Repository navigation
Chip resolution: bot-to-bot sends / own-chat followups not author-checked or stripped (remainder of #106) #106
Description
Non-blocking finding from the independent review of #101.
The #53 chip gate (a dsh-session: reference must resolve through sessionOwnedBy for the author) covers channel send and room-post. The reviewer verified the DSH chip parser accepts both @[label](dsh-session:id) and bare dsh-session:id (so the gate's regex is a superset on those two endpoints) but left two paths open:
answer-question/schedule-create: actor-authored text injected viaagent.followup/ delivered later. A chip naming a foreign session would, if DSH resolves it there, pull that snapshot into the target session (for a shared room, riding to members viaattachReference). Noteschedule-createauthz readsbody.sessionIdwhile the endpoint readsbody.target— worth a look on its own.- Bot-authored text (group relays, bot→bot sends): if DSH resolves chips in bot messages, a member Bot could tunnel its own private chat into a shared room, bypassing the [Team] Isolate private context from shared room context #53 brief share. Pre-existing behavior, not a [Team] Isolate private context from shared room context #53 regression.
Acceptance: determine DSH's actual resolution surface (probe on a bench, or ask upstream), then either extend the author check to every path where actor- or bot-authored text becomes a session user message, or document why resolution cannot occur there.
Activity
fix(security): neutralize nested session chips; decode menu chip payl…
Birfy commentedon Oct 16, 2026
Mostly fixed on main (
566f1e6) by #135. One path remains; I changed the title to match.Done:
answer-question/schedule-create: both run the author check (unshareableReference) now. It also decodes the base64url menu chips, so a foreign session can't hide in an encoded chip.schedule-createauthz now keys offbody.target(owner of the Bot or room), so a foreign target can't ride on an ownedsessionId. Tests:context-sharing.test.js(foreign and own chips, encoded chips) andauthz.test.js(schedule-create cannot hide a foreign target behind an owned sessionId).postToRoomstripsdsh-session:chips (looped, so nested fragments can't rebuild one). A member Bot can no longer tunnel its own chat into a shared room. Test:a Bot post into a group drops chat-reference chips….team.mdrecords DSH's resolution surface (session-reference/attachReferenceon user-shaped followups).Remaining:
deliverfor bot-authored text, or document why resolution can't happen there.Keeping this open for that.
[-]Chip resolution beyond send/room-post: answer-question, schedule-create, bot-authored text (#53 follow-up)[/-][+]Chip resolution: bot-to-bot sends / own-chat followups not author-checked or stripped (remainder of #106)[/+]