45 lines
2.0 KiB
Markdown
45 lines
2.0 KiB
Markdown
# M13-01F Status
|
|
|
|
status: done
|
|
task: malicious Text, driver, handler, and embedded-module fixtures
|
|
updated: 2026-08-18 America/New_York
|
|
enablingTask: false
|
|
parityStateChange: false
|
|
|
|
## Scope
|
|
|
|
Pinned Blender 5.2 generated a malicious fixture containing four source bodies: OS command text,
|
|
driver import, handler subprocess, and an embedded `register()` module. Chromium opened the file
|
|
through the production Main reader and kept every source read-only/`BLOCKED`; the embedded module
|
|
returned `SCRIPT_POLICY_DENIED`. No filesystem marker or execution path is exposed by the test.
|
|
|
|
## Evidence
|
|
|
|
- `build_blender_5.2.0/bin/blender -b --factory-startup --python
|
|
tools/web/generate-malicious-script-fixture.py -- tests/files/web/m13_malicious_script_v1
|
|
tests/golden/M13-01F/malicious-report.json` generated four deterministic source hashes and one
|
|
`use_module` request.
|
|
- `node tools/web/check-malicious-script-fixture.mjs` passed:
|
|
`malicious-script-fixture-ok sources=4 module=1 execution=BLOCKED fixtureSha256=7b1921931afc5bb74a2b73e90b175017c583ea878cdbb66f131718b2d8cd23b5 next=M13-02A`.
|
|
- `CHROME_PATH=/usr/bin/google-chrome-stable WEB_TEST_PORT=5499 node_modules/.bin/playwright test
|
|
--config playwright.config.ts --workers=1 tests/e2e/malicious-script.spec.ts` passed 1/1.
|
|
- `git diff --check` passed.
|
|
|
|
## Artifact Hashes
|
|
|
|
- generator: `013285befeb59de21a887cefd377adf8cf53ff1c785b28a9c87d29f76f092731`
|
|
- checker: `36608da893ae59e2e03856a62866ea6e7c349ec4a63200f042b2329e5f61caa9`
|
|
- e2e: `98fbde6728ddf55cce5262522197a5b4db1dfce618e52259bf0b0c9e0e9165f2`
|
|
- report: `a628b73411d6f9a761f659ae28867ea9b0c0df30d47668353278b70d4b44180c`
|
|
- fixture: `7b1921931afc5bb74a2b73e90b175017c583ea878cdbb66f131718b2d8cd23b5`
|
|
- manifest: `9a0b7c4097b3755365a9fb92b4848e6ac2ddd36ee2c7e9df3cb8808ce247cf3d`
|
|
|
|
## Next Task
|
|
|
|
`M13-02A`: bounded script manifest limits.
|
|
|
|
## Rollback
|
|
|
|
Remove the generator, checker, fixture, report, manifest, e2e test, and this status entry. Restore
|
|
M13-01E as the queue tail and move the machine queue back to M13-01F. No parity ledger rollback is required.
|