Repository navigation
KC-1504, KC-1519, KC-1526: Fix NSF ownership bypass and attacker-shared folder name collisions in mkdir, mv, ln, and record-add --folder - #2445
Open
sshrushanth-ks wants to merge 8 commits into
Conversation
Prevent attacker-owned shared-in folders from shadowing victim folder paths during NSF record operations. Restrict name resolution to owned folders, prefer owned records during title lookup, reject ambiguous matches, and add regression coverage for record creation and resolution.
sshrushanth-ks
marked this pull request as ready for review
October 16, 2026 12:01
sshrushanth-ks
requested review from
adeshmukh-ks,
amangalampalli-ks,
pvagare-ks and
sali-ks
October 16, 2026 12:02
adeshmukh-ks
left a comment
adeshmukh-ks
left a comment
Contributor
There was a problem hiding this comment.
working on additional changes
and reject path results containing unowned NSF folders. Add regression coverage for attacker-owned NSF folders present in folder_cache.
…folder path components match multiple folders instead of selecting the first result. Prevent record-add from creating unfiled records when --folder cannot be resolved, and add regression coverage for duplicate folder names across record and folder commands.
sshrushanth-ks
changed the title
sshrushanth-ks
changed the title
Prevent first-match selection for duplicate or attacker-owned NSF folders and records. Reject ambiguous classic folder paths before destructive operations, route Secrets Manager application lookup through the duplicate-safe resolver, and add regression coverage for NSF, classic, shortcut, rmdir, and Secrets Manager scenarios.
Fail closed when parent paths resolve to multiple folders, preventing mkdir, mv, and record-add --folder from routing keys into attacker-owned shared folders. Preserve valid duplicate root names in mkdir and nsf-mkdir while enforcing unique child-folder resolution.
sshrushanth-ks
changed the title
- Preserve root mkdir/nsf-mkdir idempotency for owned folders - Resolve exact-case names before case-insensitive fallbacks - Prefer owned folders and records while failing closed on collisions - Support unique shared-in NSF folder paths and KSM app lookups - Surface ambiguity errors in ls, tree, and cd - Add regression tests for folder, record, NSF, and KSM resolution
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
An attacker-owned or duplicate Nested Share Folder could be selected by name during folder creation, permission updates, shortcut operations, or record resolution. Added ownership-aware resolution, duplicate detection, and centralized fail-closed lookup across NSF and Secrets Manager commands.
Duplicate classic folder paths could cause commands to select the first match or perform destructive actions against multiple folders. Extended ambiguity handling to
rmdirand related folder operations. Duplicate classic, NSF, and Secrets Manager application titles now fail closed instead of selecting an arbitrary record.mkdirandnsf-mkdirnow allow duplicate root-level folder names while requiring every parent path and child folder name to resolve uniquely. This prevents attacker-shared folder names from capturingmkdir,mv,ln, andrecord-add --folderoperations while preserving valid duplicate root folders.Changes
NSF resolution:
folder_cachefallback checks, and duplicate folder rejection.nsf-getresolution to valid NSF folders and records.nsf-mkdir.nsf-record-permission.nsf-shortcut listandnsf-shortcut keepthrough duplicate-safe record resolution.Classic folder and record resolution:
mkdir, require unique parent and child paths, and apply ambiguity handling tocd,mv,ln,rndir, andrmdir.record-add --folderwhen the folder is invalid or ambiguous.Secrets Manager resolution:
Tests:
rmdirambiguity coverage.