[GH-ISSUE #140] BinarySession investigationWorkspace APIs expose mutable internal workspaces #87

New issue

Closed

opened 2026-10-15 18:20:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:20:59 +00:00

Owner

Originally created by @morluto on GitHub (Jul 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/140

Problem

BinarySession stores investigation workspace snapshots in #investigationWorkspaces but returns them by reference from:

investigationWorkspace() (src/application/BinarySession.ts:222)
investigationWorkspaces() (src/application/BinarySession.ts:232)

Callers can mutate returned objects and silently corrupt session-retained workspace state.

Reproduction

import { BinarySession } from "./dist/application/BinarySession.js";
import { createInvestigationWorkspace } from "./dist/domain/investigationWorkspace.js";
import { createEvidenceBundle } from "./dist/domain/evidenceBundle.js";

const session = new BinarySession(() => ({
  identity: () => ({ id: "x", name: "x", version: null }),
  capabilities: () => [],
}));

const ws = createInvestigationWorkspace("demo", createEvidenceBundle([]), []);
session.retainInvestigationWorkspace(ws);

const direct = session.investigationWorkspace(ws.workspace_id, 1);
direct!.revision = 999;
console.log(session.investigationWorkspace(ws.workspace_id, 1)?.revision);
console.log(session.investigationWorkspace(ws.workspace_id, 999));

const list = session.investigationWorkspaces();
list[0].workspace_id = "ws_deadbeef";
console.log(session.investigationWorkspace("ws_deadbeef", 999));

Observed output:

session.investigationWorkspace(ws_id, 1)?.revision prints 999
session.investigationWorkspace(ws_id, 999) now returns object instead of undefined
session.investigationWorkspace("ws_deadbeef", 999) can return an inconsistent result due mutated key state

Expected

These APIs should return detached copies so consumers cannot mutate session-owned objects.

Actual

Mutating returned workspace objects changes internal map keys/values (revision + workspace id) and makes investigationWorkspace(...) lookups incorrect.

Impact

Malicious or buggy caller code can forge/poison session workspaces without authorization, which can break resource routing and artifact/evidence retrieval paths that depend on workspace identity.

Originally created by @morluto on GitHub (Jul 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/140 ### Problem `BinarySession` stores investigation workspace snapshots in `#investigationWorkspaces` but returns them by reference from: - `investigationWorkspace()` (`src/application/BinarySession.ts:222`) - `investigationWorkspaces()` (`src/application/BinarySession.ts:232`) Callers can mutate returned objects and silently corrupt session-retained workspace state. ### Reproduction ```ts import { BinarySession } from "./dist/application/BinarySession.js"; import { createInvestigationWorkspace } from "./dist/domain/investigationWorkspace.js"; import { createEvidenceBundle } from "./dist/domain/evidenceBundle.js"; const session = new BinarySession(() => ({ identity: () => ({ id: "x", name: "x", version: null }), capabilities: () => [], })); const ws = createInvestigationWorkspace("demo", createEvidenceBundle([]), []); session.retainInvestigationWorkspace(ws); const direct = session.investigationWorkspace(ws.workspace_id, 1); direct!.revision = 999; console.log(session.investigationWorkspace(ws.workspace_id, 1)?.revision); console.log(session.investigationWorkspace(ws.workspace_id, 999)); const list = session.investigationWorkspaces(); list[0].workspace_id = "ws_deadbeef"; console.log(session.investigationWorkspace("ws_deadbeef", 999)); ``` Observed output: - `session.investigationWorkspace(ws_id, 1)?.revision` prints `999` - `session.investigationWorkspace(ws_id, 999)` now returns object instead of `undefined` - `session.investigationWorkspace("ws_deadbeef", 999)` can return an inconsistent result due mutated key state ### Expected These APIs should return detached copies so consumers cannot mutate session-owned objects. ### Actual Mutating returned workspace objects changes internal map keys/values (revision + workspace id) and makes `investigationWorkspace(...)` lookups incorrect. ### Impact Malicious or buggy caller code can forge/poison session workspaces without authorization, which can break resource routing and artifact/evidence retrieval paths that depend on workspace identity.

bsakaguchi

2026-10-15 18:20:59 +00:00