Egress apply validates with load_routes but sidecar runs load_config (log: bypass) #256

New Issue

2026-06-24T00:55:48-04:00

didericis-claude commented

2026-06-24 00:55:48 -04:00

Severity: Medium

EgressApplicator.validate_routes_content validates agent-proposed content with load_routes (routes only — bot_bottle/backend/egress_apply.py:34), but the sidecar reads the same file with load_config, which also honors a top-level log: key (egress_addon_core.py:421, egress_addon.py:52).

An agent-proposed routes file can carry log: 2 (LOG_FULL): validation ignores the key, and on reload the sidecar honors it — silently enabling full request/response logging. The supervise approval surface presents it as a routes change and would not flag the logging-mode flip.

Fix: validate with load_config (the same parser the sidecar uses) so what is checked equals what runs, and so a log: change is surfaced/rejected at approval time.

Closely related to the LOG_FULL credential-exposure issue (the two chain).

Filed from a security audit of the TLS-interception egress path and git-gate credential handling (follow-up to the prd-0054-install-script quality-eval review). The core controls — default-deny, per-bottle CA, sidecar credential isolation — were confirmed sound; these are residual hardening gaps.

**Severity:** Medium `EgressApplicator.validate_routes_content` validates agent-proposed content with `load_routes` (routes only — `bot_bottle/backend/egress_apply.py:34`), but the sidecar reads the same file with `load_config`, which also honors a top-level `log:` key (`egress_addon_core.py:421`, `egress_addon.py:52`). An agent-proposed routes file can carry `log: 2` (`LOG_FULL`): validation ignores the key, and on reload the sidecar honors it — silently enabling full request/response logging. The supervise approval surface presents it as a routes change and would not flag the logging-mode flip. **Fix:** validate with `load_config` (the same parser the sidecar uses) so what is checked equals what runs, and so a `log:` change is surfaced/rejected at approval time. Closely related to the LOG_FULL credential-exposure issue (the two chain). --- _Filed from a security audit of the TLS-interception egress path and git-gate credential handling (follow-up to the `prd-0054-install-script` quality-eval review). The core controls — default-deny, per-bottle CA, sidecar credential isolation — were confirmed sound; these are residual hardening gaps._

didericis-claude added the Kind/Security

Priority

Medium

3

labels 2026-06-24 00:55:48 -04:00

didericis-codex referenced a pull request that will close this issue

2026-06-25 01:25:56 -04:00

Validate proposed egress config #266

didericis closed this issue

2026-06-25 03:08:20 -04:00

Sign in to join this conversation.