fix: next 5 exploitable vulnerabilities (resource prompt injection, session_search wrapping, resource size, subagent summary, patch expansion)

Author: jkyberneees

AGENTS.md

@@ -91,7 +91,7 @@ System prompt is loaded by priority: `--system` flag > `~/.odek/IDENTITY.md` > c
 ### Security Architecture
 Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECURITY.md](docs/SECURITY.md).
 
-- **Untrusted-content wrapper** (`cmd/odek/untrusted.go`) — every tool whose output sources from outside the trust boundary (`browser`, `read_file`, `shell`, `search_files`, `multi_grep`, `transcribe`, `head_tail`, `diff`, `tr`, `sort`, `json_query`, `batch_patch`, `glob`, `session_search`, any MCP tool) wraps results in `<untrusted_content_<nonce> source="...">…</untrusted_content_<nonce>>`. Per-call nonce defeats wrapper-escape via literal close tag.
+- **Untrusted-content wrapper** (`cmd/odek/untrusted.go`) — every tool whose output sources from outside the trust boundary (`browser`, `read_file`, `shell`, `search_files`, `multi_grep`, `transcribe`, `head_tail`, `diff`, `tr`, `sort`, `json_query`, `batch_patch`, `glob`, `session_search`, `@-resources`, `--ctx` files, any MCP tool) wraps results in `<untrusted_content_<nonce> source="...">…</untrusted_content_<nonce>>`. Per-call nonce defeats wrapper-escape via literal close tag.
 - **Audit log** (`cmd/odek/audit.go` + `internal/session/audit.go`) — every `wrapUntrusted` call records source + content-hash + turn into `<sessions>/audit/<id>.json`. After each turn a divergence heuristic flags `suspicious_divergence=true` when the agent ingested untrusted content AND its tool calls referenced resources the user did not mention. Inspect with `odek audit <session-id>` / `odek audit --list`.
 - **Memory taint** (`internal/memory/provenance.go`) — `EpisodeProvenance` tracks Untrusted/Sources/UserApproved. Tainted episodes are stored but `Search()` filters them out, so a one-shot injection cannot persist via the episode pipeline. User must explicitly promote.
 - **Skill provenance gate** (`internal/skills/loader.go` + `cache.go`) — `Skill.Provenance{Untrusted, Sources, NeedsReview}`. NeedsReview skills pin to Lazy regardless of `auto_load`. `odek skill promote <name>` clears the flag after user review.
@@ -111,7 +111,11 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **patch tool hardening** (`cmd/odek/file_tool.go`) — `patch` rejects files larger than 10 MiB and preserves the original file mode instead of resetting it to 0644.
 - **glob tool hardening** (`cmd/odek/file_tool.go`) — `glob` caps results at 1,000 matches and wraps returned paths as untrusted content.
 - **Sub-agent task-file cap** (`cmd/odek/subagent.go`) — `odek subagent --task <file>` rejects task files larger than 10 MiB before loading them into memory.
-- **session_search get hardening** (`cmd/odek/session_search_tool.go`) — the `get` action returns at most the 100 most recent messages and wraps each message content as untrusted.
+- **session_search hardening** (`cmd/odek/session_search_tool.go`) — the `get` action returns at most the 100 most recent messages and wraps each message content, task, and buffer entry as untrusted; `list`/`search`/`find` also wrap session tasks.
+- **@-resource / --ctx prompt wrapping** (`cmd/odek/refs.go`, `cmd/odek/serve.go`) — content resolved from `@file` references and `--ctx` files is wrapped as untrusted before being inserted into the prompt.
+- **Resource resolver size cap** (`internal/resource/resource.go`) — `@-resource` file loads are capped at 1 MiB to prevent OOM from `@hugefile` references.
+- **Sub-agent summary cap** (`cmd/odek/subagent_tool.go`) — each sub-agent result included in the `delegate_tasks` summary is truncated to 100 KiB to prevent memory DoS.
+- **patch / batch_patch output expansion cap** (`cmd/odek/file_tool.go`, `cmd/odek/perf_tools.go`) — the post-replacement result is capped at 10 MiB so `ReplaceAll` cannot explode memory.
 - **Serve sandbox default-on** — `odek serve` enables `--sandbox` automatically unless `--no-sandbox` is passed.
 - **Secret redaction** (`internal/redact/redact.go`) — 20+ patterns: OpenAI, Anthropic, GitHub PAT, AWS, PEM, JWT, Vault, Google OAuth, SendGrid, Discord, DB URLs, etc.
 

