mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vb
4ab01c39df
P3 item 4. Each of the five plugin CRITICALs in audit-2026-04-07.md was re-verified against the current Server/plugin/ code rather than the tracker: - #1 invokeCommand timeout — CLOSED. Per-call CPU budget (manifest → config → 100ms floor) + WithCloseOnContextDone + lazy re-instantiation. Landed in PR #1182 (7b178ff,b13adf2); pinned by the W1-1 test. - #2 storage key isolation — CLOSED. The premise did not hold: the namespace is the caller's Instance.ID and plugin_kv PRIMARY KEY (plugin_id, key). - #3 per-command ACL — CLOSED by the manifest `commands` ACL in3d2dd19. - #4 event rate limit — CLOSED as not reachable: EventSink.Dispatch invokes no guest code and has zero callers; the requirement is recorded as a SECURITY GATE at the point delivery would be wired. - #5 HTTP exfiltration — OPEN, accepted residual risk. An allowlisted host is by definition a permitted destination; closing it needs egress content policy and per-plugin allowlists, i.e. a runtime redesign, out of scope for P3. Because #5 stays open the standing rule fires as written: plugins ship default-disabled at the beta gate. Re-verified in config.DefaultConfig() — Plugins.Enabled false, HTTPAllowlist empty. Also records the structural mitigation covering #2/#4/#5: no host imports are wired into the wazero runtime, so command_dispatch and list_commands are the only guest-reachable entry points today. Mirrors the outcome in the §1 carried-over row of audit-2026-07-19.md, records decision D11 in plans/audit-2026-07-19-decisions.md, and notes in plans/slash-commands.md which slice of its manifest design already landed.