Security issue audit, 2026-07-23

This audit covers every issue that was open in the issue tracker at the start of the review (#3 through #19). Each security claim was checked against the code and, where practical, reproduced with an executable regression test before the fix was written.

Executive result

#3, #4, and #5 were directly reproducible critical vulnerabilities. They respectively allowed a paired controller to become a persistent console administrator, allowed command-policy suffix injection, and allowed command injection through cwd.
#8 had a fleet-wide critical blast radius after compromise of the relay or release path, but was not a direct unauthenticated compromise by itself.
#6, #7, and #9 through #18 contained real security defects, with the qualifications recorded below.
#19 was not a defect in the current authorization flow. It is a valid product enhancement for device-bound refresh sessions and step-up auth.

Findings

Issue	Verdict	Severity	Reproduction or qualification	Disposition
#3	Confirmed	Critical	A normally paired controller sent `console_hello`, then persisted `bypass`.	Console sessions now require both a relay-issued console capability and membership in the device's portal-admin trust set.
#4	Confirmed	Critical	A rule for `git status` matched `git status && <payload>`.	Command prefixes are parsed as shell AST; compound syntax, redirection, and substitution require an exact rule.
#5	Confirmed	Critical	A hostile `cwd` broke out of the quoted `cd` string while the approved command remained benign.	One-shot jobs use `exec.Cmd.Dir`; persistent shells receive cwd through a private data file instead of shell interpolation.
#6	Confirmed	High	A symlink below an allowed root reached a file outside that root.	File access uses root-scoped opens, rejects link traversal and non-regular files, and carries the matched policy root to the server.
#7	Confirmed	High	Two SSO identities that normalized to one namespace caused the latter identity to replace the former. Header forgery additionally depends on an incorrectly exposed portal backend.	Namespace conflicts fail instead of changing the bound immutable identity. Deployment requirements for the SSO header are explicit.
#8	Confirmed, conditional	High	The updater and installers executed bytes supplied by the relay without an independent trust root. Compromise of the distribution path therefore became fleet code execution.	An offline Ed25519 manifest binds version, platform, name, size, and SHA-256. Updater and relay fail closed without compiled trust keys; relay-hosted installers are retired in favor of independently obtained, key-embedded release installers.
#9	Confirmed	High	Long-lived admission tokens appeared in WebSocket and HTTP query strings. The plaintext LAN transport remains safe only inside the documented encrypted overlay.	New clients use `Authorization: Bearer`; the relay temporarily accepts legacy query clients with deprecation headers for rollout.
#10	Confirmed	High	MCP rebind was recoverable Base64 containing the raw token and a caller-supplied namespace.	Rebind is an AEAD-sealed, audience-bound, expiring claim; restore resolves the token namespace at the relay. Logout revocation is currently process-local.
#11	Confirmed	High	An ACL row's `perms` value was displayed but ignored by the tunnel, so a read or exec grant opened the full protocol.	The relay issues authenticated session capabilities and the device enforces them for exec, read, write, logs, and console.
#12	Confirmed, scoped	High	Relay bodies and background jobs had practical unbounded memory/concurrency paths and HTTP servers lacked complete timeouts. The wire frame already had a 16 MiB cap and MCP sessions already expired.	Relay bodies, HTTP timeouts, job concurrency, runtime, output, count, bytes, and retention are bounded. Aggregate session queues and synchronous exec lifetime remain separate hardening work.
#13	Confirmed	Medium	Event logs retained raw command/path secrets indefinitely and log reads had no separate capability.	Common credentials are redacted, logs rotate within a quota, and log reads require a distinct capability. Free-form positional secrets can still evade heuristic redaction.
#14	Confirmed, conditional	Medium	Cross-site mutation defenses, framing policy, CSP, body limits, URL sanitization, and production-safe `/whoami` behavior were absent. Exploitability of CSRF depended on the surrounding SSO cookie/proxy policy.	Mutations require same-origin double-submit CSRF, responses carry browser security headers, Markdown allows only HTTP(S) or safe relative URLs, and `/whoami` is disabled by default.
#15	Confirmed	Medium	Upload opened the destination with `O_TRUNC` before the stream completed and accepted unbounded/mismatched sizes.	Uploads are size-bounded, exact-length checked, written to a same-directory temporary regular file, synced, and atomically renamed.
#16	Confirmed	Medium	Pins were indexed only by device name, so same-named devices in different namespaces collided. First contact was also silently trusted.	Pins use canonical `owner/device`; first contact and certificate changes require explicit out-of-band confirmation or authenticated portal pre-pinning.
#17	Confirmed, architectural	Medium	A production portal fingerprint compiled into every binary acted as a non-rotatable fleet root.	Self-hosted binaries have no company portal root; devices support versioned multi-root overlap, explicit rotation, revocation, and legacy migration. Existing sessions are not forcibly disconnected after revocation.
#18	Confirmed, partial	Medium	Alpine's release table lists 3.20 support ending on 2026-04-01; image tags were mutable, containers ran as root, and installer URLs trusted request Host/proto. Internal deployment documentation was operational metadata, not itself a code vulnerability.	Images and CI tooling are digest-pinned, runtime is non-root, request-derived installers are retired, and CI adds vulnerability, SBOM, and image scanning.
#19	Not a bug	Enhancement	The CLI already stores a long-lived admission token, and HTTP MCP already had a rebind path. The issue asks for a safer, more complete refresh-token and step-up-auth product model rather than describing a current repeated-code defect.	Keep as a roadmap enhancement; do not close it as a security fix.