cmd/odek/file_tool.go

@@ -689,6 +689,9 @@ func (t *patchTool) Call(argsJSON string) (string, error) {
 	} else {
 		modified = strings.Replace(original, args.OldString, args.NewString, 1)
 	}
+	if len(modified) > maxFileReadBytes {
+		return jsonError(fmt.Sprintf("patch result too large (%d bytes, max %d)", len(modified), maxFileReadBytes))
+	}
 
 	// Generate a simple diff
 	diff := fmt.Sprintf("--- a/%s\n+++ b/%s\n@@ -1 +1 @@\n-%s\n+%s\n",

cmd/odek/next_security_vulnerabilities_test.go

@@ -14,6 +14,7 @@ import (
 	"github.com/BackendStack21/odek/internal/config"
 	"github.com/BackendStack21/odek/internal/danger"
 	"github.com/BackendStack21/odek/internal/llm"
+	"github.com/BackendStack21/odek/internal/resource"
 	"github.com/BackendStack21/odek/internal/session"
 )
 
@@ -648,3 +649,155 @@ func TestSessionSearchGet_CapsAndWrapsMessages(t *testing.T) {
 		t.Fatalf("session message should be wrapped in untrusted_content, got: %q", r.SessionMessages[0].Content)
 	}
 }
+
+
+// ── 16. enrichTask must wrap @-resource / --ctx content ──────────────────
+
+func TestEnrichTask_WrapsCtxContent(t *testing.T) {
+	dir := t.TempDir()
+	os.WriteFile(filepath.Join(dir, "note.txt"), []byte("hello world"), 0644)
+
+	enriched, err := enrichTask("check @note.txt", nil, dir)
+	if err != nil {
+		t.Fatalf("enrichTask error: %v", err)
+	}
+	if !strings.Contains(enriched, "<untrusted_content_") {
+		t.Fatalf("enriched prompt should wrap file content in untrusted_content, got: %s", enriched)
+	}
+}
+
+func TestEnrichTask_WrapsCtxFiles(t *testing.T) {
+	dir := t.TempDir()
+	os.WriteFile(filepath.Join(dir, "data.txt"), []byte("sensitive data"), 0644)
+
+	enriched, err := enrichTask("analyze", []string{"data.txt"}, dir)
+	if err != nil {
+		t.Fatalf("enrichTask error: %v", err)
+	}
+	if !strings.Contains(enriched, "<untrusted_content_") {
+		t.Fatalf("--ctx content should be wrapped in untrusted_content, got: %s", enriched)
+	}
+}
+
+// ── 17. session_search list/search/find must wrap Task/Buffer ────────────
+
+func TestSessionSearch_ListWrapsTask(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+	store, err := session.NewStore()
+	if err != nil {
+		t.Fatalf("NewStore: %v", err)
+	}
+	sess := &session.Session{
+		ID:        "list-test",
+		Task:      "user task about go-vector",
+		Model:     "test",
+		CreatedAt: time.Now(),
+		UpdatedAt: time.Now(),
+	}
+	if err := store.Save(sess); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+
+	tool := newSessionSearchTool(store)
+	result := callJSON(t, tool, `{"action":"list"}`)
+	var r struct {
+		Sessions []struct {
+			Task string `json:"task"`
+		} `json:"sessions"`
+	}
+	mustUnmarshal(t, result, &r)
+	if len(r.Sessions) == 0 || !strings.HasPrefix(r.Sessions[0].Task, "<untrusted_content_") {
+		t.Fatalf("session list should wrap task in untrusted_content, got: %s", result)
+	}
+}
+
+// ── 18. Resource resolver must reject huge files ─────────────────────────
+
+func TestResourceResolver_RejectsHugeFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "huge.txt")
+	os.WriteFile(path, make([]byte, 15*1024*1024), 0644)
+
+	res := resource.NewFileResolver(dir)
+	_, err := res.Load(context.Background(), "huge.txt")
+	if err == nil {
+		t.Fatal("resource resolver should reject a 15 MiB file")
+	}
