Vouch Request: Security regression tests for issue #1498 #1553
RanPollak
started this conversation in
Vouch Request
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Hi OpenShell maintainers,
I would like to contribute regression tests for the hostname parser security issue documented in #1498.
What I want to add:
Add 9 unit tests to
crates/openshell-sandbox/src/proxy.rsthat test theparse_target()function for security vulnerabilities like NUL byte injection, control character injection, and other malformed hostname cases.Why this matters:
Issue #1498 specifically requests regression coverage for the Claude Code SOCKS5 bypass vulnerability where NUL bytes in hostnames can cause parser differential attacks. The tests I wrote expose 6 real vulnerabilities in the current code that allow attackers to bypass policy checks.
What I have done:
Why me:
I have experience with security testing and wanted to contribute something concrete that addresses a real security issue documented in your issue tracker.
The tests are ready to review - they are test-only changes with zero risk to production code.
Thanks for considering my contribution!
Beta Was this translation helpful? Give feedback.
All reactions