fix: next 5 security vulnerabilities (patch, glob, subagent task, transcribe output, session_search get)

Author: jkyberneees

AGENTS.md

@@ -91,7 +91,7 @@ System prompt is loaded by priority: `--system` flag > `~/.odek/IDENTITY.md` > c
 ### Security Architecture
 Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECURITY.md](docs/SECURITY.md).
 
-- **Untrusted-content wrapper** (`cmd/odek/untrusted.go`) — every tool whose output sources from outside the trust boundary (`browser`, `read_file`, `shell`, `search_files`, `multi_grep`, `transcribe`, `head_tail`, `diff`, `tr`, `sort`, `json_query`, `batch_patch`, any MCP tool) wraps results in `<untrusted_content_<nonce> source="...">…</untrusted_content_<nonce>>`. Per-call nonce defeats wrapper-escape via literal close tag.
+- **Untrusted-content wrapper** (`cmd/odek/untrusted.go`) — every tool whose output sources from outside the trust boundary (`browser`, `read_file`, `shell`, `search_files`, `multi_grep`, `transcribe`, `head_tail`, `diff`, `tr`, `sort`, `json_query`, `batch_patch`, `glob`, `session_search`, any MCP tool) wraps results in `<untrusted_content_<nonce> source="...">…</untrusted_content_<nonce>>`. Per-call nonce defeats wrapper-escape via literal close tag.
 - **Audit log** (`cmd/odek/audit.go` + `internal/session/audit.go`) — every `wrapUntrusted` call records source + content-hash + turn into `<sessions>/audit/<id>.json`. After each turn a divergence heuristic flags `suspicious_divergence=true` when the agent ingested untrusted content AND its tool calls referenced resources the user did not mention. Inspect with `odek audit <session-id>` / `odek audit --list`.
 - **Memory taint** (`internal/memory/provenance.go`) — `EpisodeProvenance` tracks Untrusted/Sources/UserApproved. Tainted episodes are stored but `Search()` filters them out, so a one-shot injection cannot persist via the episode pipeline. User must explicitly promote.
 - **Skill provenance gate** (`internal/skills/loader.go` + `cache.go`) — `Skill.Provenance{Untrusted, Sources, NeedsReview}`. NeedsReview skills pin to Lazy regardless of `auto_load`. `odek skill promote <name>` clears the flag after user review.
@@ -106,8 +106,12 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **Perf-tool file-size cap** (`cmd/odek/perf_tools.go`) — `diff`, `base64`, `tr`, `sort`, `json_query`, and `batch_patch` reject files larger than 10 MiB to avoid loading multi-gigabyte files into memory.
 - **Shell output cap** (`cmd/odek/shell.go`, `cmd/odek/perf_tools.go`) — `shell` and `parallel_shell` cap captured stdout/stderr at 1 MiB per stream to prevent memory DoS from commands that dump huge files.
 - **Browser request timeout** (`cmd/odek/browser_tool.go`) — the browser HTTP client enforces a 30-second request timeout so a slow/malicious server cannot hang the agent turn.
-- **Transcribe input guard** (`cmd/odek/transcribe_tool.go`) — rejects audio files larger than 10 MiB and writes ffmpeg output to a temp file so it cannot clobber an existing `.wav` next to the source path.
+- **Transcribe input/output guard** (`cmd/odek/transcribe_tool.go`) — rejects audio files larger than 10 MiB, caps whisper stdout at 10 MiB, and writes ffmpeg output to a temp file so it cannot clobber an existing `.wav` next to the source path.
 - **Tree width cap** (`cmd/odek/perf_tools.go`) — the `tree` tool limits each directory listing to 1,000 entries to avoid OOM from directories with millions of files.
+- **patch tool hardening** (`cmd/odek/file_tool.go`) — `patch` rejects files larger than 10 MiB and preserves the original file mode instead of resetting it to 0644.
+- **glob tool hardening** (`cmd/odek/file_tool.go`) — `glob` caps results at 1,000 matches and wraps returned paths as untrusted content.
+- **Sub-agent task-file cap** (`cmd/odek/subagent.go`) — `odek subagent --task <file>` rejects task files larger than 10 MiB before loading them into memory.
+- **session_search get hardening** (`cmd/odek/session_search_tool.go`) — the `get` action returns at most the 100 most recent messages and wraps each message content as untrusted.
 - **Serve sandbox default-on** — `odek serve` enables `--sandbox` automatically unless `--no-sandbox` is passed.
 - **Secret redaction** (`internal/redact/redact.go`) — 20+ patterns: OpenAI, Anthropic, GitHub PAT, AWS, PEM, JWT, Vault, Google OAuth, SendGrid, Discord, DB URLs, etc.
 

