admin343/browser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Tighten opaque plugin content boundaries

Browse Source
This commit is contained in:
npc0-hue
2026-09-03 18:24:39 +08:00
parent 80cddbf19d
commit 14cbc63e61
31 changed files with 452 additions and 558 deletions
Download Patch File Download Diff File Expand all files Collapse all files
platform/validator/rules.md
+2 -2
View File
@@ -2,7 +2,7 @@
- API handlers must use named DTOs from `platform/dto`.
- Platform services must not accept raw plugin-provided host paths.
- AI provider secrets must be stored by reference and redacted from logs and plugin bridge responses.
- AI provider secrets must be stored by reference and hidden from platform diagnostics and plugin bridge responses.
- Game management plugin installation must validate manifest identity, server type, required run capabilities, pages, permissions, and schema references.
- Server instance creation must validate plugin installation state and run endpoint capability compatibility.
- `platform/validator/resources.go` validates required IDs, enum values, AI key-reference shape, bounded progress summaries, artifact metadata, log stream cursors, and run capability compatibility.
@@ -10,4 +10,4 @@
- Job creation must require an idempotency key and return the existing job for duplicate `(runEndpointId, idempotencyKey)` pairs.
# Runtime and bridge validation
Runtime validation rejects undeclared operations, stale attempt/key generations, cross-owner/server/target artifacts, unavailable endpoints, raw secrets, endpoint/socket values, traversal or absolute executable references, shell metacharacters, and unbounded timeouts. Game-client bridge validation rejects legacy companion declarations and keeps operator-facing DTOs redacted before they cross the Platform boundary.
Runtime validation rejects undeclared operations, stale attempt/key generations, cross-owner/server/target artifacts, unavailable endpoints, raw secrets, endpoint/socket values, traversal or absolute executable references, shell metacharacters, and unbounded timeouts. Game-client bridge validation keeps operator-facing transport metadata bounded before it crosses the Platform boundary; plugin-owned request text, result payloads, records, and log bodies remain opaque.