Repository navigation
Preserve untrusted provenance of security advisory content - #15773
Conversation
Classify advisory prose at none integrity without changing secrecy restrictions. Use coarse resource labels for whole advisory responses so metadata fallbacks cannot promote content and allowed payloads retain their original shape. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5737168d-e4b3-4af9-9af8-4ddbf119542a
🔒 mcpg Read-Only Stress — defaultSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Overall: INCONCLUSIVE No write leaked on any surface. Part A and C reads fully passed. Part B is INCONCLUSIVE because all targeted write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) are entirely absent from the gh-aw tools.github: MCP catalog (backend launched with GITHUB_READ_ONLY=1), so the refusal only proves backend/toolset configuration, not mcpg's own DIFC/guard write-blocking layer. Parts D and E are INCONCLUSIVE because gh is not authenticated in this job ("You are not logged into any GitHub hosts"), so the REST/GraphQL token-scope boundary could not be exercised this run. mcpg's independent write-blocking guarantees remain covered by internal/guard and internal/difc unit tests; a dedicated MCP-tool-level probe that launches the backend outside the tools.github: wrapper is tracked as follow-up work.
|
There was a problem hiding this comment.
🟡 Changes recommended
Regression coverage is unreliable because GitHub environment settings can alter expected outcomes, CI skips the compiled-guard matrix, and response-shape tests bypass path and per-item labeling.
3 open issues
What changed in this PR
This PR updates the GitHub guard to treat security advisory content as untrusted, preventing read access, publication, or submission acceptance from implying trusted authorship.
Changes:
- Assigns
noneintegrity to repository, organization, and global advisories while preserving secrecy restrictions. - Uses whole-resource labels for advisory responses, preserving the original payload shape when access is allowed.
- Adds synthetic Rust and compiled-guard regression coverage and documents the provenance policy.
| File | Description |
|---|---|
internal/server/advisory_integrity_wasm_integration_test.go |
Adds strict/filter tests for advisory enforcement and payload preservation. |
guards/github-guard/rust-guard/src/lib.rs |
Bypasses advisory singleton promotion and tests varied response shapes. |
guards/github-guard/rust-guard/src/labels/tool_rules.rs |
Assigns advisory resources none integrity without changing secrecy rules. |
guards/github-guard/rust-guard/src/labels/mod.rs |
Updates advisory integrity expectations in label tests. |
guards/github-guard/rust-guard/src/labels/constants.rs |
Adds shared organization and global advisory tool-name constants. |
docs/GUARD_RESPONSE_LABELING.md |
Documents conservative advisory provenance and access implications. |
Review effort: Max (auto)
| let mut items = Vec::new(); | ||
| let action = apply_singleton_fallback_if_needed(&input, &ctx, &mut items); |
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| func TestCallBackendTool_CompiledGuardAdvisoryIntegrity(t *testing.T) { |
| ) | ||
|
|
||
| func TestCallBackendTool_CompiledGuardAdvisoryIntegrity(t *testing.T) { | ||
| wasmPath := findCompiledGitHubGuard(t) |
|
@copilot address review feedback |
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Addressed in |
Summary
noneintegrity to repository, organization, and global security advisory prose. Read access, publication, and submission acceptance are not evidence of trusted authorship.Validation
wasm32-wasip1guard and exercised 144 compiled-guard/server cases across strict and filter modes, including authorized private-repository scope with approved integrity, confidentiality checks, and exact allowed-response shape preservation.make agent-finishedpassed, including build, lint, Go tests, and all 688 Rust guard tests.All advisory fixtures are inert, synthetic data.