cmd/odek/file_tool.go

@@ -33,6 +33,10 @@ const maxSearchLimit = 500
 // search_files / multi_grep content query.
 const maxSearchResultBytes = maxReadBytes
 
+// maxGlobMatches caps the number of paths returned by the glob tool to prevent
+// unbounded JSON responses from broad patterns.
+const maxGlobMatches = 1000
+
 type readFileTool struct {
 	dangerousConfig danger.DangerousConfig
 }
@@ -656,6 +660,16 @@ func (t *patchTool) Call(argsJSON string) (string, error) {
 	}
 	defer f.Close()
 
+	// Reject files that would exhaust memory during the read/edit/write cycle.
+	info, err := f.Stat()
+	if err != nil {
+		return jsonError(fmt.Sprintf("cannot stat %q: %v", args.Path, err))
+	}
+	if info.Size() > maxFileReadBytes {
+		return jsonError(fmt.Sprintf("file too large (%d bytes, max %d)", info.Size(), maxFileReadBytes))
+	}
+	origMode := info.Mode().Perm()
+
 	// Read content through the opened fd (not re-opening the path)
 	var sb strings.Builder
 	_, err = io.Copy(&sb, f)
@@ -699,7 +713,7 @@ func (t *patchTool) Call(argsJSON string) (string, error) {
 		os.Remove(tmpPath)
 		return jsonError(fmt.Sprintf("cannot write %q: %v", args.Path, err))
 	}
-	if err := tmpFile.Chmod(0644); err != nil {
+	if err := tmpFile.Chmod(origMode); err != nil {
 		tmpFile.Close()
 		os.Remove(tmpPath)
 		return jsonError(fmt.Sprintf("cannot set permissions %q: %v", args.Path, err))
@@ -1155,6 +1169,9 @@ func (t *globTool) Call(argsJSON string) (result string, err error) {
 	if args.Limit <= 0 {
 		args.Limit = maxMatches
 	}
+	if args.Limit > maxGlobMatches {
+		args.Limit = maxGlobMatches
+	}
 
 	// Security: classify search root path
 	risk := danger.ClassifyPath(args.Path)
@@ -1278,6 +1295,10 @@ func (t *globTool) Call(argsJSON string) (result string, err error) {
 		return fi.ModTime().After(fj.ModTime())
 	})
 
+	for i := range matches {
+		matches[i].Path = wrapUntrusted("glob:"+args.Path, matches[i].Path)
+	}
+
 	return jsonResult(globResult{Matches: matches})
 }
 

cmd/odek/next_security_vulnerabilities_test.go

@@ -11,7 +11,10 @@ import (
 	"testing"
 	"time"
 
+	"github.com/BackendStack21/odek/internal/config"
 	"github.com/BackendStack21/odek/internal/danger"
+	"github.com/BackendStack21/odek/internal/llm"
+	"github.com/BackendStack21/odek/internal/session"
 )
 
