Hand-rolled egress/gitconfig YAML emitters don't escape quotes/newlines #258

New Issue

2026-06-24T00:55:48-04:00

didericis-claude commented

2026-06-24 00:55:48 -04:00

Severity: Low (robustness; no agent privilege boundary crossed)

egress_render_routes / _route_to_yaml_fields (bot_bottle/egress.py) interpolate manifest strings (host, path/header match values, auth_scheme) into "..." YAML scalars with no escaping of ", \, or newline. git_gate_render_gitconfig (bot_bottle/git_gate.py:115) has the same shape for Upstream / the ssh alias into gitconfig.

This path is operator-manifest only — the agent-proposed routes path is parse-validated and written verbatim, never re-rendered through these emitters — so there is no privilege escalation. But a stray quote in an otherwise-legitimate header-match value silently corrupts routes.yaml; the strict re-parse then fails and the sidecar falls back to empty/stale routes (a fail-closed but confusing outcome). A newline in Upstream could inject arbitrary gitconfig keys.

Fix: escape "/\/newline at render time, or assert-reject these metacharacters in the affected manifest fields with a clear error.

Filed from a security audit of the TLS-interception egress path and git-gate credential handling (follow-up to the prd-0054-install-script quality-eval review). The core controls — default-deny, per-bottle CA, sidecar credential isolation — were confirmed sound; these are residual hardening gaps.

**Severity:** Low (robustness; no agent privilege boundary crossed) `egress_render_routes` / `_route_to_yaml_fields` (`bot_bottle/egress.py`) interpolate manifest strings (host, path/header match values, auth_scheme) into `"..."` YAML scalars with no escaping of `"`, `\`, or newline. `git_gate_render_gitconfig` (`bot_bottle/git_gate.py:115`) has the same shape for `Upstream` / the ssh alias into gitconfig. This path is operator-manifest only — the agent-proposed routes path is parse-validated and written verbatim, never re-rendered through these emitters — so there is **no privilege escalation**. But a stray quote in an otherwise-legitimate header-match value silently corrupts `routes.yaml`; the strict re-parse then fails and the sidecar falls back to empty/stale routes (a fail-closed but confusing outcome). A newline in `Upstream` could inject arbitrary gitconfig keys. **Fix:** escape `"`/`\`/newline at render time, or assert-reject these metacharacters in the affected manifest fields with a clear error. --- _Filed from a security audit of the TLS-interception egress path and git-gate credential handling (follow-up to the `prd-0054-install-script` quality-eval review). The core controls — default-deny, per-bottle CA, sidecar credential isolation — were confirmed sound; these are residual hardening gaps._

didericis-claude added the

Priority

Low

4

Kind/Bug labels 2026-06-24 00:55:49 -04:00

didericis referenced this issue from a commit

2026-06-25 03:42:42 -04:00

fix: escape quotes/newlines in YAML and gitconfig emitters

didericis-claude referenced a pull request that will close this issue

2026-06-25 03:43:02 -04:00

Fix unescaped quotes/newlines in YAML and gitconfig emitters #276

didericis referenced this issue from a commit