Close bounded path and format review gaps

Reject symlinked parents, scan raw Git path bytes safely, and cover PGP headers plus serialized Windows home paths without expanding the audit architecture.

Author: VladimirBrejcha

public-source-release-audit/SKILL.md

@@ -33,7 +33,9 @@ Stage all intended release changes before relying on the candidate result.
 Ignored files and submodule contents are outside this check. The checker does
 not inspect Git history. Git LFS pointers fail the check because their external
 objects require separate review. Missing index blobs, including unavailable
-partial-clone objects, fail without network fetching.
+partial-clone objects, fail without network fetching. A symlink's own target
+text is scanned, while a symlinked parent component fails without reading
+outside the repository.
 
 ## Semantic Review
 

public-source-release-audit/scripts/check_current_source.rb

@@ -7,7 +7,7 @@
 RULES = [
   [
     "machine-local home path",
-    %r{(?:\A|[\s"'`=:(,])(?:/(?:Users|home)/[A-Za-z0-9._-]+(?:/|\b)|/root(?:/|(?![A-Za-z0-9._-])))|\b[A-Za-z]:[\\/]Users[\\/][^\\/\r\n]+(?:[\\/]|$)}
+    %r{(?:\A|[\s"'`=:(,])(?:/(?:Users|home)/[A-Za-z0-9._-]+(?:/|\b)|/root(?:/|(?![A-Za-z0-9._-])))|\b[A-Za-z]:[\\/]{1,2}Users[\\/]{1,2}[^\\/\r\n]+(?:[\\/]{1,2}|$)}
   ],
   ["AWS access key", /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],
   ["bearer credential", /Authorization\s*:\s*Bearer\s+[A-Za-z0-9._~+\/=:-]{16,}/i],
@@ -18,7 +18,7 @@
   ["OpenAI API key", /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/],
   [
     "private key",
-    /-----BEGIN (?:[A-Z0-9][A-Z0-9 ]* )?PRIVATE KEY-----/
+    /-----BEGIN (?:[A-Z0-9][A-Z0-9 ]* )?PRIVATE KEY(?: BLOCK)?-----/
   ]
 ].freeze
 
@@ -70,6 +70,14 @@ def display_path(relative_path, sensitive_paths)
   sensitive_paths.include?(relative_path) ? "<redacted path>" : relative_path.dump
 end
 
+def symlinked_parent?(repo, relative_path)
+  current = repo.b
+  relative_path.b.split("/".b)[0...-1].any? do |component|
+    current = File.join(current, component)
+    File.symlink?(current)
+  end
+end
+
 usage("Too many arguments") if ARGV.length > 1
 repo = File.expand_path(ARGV.first || ".")
 usage("Repository must be a directory") unless File.directory?(repo)
@@ -86,9 +94,9 @@ def display_path(relative_path, sensitive_paths)
 findings = Set.new
 sensitive_paths = Set.new
 blob_result_cache = {}
-index_entries = index_output.split("\0").reject(&:empty?).filter_map do |record|
-  metadata, relative_path = record.split("\t", 2)
-  mode, object_id, stage = metadata&.split(" ", 3)
+index_entries = index_output.b.split("\0".b).reject(&:empty?).filter_map do |record|
+  metadata, relative_path = record.split("\t".b, 2)
+  mode, object_id, stage = metadata&.split(" ".b, 3)
   unless mode && object_id && stage && relative_path
     errors.add([relative_path || "<unknown>", "unreadable Git index entry"])
     next
@@ -146,11 +154,15 @@ def display_path(relative_path, sensitive_paths)
 )
 usage("Unable to enumerate repository worktree source") unless worktree_status.success?
 
-worktree_paths = worktree_output.split("\0").reject(&:empty?).uniq
+worktree_paths = worktree_output.b.split("\0".b).reject(&:empty?).uniq
 worktree_paths.each do |relative_path|
-  absolute_path = File.join(repo, relative_path)
   scan_source(relative_path, relative_path, findings, sensitive_paths)
   begin
+    if symlinked_parent?(repo, relative_path)
+      errors.add([relative_path, "symlinked parent component"])
+      next
+    end
+    absolute_path = File.join(repo.b, relative_path)
     content = if File.symlink?(absolute_path)
       File.readlink(absolute_path)
     elsif File.file?(absolute_path)
@@ -164,10 +176,10 @@ def display_path(relative_path, sensitive_paths)
 
 unless errors.empty? && findings.empty?
   warn "current public-source check failed:"
-  errors.to_a.sort.each do |relative_path, label|
+  errors.to_a.sort_by { |relative_path, label| [relative_path.b, label] }.each do |relative_path, label|
     warn "- #{display_path(relative_path, sensitive_paths)}: #{label}"
   end
-  findings.to_a.sort.each do |relative_path, label|
+  findings.to_a.sort_by { |relative_path, label| [relative_path.b, label] }.each do |relative_path, label|
     warn "- #{display_path(relative_path, sensitive_paths)}: #{label}"
   end
   warn "Matched content is intentionally omitted." unless findings.empty?