 // ── 1. Browser history must be capped to avoid memory DoS ────────────────
@@ -475,3 +478,173 @@ func TestTree_CapsDirectoryWidth(t *testing.T) {
 		t.Fatalf("tree did not cap directory width: got %d children", len(r.Tree.Children))
 	}
 }
+
+
+// ── 11. patch must reject huge files and preserve original permissions ───
+
+func TestPatch_RejectsHugeFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "huge.txt")
+	os.WriteFile(path, []byte(strings.Repeat("x", 15*1024*1024)), 0644)
+
+	tool := &patchTool{}
+	result := callJSON(t, tool, fmt.Sprintf(`{"path":%q,"old_string":"xxx","new_string":"yyy"}`, path))
+	var r struct {
+		Success bool   `json:"success"`
+		Error   string `json:"error,omitempty"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Success {
+		t.Fatal("patch should reject a 15 MiB file")
+	}
+	if !strings.Contains(r.Error, "too large") {
+		t.Fatalf("patch should reject huge file with a size error, got: %q", r.Error)
+	}
+}
+
+func TestPatch_PreservesFileMode(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "script.sh")
+	os.WriteFile(path, []byte("#!/bin/sh\necho hello\n"), 0755)
+
+	tool := &patchTool{}
+	result := callJSON(t, tool, fmt.Sprintf(`{"path":%q,"old_string":"hello","new_string":"world"}`, path))
+	var r struct {
+		Success bool `json:"success"`
+	}
+	mustUnmarshal(t, result, &r)
+	if !r.Success {
+		t.Fatal("patch failed")
+	}
+
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode().Perm() != 0755 {
+		t.Fatalf("patch changed mode from 0755 to %04o", info.Mode().Perm())
+	}
+}
+
+// ── 12. glob must cap match count and wrap paths as untrusted ────────────
+
+func TestGlob_CapsMatchCount(t *testing.T) {
+	dir := t.TempDir()
+	for i := 0; i < 1500; i++ {
+		os.WriteFile(filepath.Join(dir, fmt.Sprintf("file%d.txt", i)), []byte("x"), 0644)
+	}
+
+	tool := &globTool{dangerousConfig: danger.DangerousConfig{}}
+	result := callJSON(t, tool, fmt.Sprintf(`{"pattern":"*","path":%q,"limit":10000}`, dir))
+	var r struct {
+		Matches []struct {
+			Path string `json:"path"`
+		} `json:"matches"`
+	}
+	mustUnmarshal(t, result, &r)
+	if len(r.Matches) > 1000 {
+		t.Fatalf("glob did not cap match count: got %d", len(r.Matches))
+	}
+	if len(r.Matches) == 0 {
+		t.Fatal("expected at least one match")
+	}
+	if !strings.HasPrefix(r.Matches[0].Path, "<untrusted_content_") {
+		t.Fatalf("glob path should be wrapped in untrusted_content, got: %q", r.Matches[0].Path)
+	}
+}
+
+// ── 13. subagent must reject a huge task file ────────────────────────────
+
+func TestSubagent_RejectsHugeTaskFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "task.json")
+	os.WriteFile(path, []byte(`{"goal":"`+strings.Repeat("x", 15*1024*1024)+`"}`), 0600)
+
+	err := subagentCmd([]string{"--task", path})
+	if err == nil {
+		t.Fatal("subagent should reject a huge task file")
+	}
+	if !strings.Contains(err.Error(), "too large") {
+		t.Fatalf("subagent should reject huge task file with a size error, got: %v", err)
+	}
+}
+
+// ── 14. transcribe must cap whisper stdout ───────────────────────────────
+
+func TestTranscribe_CapsWhisperOutput(t *testing.T) {
+	dir := t.TempDir()
+	fakeBinary := filepath.Join(dir, "whisper")
+	fakeModel := filepath.Join(dir, "model.bin")
+	// Fake whisper: streams valid-ish opening JSON then floods stdout.
+	script := `#!/bin/sh
+head -c 20000000 /dev/zero | tr '\0' 'x'
+exit 0
+`
+	os.WriteFile(fakeBinary, []byte(script), 0755)
+	os.WriteFile(fakeModel, []byte("fake model"), 0644)
+
+	audioPath := filepath.Join(dir, "audio.wav")
+	os.WriteFile(audioPath, []byte("fake wav"), 0644)
+
+	tool := newTranscribeTool(danger.DangerousConfig{}, config.TranscriptionConfig{
+		BinaryPath: fakeBinary,
+		Model:      fakeModel,
+	})
+	result := callJSON(t, tool, fmt.Sprintf(`{"path":%q}`, audioPath))
+	var r struct {
+		Error string `json:"error,omitempty"`
+	}
+	mustUnmarshal(t, result, &r)
+	if !strings.Contains(r.Error, "too large") {
+		t.Fatalf("transcribe should cap whisper output, got: %q", r.Error)
+	}
+}
+
+// ── 15. session_search get must cap/wrap returned messages ───────────────
+
+func TestSessionSearchGet_CapsAndWrapsMessages(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+
+	store, err := session.NewStore()
+	if err != nil {
+		t.Fatalf("NewStore: %v", err)
+	}
+
+	sess := &session.Session{
+		ID:        "test-session",
+		Task:      "test",
+		Model:     "test-model",
+		CreatedAt: time.Now(),
+		UpdatedAt: time.Now(),
+	}
+	for i := 0; i < 150; i++ {
+		sess.Messages = append(sess.Messages, llm.Message{Role: "assistant", Content: fmt.Sprintf("msg %d", i)})
+	}
+	if err := store.Save(sess); err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+
+	tool := &sessionSearchTool{store: store}
+	result := callJSON(t, tool, `{"action":"get","query":"test-session"}`)
+	t.Logf("session get result: %s", result)
+	var r struct {
+		Error           string `json:"error,omitempty"`
+		SessionMessages []struct {
+			Content string `json:"content"`
+		} `json:"session_messages"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Error != "" {
+		t.Fatalf("session get error: %s", r.Error)
+	}
+	if len(r.SessionMessages) > 100 {
+		t.Fatalf("session_search get did not cap messages: got %d", len(r.SessionMessages))
+	}
+	if len(r.SessionMessages) == 0 {
+		t.Fatal("expected at least one message")
+	}
+	if !strings.HasPrefix(r.SessionMessages[0].Content, "<untrusted_content_") {
+		t.Fatalf("session message should be wrapped in untrusted_content, got: %q", r.SessionMessages[0].Content)
+	}
+}