+	if !strings.Contains(err.Error(), "too large") {
+		t.Fatalf("expected size error, got: %v", err)
+	}
+}
+
+// ── 19. delegate_tasks must cap summary size ─────────────────────────────
+
+func TestDelegateTasks_CapsSummarySize(t *testing.T) {
+	if os.Getenv("ODEK_E2E") == "" {
+		t.Skip("sub-agent spawning test; set ODEK_E2E=true to run")
+	}
+	fakeOdek := filepath.Join(t.TempDir(), "fake-odek")
+	// Print a valid JSON result whose summary is ~6 MB.
+	script := `#!/bin/sh
+printf '{"status":"success","summary":"%s","files_changed":[],"iterations":1,"tokens_used":10}\n' "$(head -c 6000000 /dev/zero | tr '\0' 'x')"
+`
+	os.WriteFile(fakeOdek, []byte(script), 0755)
+
+	tool := &delegateTasksTool{
+		odekPath:       fakeOdek,
+		maxConcurrency: 1,
+		timeout:        30 * time.Second,
+	}
+	tool.SetContext(context.Background())
+	result, err := tool.Call(`{"tasks":[{"goal":"a"},{"goal":"b"}],"description":"summary cap test"}`)
+	if err != nil {
+		t.Fatalf("Call() error: %v", err)
+	}
+	if len(result) > 1024*1024+500 {
+		t.Fatalf("delegate_tasks summary returned %d bytes, expected cap near 1 MiB", len(result))
+	}
+}
+
+// ── 20. patch / batch_patch must cap ReplaceAll expansion ────────────────
+
+func TestPatch_RejectsOutputExpansion(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "data.txt")
+	// 2,000 'a' chars. Replacing each with 10,000 'x' => ~20M chars.
+	os.WriteFile(path, []byte(strings.Repeat("a", 2000)), 0644)
+
+	tool := &patchTool{}
+	result := callJSON(t, tool, fmt.Sprintf(`{"path":%q,"old_string":"a","new_string":%q,"replace_all":true}`, path, strings.Repeat("x", 10000)))
+	var r struct {
+		Success bool   `json:"success"`
+		Error   string `json:"error,omitempty"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Success {
+		t.Fatal("patch should reject a ReplaceAll that explodes output size")
+	}
+	if !strings.Contains(r.Error, "too large") {
+		t.Fatalf("expected size error, got: %q", r.Error)
+	}
+}
+
+func TestBatchPatch_RejectsOutputExpansion(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "data.txt")
+	os.WriteFile(path, []byte(strings.Repeat("a", 2000)), 0644)
+
+	tool := &batchPatchTool{}
+	result := callJSON(t, tool, fmt.Sprintf(`{"patches":[{"path":%q,"old_string":"a","new_string":%q,"replace_all":true}]}`, path, strings.Repeat("x", 10000)))
+	var r struct {
+		Results []struct {
+			Success bool   `json:"success"`
+			Error   string `json:"error,omitempty"`
+		} `json:"results"`
+	}
+	mustUnmarshal(t, result, &r)
+	if len(r.Results) != 1 || r.Results[0].Success {
+		t.Fatal("batch_patch should reject a ReplaceAll that explodes output size")
+	}
+	if !strings.Contains(r.Results[0].Error, "too large") {
+		t.Fatalf("expected size error, got: %q", r.Results[0].Error)
+	}
+}

cmd/odek/perf_tools.go

@@ -214,6 +214,11 @@ func (t *batchPatchTool) Call(argsJSON string) (result string, err error) {
 		} else {
 			modified = strings.Replace(original, p.OldString, p.NewString, 1)
 		}
+		if len(modified) > maxFileReadBytes {
+			entry.Error = fmt.Sprintf("patch result too large (%d bytes, max %d)", len(modified), maxFileReadBytes)
+			results[idx] = entry
+			continue
+		}
 
 		diff := fmt.Sprintf("--- a/%s\n+++ b/%s\n@@ -1 +1 @@\n-%s\n+%s\n",
 			p.Path, p.Path, truncateDiff(original, 100), truncateDiff(modified, 100))