Residual boundaries

The fixes do not make a plaintext LAN relay confidential; deployments must use an encrypted overlay or wss://. Token rotation, process-independent MCP rebind revocation, forced termination of already-established portal sessions, and the larger device-bound refresh-session design from #19 remain explicit follow-up work rather than hidden claims of completion.

The repository fails closed when a release trust key or signed directory is missing. A production signing seed is configured as an environment-scoped (release) GitHub Actions secret, restricted to the protected tags matching v*. The protected v0.1.0 tag exercised the complete signing path in the CI run for that tag. Its release job published the exact signed artifacts to the public v0.1.0 GitHub Release, and an anonymous, separately downloaded copy was verified against release-public.pem.

The PowerShell installer was exercised end to end on Windows PowerShell 5.1 against a temporary signed release served from WSL. It upgraded a historical binary without a version command, installed v9.8.7 with the manifest-bound SHA-256, rejected a truncated artifact, and rejected a same-version reinstall.

The post-merge CI run on the project-locked, protected self-hosted WSL runner passed Go tests, vet, and the Windows cross-build. The supply-chain job built the digest-pinned image, passed relay, portal, and MCP container smoke tests as UID 10001, found no reachable Go vulnerabilities, produced a 77,046-byte CycloneDX SBOM with 116 components, and found no HIGH or CRITICAL vulnerabilities in either the Alpine packages or Go binary. The post-merge Linux process-tree timeout regression and scanner temporary-storage regression discovered while commissioning this runner were fixed in two follow-up pull requests.

安全问题审计，2026-07-23

这次审计覆盖评审开始时 issue 跟踪器里所有处于打开状态的问题（#3 到 #19）。每一条安全声明都对着代码核过，可行的地方还在写修复之前用一个可执行的回归测试复现过。

结论摘要

#3、#4、#5 是可直接复现的严重漏洞。它们分别允许一个已配对的控制端变成常驻的控制台管理员、允许命令策略的后缀注入、允许经由 cwd 的命令注入。
#8 在 relay 或发布路径被攻破之后有覆盖整个机群的严重影响面，但它本身不构成一次直接的、无需认证的攻破。
#6、#7 以及 #9 到 #18 都含有真实的安全缺陷，附带下面记下的限定条件。
#19 不是当前授权流程里的缺陷。它是一项关于设备绑定的刷新会话和二次认证的、有效的产品增强。