cmd/odek/session_search_tool.go

@@ -362,7 +362,9 @@ func (t *sessionSearchTool) handleGet(id string) (string, error) {
 		})
 	}
 
-	// Build session messages for the LLM to read.
+	// Build session messages for the LLM to read. Cap how many are returned
+	// and treat the content as untrusted because it includes prior tool outputs.
+	const maxSessionGetMessages = 100
 	var sessionMessages []sessionMessage
 	for _, m := range sess.Messages {
 		if m.Role == "user" || m.Role == "assistant" {
@@ -372,6 +374,12 @@ func (t *sessionSearchTool) handleGet(id string) (string, error) {
 			})
 		}
 	}
+	if len(sessionMessages) > maxSessionGetMessages {
+		sessionMessages = sessionMessages[len(sessionMessages)-maxSessionGetMessages:]
+	}
+	for i := range sessionMessages {
+		sessionMessages[i].Content = wrapUntrusted("session_search:"+sess.ID, sessionMessages[i].Content)
+	}
 	msgCount := len(sessionMessages)
 	return jsonResult(sessionSearchResult{
 		Action:          "get",

cmd/odek/session_search_tool_test.go

@@ -712,7 +712,7 @@ func TestSessionSearch_GetReturnsSessionMessages(t *testing.T) {
 		if resp.SessionMessages[i].Role != c.role {
 			t.Errorf("msg[%d] role = %q, want %q", i, resp.SessionMessages[i].Role, c.role)
 		}
-		if resp.SessionMessages[i].Content != c.content {
+		if unwrapUntrusted(resp.SessionMessages[i].Content) != c.content {
 			t.Errorf("msg[%d] content = %q, want %q", i, resp.SessionMessages[i].Content, c.content)
 		}
 	}

cmd/odek/subagent.go

@@ -224,6 +224,13 @@ func subagentCmd(args []string) error {
 	var taskTrust string    // "trusted" or "untrusted" (from parent agent)
 	var taskMaxRisk string
 	if hasTaskFile {
+		info, err := os.Stat(cfg.taskFile)
+		if err != nil {
+			return fmt.Errorf("stat task file: %w", err)
+		}
+		if info.Size() > maxFileReadBytes {
+			return fmt.Errorf("task file too large (%d bytes, max %d)", info.Size(), maxFileReadBytes)
+		}
 		data, err := os.ReadFile(cfg.taskFile)
 		if err != nil {
 			return fmt.Errorf("read task file: %w", err)

cmd/odek/transcribe_tool.go

@@ -287,8 +287,14 @@ func (t *transcribeTool) Call(argsJSON string) (result string, err error) {
 		args2 = append(args2, "--language", lang)
 	}
 
+	const maxWhisperOutputBytes = 10 << 20 // 10 MiB
 	cmd := exec.CommandContext(t.toolCtx(), binary, args2...)
 	output, err := cmd.Output()
+	if err == nil && len(output) > maxWhisperOutputBytes {
+		return jsonResult(transcribeResult{
+			Error: fmt.Sprintf("whisper output too large (%d bytes, max %d)", len(output), maxWhisperOutputBytes),
+		})
+	}
 	if err != nil {
 		if exitErr, ok := err.(*exec.ExitError); ok {
 			return jsonResult(transcribeResult{