SEC2-083: `check-pin.mjs` accepts a tag name as the pin, and a tag can be moved #11

New issue

Closed

opened 2026-10-17 10:40:20 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-17 10:40:20 +00:00

Owner

Found on 2026-10-16 in a read-only security review of postulo-firefox at c9ee306, checked by a second, independent pass.

Severity: Informational · Category: Configuration · Reference: CWE-494 (Download of Code Without Integrity Check); OWASP A08:2021 (Software and Data Integrity Failures)

Location:

scripts/check-pin.mjs:68-75
source.json:3-4 (the note says to "replace it with the tag at the first release")

Issue

if (ref !== latest.name && ref !== latest.sha) {
  fail(...)
}

Once postulo-chromium has tags, the pin may be the tag's name. The purpose stated at the top of
the file is that "an addons.mozilla.org source submission has to build to the byte from what is
submitted", and a name does not fix bytes: a tag can be deleted and re-created on another commit,
and build.mjs clones over the network at build time and checks out whatever the name resolves to
then. Today the pin is a full SHA, which is the right form.

Impact

None today. At the first release, if the note in source.json is followed literally, the
reproducibility the repository exists for depends on nobody moving a tag.

Fix

Keep the pin a 40-hex SHA always, and let check-pin.mjs require that it equals latest.sha once
tags exist (accept the name only as a hint printed beside it). Change the note in source.json
accordingly.

Done when test/check-pin.test.mjs refuses a tag name once a tag exists.

#1 (closed) asked to "pin a tag or commit SHA" and is satisfied by the SHA; this refines it.

Found on 2026-10-16 in a read-only security review of `postulo-firefox` at `c9ee306`, checked by a second, independent pass. **Severity:** Informational · **Category:** Configuration · **Reference:** CWE-494 (Download of Code Without Integrity Check); OWASP A08:2021 (Software and Data Integrity Failures) **Location:** - `scripts/check-pin.mjs:68-75` - `source.json:3-4` (the note says to "replace it with the tag at the first release") ## Issue ```js if (ref !== latest.name && ref !== latest.sha) { fail(...) } ``` Once postulo-chromium has tags, the pin may be the tag's *name*. The purpose stated at the top of the file is that "an addons.mozilla.org source submission has to build to the byte from what is submitted", and a name does not fix bytes: a tag can be deleted and re-created on another commit, and `build.mjs` clones over the network at build time and checks out whatever the name resolves to then. Today the pin is a full SHA, which is the right form. ## Impact None today. At the first release, if the note in `source.json` is followed literally, the reproducibility the repository exists for depends on nobody moving a tag. ## Fix Keep the pin a 40-hex SHA always, and let `check-pin.mjs` require that it equals `latest.sha` once tags exist (accept the name only as a hint printed beside it). Change the note in `source.json` accordingly. Done when `test/check-pin.test.mjs` refuses a tag name once a tag exists. ## Related #1 (closed) asked to "pin a tag or commit SHA" and is satisfied by the SHA; this refines it.

tiagoagueda added the

enhancement

security

labels

2026-10-17 10:40:20 +00:00

tiagoagueda referenced this issue from Postulo/postulo

2026-10-17 10:41:23 +00:00

SEC2 index: security review of 2026-10-16 (86 issues across the core, plugins and extensions) #992

tiagoagueda referenced this issue from a commit

2026-10-19 07:05:10 +00:00

Pin only a full commit SHA of postulo-chromium, and build nothing else

tiagoagueda referenced this issue