cmd/odek/refs.go

@@ -39,7 +39,7 @@ func enrichTask(task string, ctxFiles []string, cwd string) (string, error) {
 				// Leave unresolved refs as-is
 				continue
 			}
-			resolved[ref.Raw] = content
+			resolved[ref.Raw] = wrapUntrusted("resource:"+ref.Raw, content)
 		}
 		enriched = resource.ReplaceRefs(task, resolved)
 	}
@@ -56,7 +56,7 @@ func enrichTask(task string, ctxFiles []string, cwd string) (string, error) {
 			if err != nil {
 				return "", fmt.Errorf("ctx file %q: %w", f, err)
 			}
-			blocks = append(blocks, fmt.Sprintf("--- %s ---\n%s\n--- end %s ---", f, content, f))
+			blocks = append(blocks, fmt.Sprintf("--- %s ---\n%s\n--- end %s ---", f, wrapUntrusted("ctx:"+f, content), f))
 		}
 		if len(blocks) > 0 {
 			// Log attached files to stderr

cmd/odek/serve.go

@@ -682,7 +682,7 @@ func handlePrompt(
 		if err != nil {
 			continue
 		}
-		resolvedRefs[ref.Raw] = content
+		resolvedRefs[ref.Raw] = wrapUntrusted("resource:"+ref.Raw, content)
 	}
 	enrichedPrompt := resource.ReplaceRefs(prompt, resolvedRefs)
 

cmd/odek/session_search_tool.go

@@ -142,7 +142,7 @@ func (t *sessionSearchTool) handleList(limit int) (string, error) {
 			Count:    0,
 		})
 	}
-	results := toSummaries(sessions)
+	results := toSummaries("session_search:list", sessions)
 	return jsonResult(sessionSearchResult{
 		Action:   "list",
 		Sessions: results,
@@ -191,7 +191,7 @@ func (t *sessionSearchTool) handleSearch(query string, limit int) (string, error
 				scoreLabel := fmt.Sprintf("(score: %.3f)", vr.Score)
 				results = append(results, sessionSummary{
 					ID:        sess.ID,
-					Task:      sess.Task + " " + scoreLabel,
+					Task:      wrapUntrusted("session_search:search", sess.Task+" "+scoreLabel),
 					Turns:     sess.Turns,
 					CreatedAt: sess.CreatedAt.UTC().Format(time.RFC3339),
 					UpdatedAt: sess.UpdatedAt.UTC().Format(time.RFC3339),
@@ -248,17 +248,18 @@ func (t *sessionSearchTool) handleSearch(query string, limit int) (string, error
 
 	results := make([]sessionSummary, len(matches))
 	for i, m := range matches {
+		task := m.session.Task
+		if m.snippet != "" && m.snippet != m.session.Task {
+			task = m.session.Task + " — " + m.snippet
+		}
 		results[i] = sessionSummary{
 			ID:        m.session.ID,
-			Task:      m.session.Task,
+			Task:      wrapUntrusted("session_search:search", task),
 			Turns:     m.session.Turns,
 			CreatedAt: m.session.CreatedAt.UTC().Format(time.RFC3339),
 			UpdatedAt: m.session.UpdatedAt.UTC().Format(time.RFC3339),
 			Model:     m.session.Model,
 		}
-		if m.snippet != "" && m.snippet != m.session.Task {
-			results[i].Task = m.session.Task + " — " + m.snippet
-		}
 	}
 
 	return jsonResult(sessionSearchResult{
@@ -381,15 +382,19 @@ func (t *sessionSearchTool) handleGet(id string) (string, error) {
 		sessionMessages[i].Content = wrapUntrusted("session_search:"+sess.ID, sessionMessages[i].Content)
 	}
 	msgCount := len(sessionMessages)
+	wrappedBuffer := make([]string, len(sess.Buffer))
+	for i, b := range sess.Buffer {
+		wrappedBuffer[i] = wrapUntrusted("session_search:get:buffer", b)
+	}
 	return jsonResult(sessionSearchResult{
 		Action:          "get",
 		ID:              sess.ID,
-		Task:            sess.Task,
+		Task:            wrapUntrusted("session_search:get", sess.Task),
 		Turns:           sess.Turns,
 		CreatedAt:       sess.CreatedAt.UTC().Format(time.RFC3339),
 		UpdatedAt:       sess.UpdatedAt.UTC().Format(time.RFC3339),
 		Model:           sess.Model,
-		Buffer:          sess.Buffer,
+		Buffer:          wrappedBuffer,
 		Messages:        msgCount,
 		SessionMessages: sessionMessages,
 	})
@@ -426,7 +431,7 @@ func (t *sessionSearchTool) handleFind(query string, limit int) (string, error)
 
 	return jsonResult(sessionSearchResult{
 		Action:   "find",
-		Sessions: toSummaries(matched),
+		Sessions: toSummaries("session_search:find", matched),
 		Count:    len(matched),
 	})
 }
@@ -449,12 +454,12 @@ func matchTokens(tokens []string, text string) int {
 }
 
