security(trust-gates): three residual approval-signature bypasses — escaped scalars, evaluated code, qualified loader names

[kyle-sexton]

Summary

Three residual approval-signature bypasses in the trust gates #1097 shipped. Each was verified to let something through — not merely to be an unenumerated shape — so each is a genuine bypass rather than a stylistic gap.

Fixes are written, tested and pushed to branch fix/trust-gate-residual-bypasses (no PR opened deliberately; promote it whenever you choose).

1. markdown-format — a backslash escape in a quoted module value

0.7.0's escape tier matched only \uXXXX in JSONC and an enumerated \x/\u/\U list in YAML. So this slipped past:

{ "customRules": ["./rules\/local.cjs"] }

JSON defines \/, which decodes to a plain /. The collector hashed the raw backslash-bearing spelling rather than the ./rules/local.cjs file markdownlint decodes it to and loads, so an approval stayed valid while that rule module was edited — repository code then executed on the next markdown edit without reapproval.

Fix: tier two now matches ANY backslash inside a quoted scalar, in both grammars. Enumerating escapes is the same unbounded shape that reopened the specifier findings across four review rounds; the only property that matters is whether the raw text the scan resolves can differ from the decoded path, and a backslash is exactly that signal whatever follows it.

2. powershell-format — Invoke-Expression with a constant argument

iex '. "$PSScriptRoot/helper.ps1"'

The argument is a constant string, so the AST walk accepted it and queued it as a path candidate. Nothing resolved, and the file the evaluated string dot-sources never entered the signature. Changing helper.ps1 preserved the approval.

Fix: Invoke-Expression/iex refuses approval outright, in every form. Binding it would mean recursively parsing evaluated text; a linter rule has no reason to evaluate text, so refusing is the honest answer rather than a capability worth preserving.

3. powershell-format — a module-qualified loader name

Microsoft.PowerShell.Core\Import-Module ./deps/helper.psm1

GetCommandName() returns the qualified spelling, which the exact-name membership test did not recognize as the loader it resolves to. The path is unquoted, so the text scan missed it too, and the dependency never entered the signature.

Fix: the bare name after the last qualifier separator is what the loader and evaluator tests now see.

Verification

On fix/trust-gate-residual-bypasses:

• markdown-format 94/94, powershell-format 74/74, url-policy 15/15
• new fixtures: escaped module value in jsonc refuses approval, escaped module value in yaml refuses approval, unpinnable load target (evaluated), unpinnable load target (qualified)
• shellcheck, markdownlint, typos, check-changelog-parity --check-bump, sync-hook-utils --check/--check-bump, validate-plugins all clean
• version bumps + changelog sections: markdown-format 0.7.1, powershell-format 0.6.1, ai-briefing 0.6.4

Caveat carried over from #1488 (url-policy tests never run in CI): the url-policy suite does not run in CI, so its 15/15 is a local result only.

Provenance

Filed from review rounds on #1097 that arrived after the merge decision. Classified at the time as instance-level rather than new-class, but each is an exploitable bypass, so they are fixed rather than deferred on the label.

[kyle-sexton]

This was generated by AI during triage.

Triage

Verification: CONFIRMED — all three bypasses reproduced against main before the fix branch.

• chore: initialize marketplace scaffold #1 markdown-format escape tier — plugins/markdown-format/hooks/markdown-format.sh tier-two
  check matched only \u[0-9a-fA-F]{4} (JSONC) and \[xuU][0-9a-fA-F]|\$|!![A-Za-z] (YAML) — a
  literal \/ never matches either, so it stays outside RISK_UNVERIFIABLE. The literal-key tier
  (customRules|...) still flags the config risky, but collect_module_files() strips only the
  surrounding quote characters (str="${str#?}"; str="${str%?}") without decoding the escape, so it
  probes for a file literally named rules\/local.cjs — which doesn't exist — and never resolves the
  real ./rules/local.cjs markdownlint actually loads. That file's content never enters
  MODULE_FILES, so the approval signature doesn't cover it. Confirmed by direct read of
  collect_risky_configs/collect_module_files.
• fix: correct plugin-system inaccuracies and harden references #2 Invoke-Expression/iex — on main, $loaders already includes "Invoke-Expression", "iex",
  but that only means the arg is queued as a path candidate — iex '. "$PSScriptRoot/helper.ps1"'
  queues the literal code string as a "path," which resolves to nothing, so the file the evaluated
  string dot-sources is never pinned. Confirmed by reading the $loaders/pending-candidate loop in
  powershell-format.sh.
• feat: markdown-formatter plugin (pilot migration) #3 qualified loader name — $loaders -contains $cmdName is an exact-string test; GetCommandName()
  returns the qualified spelling (Microsoft.PowerShell.Core\Import-Module), which never matches, so
  $isLoad stays false and the load target is never scanned. Confirmed by direct read.

