76 lines
2.3 KiB
Bash
Executable File
76 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ©AngelaMos | 2026
|
|
# detector-gate.sh
|
|
|
|
set -uo pipefail
|
|
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
VULNERABLE_IMAGE="ruby:4.0.2-slim"
|
|
|
|
echo "boundary detector gate"
|
|
echo
|
|
|
|
output="$(docker run --rm --network none --read-only --tmpfs /tmp:rw,noexec,nosuid,size=1m \
|
|
--user nobody \
|
|
-v "${HERE}/lib:/app/lib:ro" -w /app "${VULNERABLE_IMAGE}" ruby -Ilib -e '
|
|
require "rube"
|
|
D = Rube::Marshal::BoundaryDetector
|
|
CANARY = "/tmp/rube-canary"
|
|
|
|
hostile = Rube::Chains::ErbDefMethod.canary(CANARY, "fired").serialize
|
|
benign = Marshal.dump({ "user" => "guest", "roles" => [1, 2, 3] })
|
|
sinky = Marshal.dump(Gem::Requirement.new(">= 0"))
|
|
|
|
strict_hostile = D.new.inspect_stream(hostile)
|
|
strict_benign = D.new.inspect_stream(benign)
|
|
strict_sinky = D.new.inspect_stream(sinky)
|
|
allowlisted = D.new(allowed_class_names: %w[Gem::Requirement Gem::Version]).inspect_stream(sinky)
|
|
loose_hostile = D.new(policy: D::POLICY_DENY_SINKS_ONLY).inspect_stream(hostile)
|
|
|
|
puts "strict_rejects_cve=#{strict_hostile.rejected?}"
|
|
puts "strict_accepts_benign=#{strict_benign.accepted?}"
|
|
puts "strict_rejects_sink=#{strict_sinky.rejected?}"
|
|
puts "allowlist_does_not_exempt_sink=#{allowlisted.rejected?}"
|
|
puts "deny_sinks_only_accepts_cve=#{loose_hostile.accepted?}"
|
|
|
|
fired = false
|
|
if loose_hostile.accepted?
|
|
begin
|
|
Marshal.load(loose_hostile.snapshot).def_method(Module.new, "x")
|
|
rescue StandardError
|
|
nil
|
|
end
|
|
fired = File.exist?(CANARY)
|
|
end
|
|
puts "documented_bypass_executes=#{fired}"
|
|
' 2>&1)"
|
|
|
|
echo "${output}" | sed 's/^/ /'
|
|
echo
|
|
|
|
failures=0
|
|
expect() {
|
|
if echo "${output}" | grep -q "^$1=true$"; then
|
|
echo " PASS $2"
|
|
else
|
|
echo " FAIL $2"
|
|
failures=$((failures + 1))
|
|
fi
|
|
}
|
|
|
|
expect strict_rejects_cve "strict policy rejects the CVE-2026-41316 payload"
|
|
expect strict_accepts_benign "strict policy still accepts a benign primitive stream"
|
|
expect strict_rejects_sink "strict policy rejects a sink-bearing stream"
|
|
expect allowlist_does_not_exempt_sink "allowlisting a class does not exempt its sink"
|
|
expect deny_sinks_only_accepts_cve "deny-sinks-only accepts the CVE payload as documented"
|
|
expect documented_bypass_executes "the documented bypass actually executes, so the notice is honest"
|
|
|
|
echo
|
|
if [[ ${failures} -eq 0 ]]; then
|
|
echo "GATE PASSED"
|
|
exit 0
|
|
fi
|
|
|
|
echo "GATE FAILED (${failures})"
|
|
exit 1
|