From 0b31a5dcdfeebcc5ba8b64efa4debe5f470f788b Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Wed, 29 Jul 2026 10:38:18 +0200 Subject: [PATCH] fix(security): declare the printed install-script URL on the allow-list The `update` handoff prints a curl one-liner when install.sh is not beside the binary, and the security audit blocked the release on it: BLOCKED: src/cli/cli.c: URL not on allow-list: https://raw.githubusercontent.com/DeusData/ Two things were wrong. The URL was not declared, and it was split across string literal continuations, so the audit extracted only the first fragment -- an allow-list entry for the real URL could never have matched it. Hoisted to a single CBM_INSTALL_SH_URL token so the declaration means what it says. It is the same URL as the documented one-liner install, and it is printed for the user to paste: the binary no longer downloads anything. Signed-off-by: Martin Vogel --- scripts/security-allowlist.txt | 1 + src/cli/cli.c | 9 +++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/scripts/security-allowlist.txt b/scripts/security-allowlist.txt index efe9b37f8..6c7fea9ca 100644 --- a/scripts/security-allowlist.txt +++ b/scripts/security-allowlist.txt @@ -66,6 +66,7 @@ src/ui/http_server.c:execl:exec indexing binary in child process URL:https://api.github.com/repos/DeusData/codebase-memory-mcp/releases/latest:update check URL:https://github.com/DeusData/codebase-memory-mcp/releases/latest/download:binary download + checksums URL:https://github.com/DeusData/codebase-memory-mcp/releases/latest:version check via redirect header +URL:https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh:printed by `update` as the install-script command when install.sh is not beside the binary (a string in the message, not a network call - the binary no longer downloads anything) URL:http://127.0.0.1:UI server binding (localhost only) URL:https://www.sqlite.org/c3ref/c_checkpoint_full.html:sqlite WAL checkpoint API doc reference (comment only, not a network call) URL:https://github.com/DeusData/codebase-memory-mcp:project repository self-reference in update/star notice (src/mcp/mcp.c) diff --git a/src/cli/cli.c b/src/cli/cli.c index 04393d101..8413bad12 100644 --- a/src/cli/cli.c +++ b/src/cli/cli.c @@ -11168,6 +11168,12 @@ static bool check_already_latest(void) { #endif /* CBM_CLI_ENABLE_TEST_API */ +/* One token on purpose: the security audit extracts URLs literally, so a URL + * split across string-literal continuations cannot be matched against the + * allow-list. Printed for the user to paste; never fetched by this binary. */ +#define CBM_INSTALL_SH_URL \ + "https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh" + int cbm_cmd_update(int argc, char **argv) { parse_auto_answer(argc, argv); @@ -11257,8 +11263,7 @@ int cbm_cmd_update(int argc, char **argv) { if (have_dir) { printf(" bash \"%s/install.sh\"\n\n", self_dir); } else { - printf(" curl -fsSL https://raw.githubusercontent.com/DeusData/" - "codebase-memory-mcp/main/install.sh | bash\n\n"); + printf(" curl -fsSL " CBM_INSTALL_SH_URL " | bash\n\n"); } printf("It downloads the latest release, verifies its checksum, and replaces\n" "this binary in place. install.sh is idempotent, so re-running it IS\n"