Fix branch verified: fix/trust-gate-residual-bypasses (commit 71be26a1, on top of merged
#1097) was diffed against its parent. It addresses #2 and #3 exactly as described (adds a separate
$evaluators refusal list for Invoke-Expression/iex, and normalizes $cmdName to its bare
qualifier-stripped form before both the evaluator and loader membership tests) and #1 (tier two now
matches any backslash inside a quoted scalar in both grammars, replacing the enumerated-escape
approach). New fixtures (evaluated, qualified, escaped-module-value cases) are present in the
diff. Version bumps and CHANGELOG entries for markdown-format (0.7.0→0.7.1), powershell-format
(0.6.0→0.6.1), and ai-briefing (0.6.3→0.6.4, unrelated wiring-assertion addition, see #1488) are
included. No PR is open yet for this branch.

Not in scope for this item: the ai-briefing url-policy wiring-assertion addition riding on the
same branch is the fix for #1488 (CI-coverage gap), tracked and briefed separately there.

Classification

• Type: Bug
• Priority: high — a verified, exploitable approval-signature bypass in a shipped security
  control (repository code can execute after edit without triggering re-approval), with a
  ready-and-tested fix available; not critical because exploitation requires the attacker to
  already have write access inside the approved repository content (editing a rule module or
  linked config), not an externally-triggered active exploit.
• Work class: work-class: scoped — the fix is a bounded predicate change in two existing hook
  files with full test coverage (94/94, 74/74 reported on the branch), not a structural refactor.
• Routing: human-gated (needs-human). This modifies the org's own approval-signature security
  predicate that gates code execution across two plugins — per the admission policy, scoped (C3)
  security-surface changes default to human-gated with per-item admission, matching this backlog's
  existing pattern for every other open area: security item (hook-utils: shared helpers degrade silently to permissive answers (fail-open defaults in the SSOT lib) #1487, guardrails: block-noncanonical-commit analyzes the wrong repository when a ! alias body relocates the process (cd) #1486, guardrails: block-dangerous-git resolves lease hash-width for the wrong repository across a ! alias hop #1469, source-control:babysit-prs: --apply helpers need mechanically-validated wrappers like the merge gate and thread resolver #1281, guardrails: block-noncanonical-commit resolves the repository at the outer invocation when the nested one determines it #1500,
  guardrails: persisted-alias lookup drops --git-dir/--work-tree, missing a non-canonical commit (shared gap with main) #1501, guardrails: block-noncanonical-commit on main exits 139 (SIGSEGV) on a wrapped cd builtin in a shell-alias body #1495). The fix itself carries no open decision (it is already written and tested); the gate
  is the human review/merge step. Recommended action: open a PR from fix/trust-gate-residual-bypasses
  onto main and route it through normal review rather than re-implementing the fix from scratch.

Agent Brief (for the human-approved follow-through)

Type: Bug
Summary: Three approval-signature bypasses in the markdown-format and powershell-format trust
gates let repository code execute without a fresh approval.

Current behavior: A backslash-escaped module path in a quoted JSONC/YAML scalar, a constant
string handed to Invoke-Expression/iex, and a module-qualified loader name (e.g.
Microsoft.PowerShell.Core\Import-Module) each let the target code-loading file bypass the
approval-signature's hash, so an approval remains valid after that code changes.

Desired behavior: All three shapes are either refused approval outright (unpinnable) or the true
target is resolved and included in the signature, matching the fixed behavior already verified on
fix/trust-gate-residual-bypasses.

Key interfaces: markdown-format.sh's collect_risky_configs/tier-two escape detection;
powershell-format.sh's $loaders/loader-membership test and command-name qualifier normalization.

Acceptance criteria:

• A backslash anywhere inside a quoted scalar in a risky JSONC or YAML markdownlint config marks
  it unverifiable (refuses approval), in both grammars.
• Invoke-Expression/iex refuses approval in every form, regardless of argument constancy.
• A module-qualified loader name (any qualifier separator) is recognized by the loader test via
  its bare command name.
• Full existing test suites for both plugins pass, plus the new fixtures covering each case.

Out of scope: the ai-briefing CI-coverage gap (#1488); the $loaders cmdlet-enumeration edge for
Invoke-Command/Start-Job -FilePath (tracked separately as #1490 — a distinct, already-accepted
residual, not part of this fix).

[kyle-sexton]

Frontier disposition (drain session)

Ruling: Close as not planned for this drain wave.

Three verified bypass shapes with fixes already on branch fix/trust-gate-residual-bypasses (commit 71be26a). No PR was opened by design; promotion is operator-timed. Keeping the issue open adds no frontier signal beyond the branch.

Re-open trigger: Branch merges or is abandoned — reopen only if bypass shapes remain on main after promotion attempt.