JoannaaKL
fb7cbc8b85
* Annotate read tools with ifc labels * Dont automatically enable IFCLabels in insiders mode * ifc: don't label unpublished repo advisories as public Repository security advisory listings can include draft/triage/closed advisories (via the state filter), which are not world-readable even on a public repository. Deriving confidentiality from repo visibility alone under-classified those results as public. LabelRepositorySecurityAdvisory now takes an allPublished flag and only returns a public label when the repo is public AND every returned advisory is published; otherwise it is private. list_repository_security_advisories computes allPublished from the response state; the org-wide listing stays private-untrusted. Adds unit + handler regression tests covering the draft-advisory-on-public-repo case. Addresses PR review feedback. * ifc: fix confidentiality under-classification in releases, collaborators, get_me Audit for the same bug class as the repo-advisory fix (confidentiality derived from a coarse signal that misses access-restricted items) found three more under-classifications: - Releases (list_releases, get_latest_release, get_release_by_tag): draft releases are visible only to push-access users and are not world-readable even on a public repo. New LabelRelease(isPrivate, hasDraft) returns public only for a non-draft release on a public repo; handlers compute hasDraft from the response (Draft flag / per-item scan). - list_repository_collaborators: a collaborator roster requires push access to list, so it is never world-readable, not even on a public repo. New LabelCollaboratorRoster() is always PrivateTrusted (mirrors LabelTeam), replacing the repo-visibility-derived label. - get_me: the result includes private_gists / total_private_repos / owned_private_repos, which are not part of the public profile. LabelGetMe is now PrivateTrusted instead of PublicTrusted. Verified the remaining public-capable labels are sound: Actions logs are world-readable on public repos; branches/tags are public metadata; gist, project, search, and starred-repo labels read per-item visibility and join. Adds ifc unit tests for the new/changed labels and a get_release_by_tag handler regression test (draft on public repo -> private); updates the get_me handler test to assert private. * ifc: document why list results use one joined label, not per-item Explain on LabelSearchIssues (and cross-ref from LabelGistList) that a tool result is delivered as one opaque payload and the IFC engine makes one allow/deny decision per flow at egress, so the only sound bound for a list is the meet of every item's label. Per-item labels would only be load-bearing if the engine could partition a result and route items to different sinks; until then they would invite unsafe declassification of a public item that arrived alongside private data. Doc-only change.
76 lines
2.9 KiB
Go
76 lines
2.9 KiB
Go
package github
|
|
|
|
import "slices"
|
|
|
|
// MCPAppsFeatureFlag is the feature flag name for MCP Apps (interactive UI forms).
|
|
const MCPAppsFeatureFlag = "remote_mcp_ui_apps"
|
|
|
|
// FeatureFlagCSVOutput is the feature flag name for CSV output on list tools.
|
|
const FeatureFlagCSVOutput = "csv_output"
|
|
|
|
// FeatureFlagIFCLabels is the feature flag name for IFC security labels in tool results.
|
|
const FeatureFlagIFCLabels = "ifc_labels"
|
|
|
|
// FeatureFlagIssueFields is the feature flag name for Issues 2.0 custom field
|
|
// support: the list_issue_fields tool, the field_filters input on list_issues,
|
|
// and field_values enrichment in list_issues / search_issues output.
|
|
const FeatureFlagIssueFields = "remote_mcp_issue_fields"
|
|
|
|
// AllowedFeatureFlags is the allowlist of feature flags that can be enabled
|
|
// by users via --features CLI flag or X-MCP-Features HTTP header.
|
|
// Only flags in this list are accepted; unknown flags are silently ignored.
|
|
// This is the single source of truth for which flags are user-controllable.
|
|
var AllowedFeatureFlags = []string{
|
|
MCPAppsFeatureFlag,
|
|
FeatureFlagCSVOutput,
|
|
FeatureFlagIFCLabels,
|
|
FeatureFlagIssueFields,
|
|
FeatureFlagIssuesGranular,
|
|
FeatureFlagPullRequestsGranular,
|
|
}
|
|
|
|
// InsidersFeatureFlags is the list of feature flags that insiders mode enables.
|
|
// When insiders mode is active, all flags in this list are treated as enabled.
|
|
// This is the single source of truth for what "insiders" means in terms of
|
|
// feature flag expansion.
|
|
var InsidersFeatureFlags = []string{
|
|
MCPAppsFeatureFlag,
|
|
FeatureFlagCSVOutput,
|
|
FeatureFlagIssueFields,
|
|
}
|
|
|
|
// FeatureFlags defines runtime feature toggles that adjust tool behavior.
|
|
type FeatureFlags struct {
|
|
LockdownMode bool
|
|
}
|
|
|
|
// ResolveFeatureFlags computes the effective set of enabled feature flags by:
|
|
// 1. Taking the user-supplied flags (from --features or X-MCP-Features) and
|
|
// keeping only those present in AllowedFeatureFlags. Unknown or unsafe
|
|
// flags from request input are silently dropped here.
|
|
// 2. If insiders mode is on, unioning in every flag from InsidersFeatureFlags.
|
|
// Insiders is a server-controlled meta switch, so its expansion is NOT
|
|
// re-validated against AllowedFeatureFlags.
|
|
//
|
|
// AllowedFeatureFlags and InsidersFeatureFlags are independent sets:
|
|
// - A flag in AllowedFeatureFlags but not InsidersFeatureFlags is a regular
|
|
// opt-in flag that insiders mode does not turn on automatically.
|
|
// - A flag in InsidersFeatureFlags but not AllowedFeatureFlags is reachable
|
|
// only through insiders mode and cannot be enabled by user input.
|
|
//
|
|
// Returns a set (map) for O(1) lookup by the feature checker.
|
|
func ResolveFeatureFlags(enabledFeatures []string, insidersMode bool) map[string]bool {
|
|
effective := make(map[string]bool)
|
|
for _, f := range enabledFeatures {
|
|
if slices.Contains(AllowedFeatureFlags, f) {
|
|
effective[f] = true
|
|
}
|
|
}
|
|
if insidersMode {
|
|
for _, f := range InsidersFeatureFlags {
|
|
effective[f] = true
|
|
}
|
|
}
|
|
return effective
|
|
}
|