slash/slash-server
slash/slash-server
3
0
Fork 0
Code Issues 3 Pull requests Projects Releases 3 Packages Wiki Activity Actions

upstream-watch: security heuristic classified none of the six security fixes in the 11.7.9 batch #24

New issue
Open
opened 2026-08-05 01:09:25 +00:00 by mohlec · 0 comments
mohlec commented 2026-08-05 01:09:25 +00:00
Owner
Copy link

Summary

The weekly upstream drift report (/opt/slash-upstream-watch/check.sh on git.ncwcom.com) classifies commits into a "Security / hardening (heuristic)" section. In the 2026-08-03 report that section was empty, while the batch it was describing contained at least four security fixes.

Evidence

reports/2026-08-03.md rendered:

## Security / hardening (heuristic)

## Version / plugin bumps
- 205d80ad5 Update latest patch version to 11.7.9
...

Security-relevant commits present in that same batch:

Commit What it is
8400e7cb6 Prepackage Calls v1.11.6 — SDP zip-bomb DoS fix
8a56d5a6f MM-68773 — HTML encoding in proxied image URL
50ab3983c MM-69392 — DCR redirect URI allowlist matching made URL-component aware
96bfd7e57 MM-69408 — quadratic markdown autolink trimming (ReDoS)
f52a22d0c MM-69857 — policy update endpoint keeps team scope system-managed
7acc6ce19 team-scope channel check on access policy unassign

Zero of these were classified.

Why it matters

That section is what gets read to decide "is this urgent or can it wait?". Reporting an empty security section for a batch that is mostly security actively argues for deferring the merge. This batch sat unmerged for roughly five weeks.

Root cause (suspected)

The heuristic almost certainly greps for words like security, CVE, vulnerability, or XSS in the commit subject. Mattermost does not write subjects that way — security fixes ship as plain MM-xxxxx ticket references with neutral wording, often as cherry-picks, and the DoS fix above is disguised as a routine plugin version bump.

Suggested fix

Subject-line keyword matching cannot work against this upstream. Options, roughly in order of value:

  1. Cross-reference the Mattermost security advisories / release notes for the version range rather than inferring from subjects.
  2. Treat all prepackaged-plugin bumps as "review required" — the Calls bump was the most serious item in the batch and looks the most routine.
  3. Flag on touched paths as a secondary signal (server/channels/api4/, auth/permission/policy code, markdown/rendering).
  4. If none of that is practical, remove the section entirely. An empty security heading is worse than no heading — it reads as an assurance the tool cannot actually make.
## Summary The weekly upstream drift report (`/opt/slash-upstream-watch/check.sh` on git.ncwcom.com) classifies commits into a **"Security / hardening (heuristic)"** section. In the 2026-08-03 report that section was **empty**, while the batch it was describing contained at least four security fixes. ## Evidence `reports/2026-08-03.md` rendered: ``` ## Security / hardening (heuristic) ## Version / plugin bumps - 205d80ad5 Update latest patch version to 11.7.9 ... ``` Security-relevant commits present in that same batch: | Commit | What it is | |---|---| | `8400e7cb6` | Prepackage Calls v1.11.6 — **SDP zip-bomb DoS fix** | | `8a56d5a6f` | MM-68773 — HTML encoding in proxied image URL | | `50ab3983c` | MM-69392 — DCR redirect URI allowlist matching made URL-component aware | | `96bfd7e57` | MM-69408 — quadratic markdown autolink trimming (ReDoS) | | `f52a22d0c` | MM-69857 — policy update endpoint keeps team scope system-managed | | `7acc6ce19` | team-scope channel check on access policy unassign | Zero of these were classified. ## Why it matters That section is what gets read to decide "is this urgent or can it wait?". Reporting an empty security section for a batch that is *mostly* security actively argues for deferring the merge. This batch sat unmerged for roughly five weeks. ## Root cause (suspected) The heuristic almost certainly greps for words like `security`, `CVE`, `vulnerability`, or `XSS` in the commit subject. Mattermost does not write subjects that way — security fixes ship as plain `MM-xxxxx` ticket references with neutral wording, often as cherry-picks, and the DoS fix above is disguised as a routine plugin version bump. ## Suggested fix Subject-line keyword matching cannot work against this upstream. Options, roughly in order of value: 1. Cross-reference the Mattermost security advisories / release notes for the version range rather than inferring from subjects. 2. Treat **all** prepackaged-plugin bumps as "review required" — the Calls bump was the most serious item in the batch and looks the most routine. 3. Flag on touched paths as a secondary signal (`server/channels/api4/`, auth/permission/policy code, markdown/rendering). 4. If none of that is practical, **remove the section entirely**. An empty security heading is worse than no heading — it reads as an assurance the tool cannot actually make.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
slash/main
upstream/main
upstream/v11.7-esr
main
sysbot-avatar-scratch
latest-server
latest
v11.7.0-slash.1
v11.7.2
v11.7.1
v11.7.0
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
slash/slash-server#24
No description provided.