mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vb
3d2dd19001
Closes audit-2026-04-07 CRITICAL #3. Holding the `commands` capability used to bind whatever names the guest module returned from `list_commands`, so an admin enabling a plugin could not know which commands it would claim and a plugin could widen its own command surface after review. The manifest is now the authority. `plugin.json` gains a `commands` block (`[{"name": "hello"}]`) and `RegisterCommand` refuses any undeclared name — the single choke point both auto-registration and direct registration route through, so no caller can bypass it. Declared names are validated to the dispatcher's canonical lowercase form, deduplicated, and capped at 64. The object shape matches docs/plans/slash-commands.md so the richer per-command schema can land later without a manifest migration. Also pins the two neighbouring CRITICALs that verification found already closed, and adds the storage key cap host_storage.go's doc comment already promised: - #2 (storage key isolation): TestStorageKeysIsolatedPerPlugin — the KV namespace is the caller's Instance.ID with no parameter to override it, and plugin_kv PRIMARY KEY (plugin_id, key) makes the split structural. - #4 (event rate limit): TestEventDeliveryHasNoGuestPath — EventSink.Dispatch invokes no guest code and has no callers, so there is nothing to limit yet; a SECURITY GATE comment requires the limiter in whatever change wires delivery. - #5 mitigation: TestEmptyAllowlistDeniesEveryHost — the shipped empty http_allowlist must fail closed. BREAKING CHANGE: a plugin declaring the `commands` capability must now list its commands in the manifest's `commands` block; undeclared names no longer bind. Only the in-repo `hello` example is affected and is updated here.
23 lines
1.1 KiB
Go
23 lines
1.1 KiB
Go
package plugin
|
|
|
|
import "errors"
|
|
|
|
// ErrRuntimeUnavailable is returned when the plugin runtime cannot start
|
|
// because the wazero build tag was not enabled. Default builds surface this
|
|
// error from Registry.LoadAll so the rest of the server can keep running.
|
|
var ErrRuntimeUnavailable = errors.New("plugin runtime: wazero build tag not enabled (build with -tags wazero to load .wasm plugins)")
|
|
|
|
// ErrPluginNotFound is returned when an operation references an unknown
|
|
// plugin id or name.
|
|
var ErrPluginNotFound = errors.New("plugin not found")
|
|
|
|
// ErrCapabilityNotGranted is returned when a host API call would require a
|
|
// capability the plugin's manifest did not declare.
|
|
var ErrCapabilityNotGranted = errors.New("plugin capability not granted")
|
|
|
|
// ErrCommandNotDeclared is returned when a plugin tries to bind a slash
|
|
// command its manifest did not list in `commands`. The manifest — not the
|
|
// guest module — is the authority on which commands a plugin may own, so an
|
|
// admin can see the full command surface before enabling the plugin.
|
|
var ErrCommandNotDeclared = errors.New("plugin command not declared in manifest")
|