Beagle SCM

DOG-009: HOME adopts untrusted .be anchors — store-root redirect, TOML injection

dog/HOME.c's cwd-walk discovery is the git CVE-2022-24765 class: it probes every ancestor for .be and adopts the first hit with ZERO trust validation. For a secondary-worktree anchor (a .be regular file), home_anchor_resolve (HOME.c:637-682) takes row-0's URI path VERBATIM and makes it h->root — the store root — with no ownership check, no symlink rejection (FILEStat follows symlinks; FILELStat exists and is unused), and no containment/absolute-path requirement. Running any dog inside a hostile cloned/untarred directory then routes rw opens (home_ensure_markers, DOGPupCreate) to an attacker-chosen path. Separately home_bootstrap_config (HOME.c:110-125) writes git config user.name/email into .be/config as name = "<value>" with NO escaping, so a value containing " or \n injects arbitrary TOML (e.g. forging the HOMEHost ref-authority). Method: Issues.

Input

Context

• Anchor adopted untrusted: home_walk_up (HOME.c:922-983) → home_anchor_resolve (:637-682) → DOGRepoFromBe sets h->root from row-0 (home_peek_repo_uri :562-587); nothing bounds it to the worktree.
• Symlink follow: FILEStat (HOME.c:650, :997 home_is_exe) resolves symlinks; a planted .be symlink or a symlinked sibling exe is followed, then the caller execvps it (TOCTOU between stat and exec).
• getenv("PATH") scan (HOME.c:1056) picks the sibling binary to exec — an attacker-controlled PATH chooses the code that runs.
• TOML injection: HOME.c:110-125, value slice {name_start,name[0]} fed raw; also silent truncation (256-byte emailbuf, FILEEnsureSoft fills what fits).
• DOGPupThinTail (DOG.c:714-733) unlinks a recomposed path decoupled from the mmap it released — check/unlink race in a shared .be dir.
• .. NOT rejected in project/branch segments: PATHu8sVerifySegment rejects //NUL/CR/LF/TAB but not ./..; DOGProjectFromBe (DOG.h:227-251) rejects only .be; DPATHBranchNormFeed (DPATH.h:57-78) never rejects ... A row-0 path or ref containing .. composes <root>/.be/.. (= <root>) so shard mkdir -p/refs reads+writes ESCAPE the .be store. (DPATH already ships the correct rejecter DPATHu8sDrainSeg/DPATHVerify — applied to git tree names, not to these segments; reuse it here.)
• FILECreate (abc/FILE.c) opens O_CREAT|O_RDWR|O_TRUNC with NO O_NOFOLLOW (and no O_EXCL on the pup tmp): callers HOME.c:128 (.be/config), :154 (wtlog), DOG.c:674 (pup tmp). A planted symlink at <repo>/.be/config or the <seqno>.<ext>.tmp redirects create+truncate to an arbitrary victim-writable file — classic repo-dir symlink TOCTOU.
• home_be_subdirs returns fail(OK) on the subdirs>1 break BEFORE setting *out_count (HOME.c:786-796), so it stays 0; home_dir_shieldlike (:963) then misclassifies a populated MULTI-project store as shieldlike and adopts the wrong anchor instead of walking past it.

Goals

• Refuse anchors not owned by the caller (geteuid vs FILELStat owner) and reject symlinked .be; make row-0 store roots resolve inside the discovered worktree (absolute + realpath containment) or fail.
• Escape (or reject) ", \, and control bytes in config values before emitting TOML; never silently truncate a value.
• Reject ../. in project + branch segments (reuse DPATHVerify) so no composed store path escapes .be; re-normalize before filesystem use.
• O_NOFOLLOW on .be/config/wtlog creates and O_EXCL on the pup tmp.
• Fix home_be_subdirs to set *out_count before the multi-shard break.
• Document the PATH/exec trust assumption; prefer fd-based ops over path re-derive.

Constraints

• dog/ libdog, ABC style; keep the ordinary single-user primary-worktree flow (own .be/) working unchanged — the guard only bites foreign/planted anchors.
• Note the threat model: TOML value comes from the user's OWN global git config, so that half is robustness-grade; the anchor adoption is the real remote vector (hostile repo on disk), rate it HIGH.

WIP

Design decisions

• Mirror git's safe.directory intent: an anchor is trusted only if owned by the invoking uid (or explicitly allow-listed); no ambient adoption.

TODOs

• T1 repro: a test dir containing a planted .be file whose row-0 points the store root outside the tree; assert be refuses instead of writing there.
• T2 ownership + FILELStat symlink checks on the discovered anchor.
• T3 containment check on the row-0 store root; reject ..//relative/outside; reject ../. project+branch segments (reuse DPATHVerify).
• T4 escape config values in home_bootstrap_config; reject NUL/newline; O_NOFOLLOW/O_EXCL on the marker + pup creates.
• T5 fix home_be_subdirs *out_count on the multi-shard break.
• T6 fuzz DOGParseURI/DOGRepoFromBe/home_peek_repo_uri (attacker URIs).

Blockers and bummers

• Pointer-arith in DOGRepoFromBe/DOGParseURI (DOG.h:186-280, DOG.c:238-284) is bounds-safe today but fragile; cleanup tracked under PTR-002.
• Audit 2026-07-07: re-verified in libdog HEAD 79612854 — raw TOML value feed HOME.c:108-125, no FILELStat/geteuid/O_NOFOLLOW anywhere in HOME.c, home_be_subdirs multi-shard break still skips *out_count (the fail(__) with __==OK precedes the assignment). NOTHING landed; WIP fix UNLANDED in worktree ~/src/DOG-009 (HOME.c modified).

Outcome

• OPEN — filed 2026-07-06, the libdog code-quality review session.