完善配置类/非污点类漏洞的标注方式 (fixes #8)#62
Open
colornia wants to merge 1 commit into
Open
Conversation
…encent#8) entry-00241/242/243 (GHSA-w7j5-j98m-w679, OpenClaw E2E/test Dockerfiles running as root) are static-missing config vulnerabilities — no USER instruction appears anywhere in the file, so the risk is established at FROM and never changes afterward. Their trace is trimmed to the entry_point/critical_operation bookends; entry-00244 (a real active-bypass chain) is left untouched as the contrasting example. config_vuln_annotation.md documents the judgment criteria for both subtypes, a benchmark-removal assessment, and a backward-compatible vuln_pattern field proposal. The fix is generated by scripts/data_fixes/gen_config_vuln_fixed.py into an independent entries.config_vuln.fixed.jsonl + diff CSV rather than editing the shared entries.jsonl baseline in place. scripts/data_fixes/verify_config_vuln_fixes.py checks SCHEMA.md compliance, upstream source accuracy, and generator idempotency. Scanned the remaining 404 entries across all 184 advisories for the same annotation failure mode; found none requiring the same fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
entry_point/critical_operation/trace 体系是为污点流/调用链设计的。GHSA-w7j5-j98m-w679 的 4 条 entry（entry-00241~244，OpenClaw 多个 E2E/test Dockerfile 以 root 或不必要特权运行）是配置类漏洞，套用污点流语义会导致 trace 中间节点填入实际未改变任何状态的构建步骤。
两种子模式
核实源码（commit c56fb7f353d63d6ea97028ee7d8a97bc4edf21c1）后发现这4条并非同一种情况：
NOPASSWD:ALL的 sudoers 授权架空，是有意义的因果链。判断标准不是"配置类漏洞一律精简 trace"，而是"中间节点是否真的改变了状态"。
改动方式
脚本产出独立文件：
scripts/data_fixes/gen_config_vuln_fixed.py：幂等生成器，只读entries.jsonl，输出data/entries.config_vuln.fixed.jsonl（完整408行，仅241/242/243的trace被替换）和data/config_vuln_diff.csv（4条目标entry × entry_point/critical_operation/trace/verify 4个字段的前后对比）。scripts/data_fixes/verify_config_vuln_fixes.py：只读复核脚本，6项检查——baseline未被污染、SCHEMA.md全部不变量、{file,line,code}对照openclaw上游源码核实、diff CSV一致性、生成器幂等、desc确实在解释原因而非复述代码。config_vuln_annotation.md记录判断依据、benchmark 移除评估（结论：不移除）、全量数据集扫描结果（未发现其他同类问题），并提出向后兼容的vuln_pattern可选字段草案（未写入数据）。Closes #8