[GH-ISSUE #139] NativeDmgArtifactReader.provenance() returns mutable internal provenance list #85

New issue

Closed

opened 2026-10-15 18:20:58 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:20:58 +00:00

Owner

Originally created by @morluto on GitHub (Jul 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/139

Problem

NativeDmgArtifactReader.provenance() exposes internal provenance array directly. External mutation can alter the stored provenance list used by evidence consumers.

Reproduction

import { NativeDmgArtifactReader } from "./dist/artifacts/NativeDmgArtifactReader.js";

Object.defineProperty(process, "platform", { value: "darwin" });

const host = {
  async run(arguments_) {
    if (arguments_[0] === "verify") return { stdout: "", exitCode: 0 };
    if (arguments_[0] === "attach") {
      const mountRoot = arguments_[arguments_.indexOf("-mountroot") + 1];
      return {
        stdout: `<?xml version="1.0"?><plist><dict><key>system-entities</key><array><dict><key>dev-entry</key><string>/dev/diskX</string><key>mount-point</key><string>${mountRoot}/X</string></dict></array></dict></plist>`,
        exitCode: 0,
      };
    }
    return { stdout: "", exitCode: 0 };
  },
};

const reader = await NativeDmgArtifactReader.create("/tmp/example.dmg", undefined, host);
const provenance = reader.provenance();
provenance.push({ tool: "/tmp/evil", arguments: ["spoof"], tool_version: null, executable_sha256: null, exit_code: 0, effects: ["read"] });

await reader.close();
console.log(reader.provenance());

Impact

Provenance can be forged by any API caller, undermining DMG evidence integrity and any policy checks that depend on command history.

Expected behavior

provenance() should return a detached copy of provenance entries.

Originally created by @morluto on GitHub (Jul 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/139 ## Problem `NativeDmgArtifactReader.provenance()` exposes internal provenance array directly. External mutation can alter the stored provenance list used by evidence consumers. ## Reproduction ```ts import { NativeDmgArtifactReader } from "./dist/artifacts/NativeDmgArtifactReader.js"; Object.defineProperty(process, "platform", { value: "darwin" }); const host = { async run(arguments_) { if (arguments_[0] === "verify") return { stdout: "", exitCode: 0 }; if (arguments_[0] === "attach") { const mountRoot = arguments_[arguments_.indexOf("-mountroot") + 1]; return { stdout: `<?xml version="1.0"?><plist><dict><key>system-entities</key><array><dict><key>dev-entry</key><string>/dev/diskX</string><key>mount-point</key><string>${mountRoot}/X</string></dict></array></dict></plist>`, exitCode: 0, }; } return { stdout: "", exitCode: 0 }; }, }; const reader = await NativeDmgArtifactReader.create("/tmp/example.dmg", undefined, host); const provenance = reader.provenance(); provenance.push({ tool: "/tmp/evil", arguments: ["spoof"], tool_version: null, executable_sha256: null, exit_code: 0, effects: ["read"] }); await reader.close(); console.log(reader.provenance()); ``` ## Impact Provenance can be forged by any API caller, undermining DMG evidence integrity and any policy checks that depend on command history. ## Expected behavior `provenance()` should return a detached copy of provenance entries.

bsakaguchi

2026-10-15 18:20:58 +00:00