结论明细

问题	裁决	严重度	复现或限定条件	处置
#3	确认	严重	一个正常配对的控制端发出 `console_hello`，随后把 `bypass` 持久化了下来。	控制台会话现在同时要求一个 relay 签发的控制台能力，以及在该设备的门户管理员信任集合里有一席之地。
#4	确认	严重	一条针对 `git status` 的规则匹配上了 `git status && <payload>`。	命令前缀按 shell AST 解析；复合语法、重定向和替换都要求一条精确规则。
#5	确认	严重	一个敌意的 `cwd` 从被引号包住的 `cd` 字符串里逃了出来，而被批准的那条命令看上去人畜无害。	一次性任务用 `exec.Cmd.Dir`；持久 shell 通过一个私有数据文件拿到 cwd，而不是靠 shell 插值。
#6	确认	高	一个位于允许根之下的软链接够到了那个根之外的文件。	文件访问用根作用域的打开操作，拒绝链接穿越和非普通文件，并把匹配上的策略根一路带到服务端。
#7	确认	高	两个归一化后落到同一个命名空间的 SSO 身份，让后来那个身份顶替了先前那个。伪造 header 还额外依赖门户后端被错误地暴露出来。	命名空间冲突时直接失败，而不是改掉已绑定的不可变身份。SSO header 的部署要求写明了。
#8	确认，有条件	高	更新器和安装器执行了由 relay 提供的字节，却没有一个独立的信任根。于是分发路径被攻破就等于整个机群的代码执行。	一份离线的 Ed25519 清单绑定版本、平台、名称、大小和 SHA-256。没有编译进去的信任密钥，更新器和 relay 都失败即关闭；relay 托管的安装器退役，改用独立获取、内嵌公钥的发布安装器。
#9	确认	高	长期有效的准入令牌出现在 WebSocket 和 HTTP 的查询串里。明文的局域网传输只有在文档写明的加密覆盖网里才仍然安全。	新客户端用 `Authorization: Bearer`；relay 在过渡期内仍接受老的查询串客户端，并回带弃用 header。
#10	确认	高	MCP 的重新绑定是一段可还原的 Base64，里面装着原始令牌和一个由调用方给出的命名空间。	重新绑定改成一个 AEAD 密封、受众绑定、会过期的凭据；恢复时在 relay 侧解析令牌的命名空间。登出吊销目前只在进程内生效。
#11	确认	高	一条 ACL 记录的 `perms` 值被显示出来，隧道却无视它，于是一个 read 或 exec 授予打开了完整协议。	relay 签发经过认证的会话能力，设备在 exec、read、write、logs 和 console 上逐一执行它们。
#12	确认，有范围	高	relay 的请求体和后台任务在实践中存在无界的内存/并发路径，HTTP 服务端也缺少完整的超时。线上帧本来就有 16 MiB 上限，MCP 会话本来也会过期。	relay 的请求体、HTTP 超时、任务并发、运行时长、输出、数量、字节数和保留期都设了界。会话队列的总量和同步 exec 的生命周期仍是另外的加固工作。
#13	确认	中	事件日志无限期保留命令/路径里的原始秘密，日志读取也没有单独的能力位。	常见凭据会被脱敏，日志在一个配额内轮转，日志读取需要一个独立的能力。自由形式的位置参数里的秘密，仍然可能躲过启发式脱敏。
#14	确认，有条件	中	跨站变更防御、框架嵌入策略、CSP、请求体上限、URL 净化，以及生产环境下安全的 `/whoami` 行为，全都缺失。CSRF 能否被利用取决于外围的 SSO cookie/代理策略。	变更操作要求同源的双提交 CSRF，响应带上浏览器安全 header，Markdown 只允许 HTTP(S) 或安全的相对 URL，`/whoami` 默认关闭。
#15	确认	中	上传在数据流传完之前就用 `O_TRUNC` 打开了目标文件，并且接受无界或对不上的大小。	上传有大小上限、精确长度校验，写到同目录下的一个临时普通文件里，sync，然后原子改名。
#16	确认	中	钉扎只按设备名索引，于是不同命名空间里的同名设备撞在了一起。首次接触也是被静默信任的。	钉扎改用规范的 `owner/device`；首次接触和证书变更都要求显式的带外确认，或者门户上经过认证的预钉扎。
#17	确认，属架构	中	一个编译进每个二进制的生产门户指纹，实际上成了一个不可轮换的机群根。	自部署的二进制里没有公司门户根；设备支持带版本的多根重叠、显式轮换、吊销和历史迁移。吊销之后已有的会话不会被强制断开。
#18	确认，部分	中	Alpine 的版本支持表显示 3.20 的支持在 2026-04-01 结束；镜像 tag 是可变的，容器以 root 运行，安装器 URL 信任请求里的 Host/proto。内部部署文档属于运维元数据，本身不是一个代码漏洞。	镜像和 CI 工具链都按 digest 钉死，运行时非 root，由请求推导的安装器退役，CI 加上了漏洞、SBOM 和镜像扫描。
#19	不是缺陷	增强	CLI 本来就存着一个长期有效的准入令牌，HTTP MCP 也本来就有一条重新绑定的路径。这个问题要的是一套更安全、更完整的刷新令牌加二次认证的产品模型，而不是在描述一个当下重复出现的代码缺陷。	作为路线图上的增强保留；不要把它当成一个安全修复关掉。

剩余边界

这些修复并不能让一个明文的局域网 relay 变得保密；部署必须用加密覆盖网或者 wss://。令牌轮换、与进程无关的 MCP 重新绑定吊销、强制终止已经建立的门户会话，以及 #19 里那套更大的设备绑定刷新会话设计，都是明确的后续工作，而不是被藏起来的「已完成」声明。

缺少发布信任密钥或签名目录时，这个仓库是失败即关闭的。生产签名种子配置成了一个 environment 作用域（release）的 GitHub Actions secret，限制在匹配 v* 的受保护 tag 上。受保护的 v0.1.0 tag 在它那次 CI 运行里跑通了完整的签名路径。它的发布 job 把那些精确的签名产物发布到了公开的 v0.1.0 GitHub Release，并且用一份匿名、单独下载的副本对着 release-public.pem 验证过。

PowerShell 安装器在 Windows PowerShell 5.1 上，对着一个从 WSL 提供的临时签名发布，端到端跑过一遍。它升级了一个没有 version 命令的历史二进制，装上了带清单绑定 SHA-256 的 v9.8.7，拒绝了一个被截断的产物，也拒绝了一次同版本重装。

在那台锁定到本项目、受保护的自建 WSL runner 上，合并后的 CI 跑通了 Go 测试、vet 和 Windows 交叉构建。供应链那个 job 构建了 digest 钉死的镜像，以 UID 10001 通过了 relay、门户和 MCP 的容器冒烟测试，没有发现可达的 Go 漏洞，产出了一份 77,046 字节、含 116 个组件的 CycloneDX SBOM，并且在 Alpine 软件包和 Go 二进制里都没有发现 HIGH 或 CRITICAL 漏洞。在给这台 runner 做上线调试时发现的两个问题——合并后的 Linux 进程树超时回归，以及扫描器临时存储回归——已经在两个后续 pull request 里修掉。