`tools/gmail/oauth-draft`, `tools/cve-tool-vulnogram/oauth-api`, and their `magpie-security-tools` copies)
   - [x] Skill change (`issue-sync/apply-and-push.md`: publish preconditions, exit code 4)
   
   ## Test plan
   
   - [x] `prek run` on the changed files passes
   - [x] `pytest` for `tools/gmail/oauth-draft` (with the `mcp` extra) and `tools/cve-tool-vulnogram/oauth-api`: all pass
   - [x] New tests: `setup_credentials` refuses a path outside the credential directories (relative, wrong suffix, elsewhere) before running the consent flow or writing anything; a symlinked credentials path is refused; a path in the configured directory is accepted; a record with no `vendor-advisory` reference (or only a `patch` one) is not published and nothing is POSTed; `--allow-state DRAFT|PUBLIC|REJECTED` is rejected
   - [x] `roborev` review clean
   
   ## RFC-AI-0004 compliance
   
   - [x] **Sandbox** — closes a credential-exfiltration path through an unsandboxed MCP server
   - [x] **HITL** — CVE publication now requires the shipped-advisory evidence the gate is defined by
   
   ---
   
   Gen-AI disclosure: drafted with Claude Code (Opus 5); reviewed by the submitter.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(security): confine MCP credential paths; publish only announced records [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1795:
URL: https://github.com/apache/magpie/pull/1795


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org