 // toSummaries converts session.Session slices to sessionSummary (metadata only).
-func toSummaries(sessions []session.Session) []sessionSummary {
+func toSummaries(source string, sessions []session.Session) []sessionSummary {
 	results := make([]sessionSummary, len(sessions))
 	for i, s := range sessions {
 		results[i] = sessionSummary{
 			ID:        s.ID,
-			Task:      s.Task,
+			Task:      wrapUntrusted(source, s.Task),
 			Turns:     s.Turns,
 			CreatedAt: s.CreatedAt.UTC().Format(time.RFC3339),
 			UpdatedAt: s.UpdatedAt.UTC().Format(time.RFC3339),

cmd/odek/session_search_tool_test.go

@@ -186,7 +186,7 @@ func TestSessionSearch_Get(t *testing.T) {
 	if r.ID != "20260520-auth-fix" {
 		t.Errorf("id = %q, want '20260520-auth-fix'", r.ID)
 	}
-	if r.Task != "fix O_NOFOLLOW in file_tool.go" {
+	if unwrapUntrusted(r.Task) != "fix O_NOFOLLOW in file_tool.go" {
 		t.Errorf("task = %q", r.Task)
 	}
 	if r.Turns != 8 {

cmd/odek/subagent_tool.go

@@ -157,12 +157,18 @@ func (t *delegateTasksTool) Call(args string) (string, error) {
 		sem <- struct{}{}
 	}
 
-	// Build summary for the calling agent
+	// Build summary for the calling agent. Cap each sub-agent result so the
+	// summary cannot grow without bound.
 	var buf strings.Builder
 	buf.WriteString("📋 Sub-agent results:\n\n")
 	for i, r := range results {
 		buf.WriteString(fmt.Sprintf("─── Task %d: %s ───\n", i+1, truncate(input.Tasks[i].Goal, 60)))
-		buf.WriteString(r)
+		if len(r) > maxSubagentSummaryResultBytes {
+			buf.WriteString(r[:maxSubagentSummaryResultBytes])
+			buf.WriteString("\n... [result truncated]")
+		} else {
+			buf.WriteString(r)
+		}
 		buf.WriteString("\n\n")
 	}
 	return buf.String(), nil
@@ -284,6 +290,11 @@ func (t *delegateTasksTool) runTask(taskIdx int, goal, taskContext, guidance, tr
 	return `{"error":"no result from sub-agent"}`
 }
 
+// maxSubagentSummaryResultBytes caps how much of each sub-agent result is
+// included in the parent delegate_tasks summary, preventing memory DoS from
+// huge sub-agent outputs.
+const maxSubagentSummaryResultBytes = 100 << 10 // 100 KiB
+
 // maxSubagentLine caps a single NDJSON line read from a sub-agent's stdout.
 // Streamed tool_call events embed full tool arguments (e.g. a large write_file
 // or patch), which routinely exceed bufio.Scanner's default 64KB token cap.

internal/resource/resource.go

@@ -21,6 +21,11 @@ import (
 	"github.com/BackendStack21/odek/internal/session"
 )
 
+// maxResourceFileBytes caps how much of a file the @-resource resolver will
+// read into memory. It still truncates the returned content to 50 KB, but this
+// guard prevents OOM from files larger than 1 MiB.
+const maxResourceFileBytes = 1 << 20 // 1 MiB
+
 // Resource is a discovered resource returned by a Resolver.
 type Resource struct {
 	ID      string `json:"id"`     // Full @ reference (e.g. "@src/main.go")
@@ -268,6 +273,14 @@ func (f *FileResolver) Load(ctx context.Context, id string) (string, error) {
 	}
 	defer fd.Close()
 
+	info, err := fd.Stat()
+	if err != nil {
+		return "", err
+	}
+	if info.Size() > maxResourceFileBytes {
+		return "", fmt.Errorf("resource: file too large (%d bytes, max %d)", info.Size(), maxResourceFileBytes)
+	}
+
 	data, err := io.ReadAll(fd)
 	if err != nil {
 		return "", err