Credential references: check driver create/rename against other drivers' instance-named secrets #848

New Issue

2026-11-11T05:24:27-05:00

dohertj2 commented

2026-11-11 05:24:27 -05:00

From the #835 security review (L-3). The per-instance rule refuses a reference whose first segment names ANOTHER same-type driver's id or name. Create/rename is not checked against references already stored on other drivers, so:

naming a driver gw, apikey etc. makes every same-type driver whose shared secret uses that segment fail its next deploy (any Designer can do this, intentionally or not);
renaming the victim temporarily frees its name for Test Connect/browse until the deploy gate runs (only matters for name-scoped secrets).
Fix: at create/rename (RawTreeService.CreateDriverAsync / UpdateDriverAsync), warn or refuse when the new name/id equals a first segment used by another same-type driver's stored reference.

From the #835 security review (L-3). The per-instance rule refuses a reference whose first segment names ANOTHER same-type driver's id or name. Create/rename is not checked against references already stored on other drivers, so: - naming a driver `gw`, `apikey` etc. makes every same-type driver whose shared secret uses that segment fail its next deploy (any Designer can do this, intentionally or not); - renaming the victim temporarily frees its name for Test Connect/browse until the deploy gate runs (only matters for name-scoped secrets). Fix: at create/rename (`RawTreeService.CreateDriverAsync` / `UpdateDriverAsync`), warn or refuse when the new name/id equals a first segment used by another same-type driver's stored reference.

dohertj2 added the cross-driver type:review-finding priority:p3 labels 2026-11-11 05:24:27 -05:00

dohertj2 referenced this issue

2026-11-11 05:24:36 -05:00

Credential references are scoped per driver type, not per instance: a Designer can capture another Galaxy instance's mxaccessgw key #835

dohertj2 referenced this issue from a commit

2026-11-11 07:55:03 -05:00

fix(security): a driver name may not claim another driver's credential segment, nor be renamed off its own (#848)

dohertj2 referenced this issue from a commit

2026-11-11 07:55:03 -05:00

docs(security): env: per-instance convention, name claim/pin, merged preflight (#848 #849 #850)

dohertj2 referenced this issue from a commit

2026-11-11 07:55:03 -05:00

docs(security): id-form matching, ASCII-only name form, one-save pin side-step, rename/device-save race (#848 #849 review)

dohertj2 referenced this issue from a commit

2026-11-11 07:55:04 -05:00

Merge #848 #849 #850 credential name claim/pin, env: per-instance rule, merged preflight

dohertj2 commented

2026-11-11 07:55:32 -05:00

Fixed (d08e59ee, review fixes d68dff09/ea156265). Pushed to master in 03e51457. Driver create, /raw rename and the config-modal update refuse (a) a name equal to the instance segment of a secret:/env: reference stored on another same-type driver ("claim", message names driver/id/device/field, never a value) and (b) renaming a driver off a name its own references use unless they also name its id or the new name ("pin"; case-only renames pass; one modal save may re-point and rename together). Id-shaped names (DRV, DRV-<12 hex>) are refused. Residuals documented in docs/security.md: deleting a driver frees its id/name (rotate its secrets); a rename racing a device save that adds a reference to the old name is not tied together (covered by "may author ⇒ may redirect", audited). Independent security review: no bypass.

Fixed (`d08e59ee`, review fixes `d68dff09`/`ea156265`). Pushed to master in `03e51457`. Driver create, /raw rename and the config-modal update refuse (a) a name equal to the instance segment of a `secret:`/`env:` reference stored on another same-type driver ("claim", message names driver/id/device/field, never a value) and (b) renaming a driver off a name its own references use unless they also name its id or the new name ("pin"; case-only renames pass; one modal save may re-point and rename together). Id-shaped names (`DRV`, `DRV-<12 hex>`) are refused. Residuals documented in docs/security.md: deleting a driver frees its id/name (rotate its secrets); a rename racing a device save that adds a reference to the old name is not tied together (covered by "may author ⇒ may redirect", audited). Independent security review: no bypass.

dohertj2 closed this issue

2026-11-11 07:55:32 -05:00

dohertj2 referenced this issue from a commit

2026-11-11 16:14:33 -05:00

docs(deploy): vd03 upgrade-readiness pack b8b4c18f -> master (#793)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#848