dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): bundle import runs the script trust gate — forbidden-API scripts rejected at import review, not at runtime

Browse Source 
#05-T20. Bundle import is now the fifth ScriptTrustValidator delegating call
site. RunSemanticValidationAsync gains a Pass 0 that runs ScriptTrustValidator
.FindViolations over every non-Skip template / shared / ApiMethod script body
before name resolution; any violation is a HARD error for all kinds (a trust
verdict is authoritative, not the false-positive-prone name heuristic) and
short-circuits so it is never masked by a Pass-1 name error. DetectBlockersAsync
runs the same gate for preview parity, emitting entity-qualified Blocker rows.
Transport gains a direct ScriptAnalysis project reference. Docs: Component-
ScriptAnalysis (fifth call site) + Component-Transport updated.

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj
This commit is contained in:
Joseph Doherty
2026-07-10 02:18:12 -04:00
parent c60347c5e7
commit 523e670579
7 changed files with 197 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
archreview/plans/PLAN-05-templates-deployment-transport.md.tasks.json
+1 -1
View File
@@ -19,7 +19,7 @@
{ "id": 16, "subject": "Task 16: Skip script compilation on read-only staleness/comparison paths", "status": "completed", "blockedBy": [] },
{ "id": 17, "subject": "Task 17: Isolate the post-success deployment audit write", "status": "completed", "blockedBy": [16] },
{ "id": 18, "subject": "Task 18: Delete NotDeployed instances without a site round-trip", "status": "completed", "blockedBy": [17] },
{ "id": 19, "subject": "Task 19: Import blocker heuristic — local-declaration exclusion, denylist additions, warning severity", "status": "pending", "blockedBy": [6] },
{ "id": 19, "subject": "Task 19: Import blocker heuristic — local-declaration exclusion, denylist additions, warning severity", "status": "completed", "blockedBy": [6] },
{ "id": 20, "subject": "Task 20: Run the script trust gate on bundle import", "status": "pending", "blockedBy": [19] },
{ "id": 21, "subject": "Task 21: Harden the ScriptTrustPolicy deny-list", "status": "completed", "blockedBy": [] },
{ "id": 22, "subject": "Task 22: Bound LineDiffer input size", "status": "completed", "blockedBy": [] },