constitution · epochs · watch · epoch 4

ev_dde36b1ff3604ef90f989b4d7723f339e539cbe220da5d5563e9a2e0da817198

links

• commit_id: c_543401e1c5e6e7e82e1d16e0717d3c64992f271935d7f855647f11ce1e29cfd6
• epoch 4

payload

{
  "commit_id": "c_543401e1c5e6e7e82e1d16e0717d3c64992f271935d7f855647f11ce1e29cfd6",
  "committer_timestamp_ms": 1784629783000,
  "contributor": "tommy-mor",
  "first_sources": [
    {
      "ref_name": "refs/heads/cursor/degree-scaling-explore-refine-3347",
      "repository_id": "constitution"
    },
    {
      "ref_name": "refs/heads/cursor/pair-selection-experiments-3347",
      "repository_id": "constitution"
    },
    {
      "ref_name": "refs/heads/cursor/votes-per-edge-and-watch-ui-3347",
      "repository_id": "constitution"
    },
    {
      "ref_name": "refs/heads/main",
      "repository_id": "constitution"
    }
  ],
  "message": {
    "byte_length": 1724,
    "sha256": "2e37ecaf075b9fbe19d3359389e82cb8bf57155b4c06c793a5b57d36429e1c56",
    "text_preview": "Bind signed-snippet slots as eval locals to close an RCE (#5)\n\n* Bind signed-snippet slots as eval locals to close an RCE\n\nThe POST handler ran eval() on a snippet whose $slots were spliced into\nthe source string via repr-scrubbing. Scrubbing is safe per value, but the\nlibrary substitutes every form field in sequential passes over the evolving\nstring, so a value like \"$q\" reintroduces a live slot inside an\nalready-scrubbed literal; scrubbing the referenced field's payload then\nrealigns the string quotes and lands attacker bytes in code position. An\nauthenticated user could reach arbitrary code execution through the redeem\nform.\n\nVerify the signature and one-time nonce, then rewrite each $slot to a bare\nname and bind its value into eval's locals. Request values are handed to\neval as data and are never parsed as code, so the injection class is gone.\nOnly declared slots are bound, so extra fields cannot shadow globals.\n\nCo-authored-by: tommy <thmorriss@gmail.com>\n\n* Adopt upstream evaleval snippet-binding fix; drop local workaround\n\nevaleval e330d82 fixes the nested-$ snippet RCE at the source: verify_snippet\nnow returns a BoundSnippet that binds each $slot's value as an eval local\ninstead of splicing it into the source string. Repin to that commit and call\nsigner.verify_snippet(form).eval(globals()), removing the local _bind_snippet\nshim added while the upstream fix was pending.\n\nRegression tests updated to drive the real verify_snippet/BoundSnippet path:\nthe nested-$ payload is evaluated as an inert string, extra fields can't\nshadow globals, bad signatures and reused nonces are rejected.\n\nCo-authored-by: tommy <thmorriss@gmail.com>\n\n---------\n\nCo-authored-by: Cursor Agent <cursoragent@cursor.com>"
  },
  "oid": "sha1:f7c9247de820c1be1a033e35a18817e0fd70144d",
  "patch": {
    "byte_length": 6190,
    "encoding": "blob",
    "sha256": "f59cfe2894a65142f1f1003d84d18744b3218f027d6513db0e494e2471ed83de"
  },
  "patch_identity": "git-patch-id-stable-v1:e6f623451d650d66b41a42d32585c1f0c6434837",
  "patch_sha256": "f59cfe2894a65142f1f1003d84d18744b3218f027d6513db0e494e2471ed83de",
  "summary": "sha1:f7c9247de820c1b tommy-mor",
  "urls": {
    "commit": "https://token.slug.social/commits/c_543401e1c5e6e7e82e1d16e0717d3c64992f271935d7f855647f11ce1e29cfd6",
    "epoch": "https://token.slug.social/epochs/4"
  }
}