public-source-release-audit/tests/test_check_current_source.rb

@@ -122,9 +122,19 @@ def test_supported_high_confidence_formats_are_detected_and_redacted
         "fine-grained.txt" => "github_" + "pat_" + ("C" * 24),
         "openai.txt" => "s" + "k-proj-" + ("D" * 24),
         "private-key.txt" => "-----BEGIN " + "OPENSSH PRIVATE KEY-----",
+        "pgp-private-key.txt" => "-----BEGIN " + "PGP PRIVATE KEY BLOCK-----",
         "posix-home.txt" => "/" + "Users/example/private.txt",
         "root-home.txt" => "/" + "root/.ssh/id_ed25519",
-        "windows-home.txt" => "C:" + "\\Users\\example\\private.txt"
+        "windows-home.txt" => "C:" + "\\Users\\example\\private.txt",
+        "escaped-windows-home.txt" => [
+          "C:",
+          "\\" * 2,
+          "Users",
+          "\\" * 2,
+          "example",
+          "\\" * 2,
+          "private.txt"
+        ].join
       }
       fixtures.each { |path, content| stage(repo, path, content) }
 
@@ -161,6 +171,27 @@ def test_symlink_target_is_scanned_without_following_it
     end
   end
 
+  def test_symlinked_parent_is_rejected_without_reading_outside_repo
+    with_repo do |repo|
+      stage(repo, "dir/file.txt", "safe candidate\n")
+      FileUtils.mv(File.join(repo, "dir"), File.join(repo, "original-dir"))
+
+      Dir.mktmpdir("public-source-check-outside-") do |outside|
+        token = github_token
+        write(outside, "file.txt", token)
+        File.symlink(outside, File.join(repo, "dir"))
+
+        _stdout, stderr, status = run_checker(repo)
+
+        refute status.success?
+        assert_includes stderr, "dir/file.txt"
+        assert_includes stderr, "symlinked parent component"
+        refute_includes stderr, "GitHub token"
+        refute_includes stderr, token
+      end
+    end
+  end
+
   def test_ignored_local_files_are_outside_the_release_candidate
     with_repo do |repo|
       stage(repo, ".gitignore", "ignored.txt\n")
@@ -235,6 +266,41 @@ def test_git_commands_disable_lazy_object_fetching
     end
   end
 
+  def test_non_utf8_git_paths_are_scanned_without_crashing
+    with_repo do |repo|
+      token = github_token
+      Dir.mktmpdir("public-source-check-bin-") do |bin_dir|
+        fake_git = File.join(bin_dir, "git")
+        File.write(fake_git, <<~'RUBY')
+          #!/usr/bin/env ruby
+          STDOUT.binmode
+          path = "raw-\xFF.txt".b
+          if ARGV.include?("--stage")
+            STDOUT.write("100644 #{'a' * 40} 0\t".b + path + "\0".b)
+          elsif ARGV.include?("cat-file")
+            STDOUT.write("gh" + "p_" + ("A" * 24))
+          elsif ARGV.include?("-co")
+            STDOUT.write(path + "\0".b)
+          else
+            abort "unexpected git invocation: #{ARGV.join(' ')}"
+          end
+        RUBY
+        FileUtils.chmod(0o755, fake_git)
+
+        _stdout, stderr, status = run_checker(
+          repo,
+          { "PATH" => [bin_dir, ENV.fetch("PATH")].join(File::PATH_SEPARATOR) }
+        )
+
+        refute status.success?
+        assert_includes stderr, "GitHub token"
+        assert_includes stderr, "\\xFF"
+        refute_includes stderr, "invalid byte sequence"
+        refute_includes stderr, token
+      end
+    end
+  end
+
   def test_git_lfs_pointer_requires_separate_review
     with_repo do |repo|
       pointer = [